Two-Factor Authentication for Crypto Accounts: What to Use and What to Avoid
For a crypto exchange account, use a hardware security key if the platform supports one and an authenticator app if it does not, and move off SMS codes as your second factor because a phone number can be taken over by someone who never touches your device.
Updated · By RampAtlas Research
Key takeaways
- Use a hardware security key where the exchange supports one, an authenticator app otherwise, and treat SMS as the option of last resort.
- NIST classifies out-of-band authentication over the public telephone network as RESTRICTED, requiring risk assessment and a non-restricted alternative.
- A security key signs over the full origin of the site requesting authentication, so a code cannot be replayed against a lookalike domain.
- An authenticator app code is still phishable, because a convincing fake login page can collect it and use it within its short validity window.
- Two-factor authentication protects an exchange account and does nothing for a self-custody wallet, where the recovery phrase is the only credential.
In this guide
For a crypto exchange account, use a hardware security key if the platform supports one and an authenticator app if it does not, and move off SMS codes as your second factor because a phone number can be taken over by someone who never touches your device.
Account takeover is how most exchange balances are stolen. The attacker does not break the exchange, they sign in as you. Your second factor is the control that decides whether a stolen password is enough, so the type you choose matters more than the fact that you enabled something.
The three options, ranked
The methods available on a typical exchange account fall into three tiers, and the ranking is about how they fail rather than how they feel to use.
| Method | What it is | Stops a SIM swap | Stops phishing |
|---|---|---|---|
| Hardware security key | A physical device you tap or plug in | Yes | Yes. The full origin is signed over, so a lookalike domain produces nothing usable |
| Authenticator app | A six-digit code that changes every thirty seconds, computed on your device from a shared secret | Yes. Nothing travels over the phone network | No. A fake login page can collect the code and relay it inside its short validity window |
| SMS code | A message sent to your phone number | No. The number is an account with a carrier, and carriers can be persuaded to move it | No |
All three stop someone who only has your password. They diverge sharply once the attacker is putting effort in.
Why SMS is the weakest choice
A phone number is not a device. It is an account with a carrier, and carriers can be persuaded to move it. In a SIM swap the attacker convinces the carrier that they are you and need the number on a new SIM, at which point every code sent to that number goes to them. Nothing in your possession changed, and your phone simply stops receiving service.
The standards bodies treat this as a known structural weakness. NIST classifies out-of-band authentication over the public switched telephone network as RESTRICTED, describing it in section 5.1.3.3 and the restricted-authenticator rules of section 5.2.10, which require an organization using it to assess and accept the risk, offer subscribers a non-restricted alternative at the same assurance level, give meaningful notice of the risk, and maintain a migration plan (source: NIST Special Publication 800-63B). That is the language of a method being phased out, not a method being endorsed.
SMS is still better than nothing. If it is the only second factor your platform offers, enable it, and separately ask your carrier for a port-out PIN or account lock, which is the control that actually addresses the attack.
Authenticator apps
A time-based one-time password app is the practical default. At setup the site shows a QR code containing a shared secret, your app stores it, and both sides compute the same six-digit code from that secret and the current time. Nothing travels over the phone network, so a SIM swap is irrelevant.
Two things to get right. First, save the recovery codes the exchange gives you at setup, offline, in the same place you keep other irreplaceable records. Losing your phone with no recovery codes means an identity-verification process with support, which is slow and sometimes unsuccessful.
If your authenticator app backs up its secrets to the cloud, that convenience also means your second factor is protected by your cloud account password. That is a reasonable trade for many people and an unacceptable one for a large balance. Decide rather than accept the default.
Hardware security keys
A security key is the only common method that resists the fake-login attack, and the reason is technical rather than behavioral. Under the WebAuthn standard, the full origin of the requester is included and signed over in the assertion the key produces, and each credential is scoped to a Relying Party Identifier that the authenticator enforces, so a credential created for one site cannot be used in an operation requested by another (source: W3C Web Authentication Level 2). A lookalike domain is a different origin, so the key produces nothing usable there.
That is why a key protects you even on a bad day. Phishing works by catching people who are tired, rushed, or convinced, and a security key removes the judgment call from the loop entirely.
Set it up on the accounts that matter, in order
- The email address attached to your exchange accounts. Email is the recovery channel for almost everything else, so an attacker who owns the inbox can work through your other accounts at leisure.
- The exchange accounts themselves. Enable the strongest factor offered, then turn on the adjacent controls in the same settings screen. Withdrawal address whitelisting restricts payouts to addresses you pre-approved and usually imposes a waiting period on new ones, which converts a successful account takeover into a delay rather than a loss. Withdrawal confirmation by email, session management, and login alerts are all worth switching on at the same time.
- The phone carrier account, with a port-out lock.
Security settings differ by platform, so read the ones on your own account rather than assuming. The exchanges we track are listed at Exchanges, including Coinbase, Kraken, and Binance, and each page links to that operator's own documentation.
What two-factor authentication does not cover
A custodial account has a login, so a second factor applies. A hardware wallet plays a similar role in the self-custody world, and its setup is covered in Hardware wallet setup.
It also does nothing about a transaction you authorize yourself. Approving a malicious contract, sending to an attacker's address, or paying a fake support agent all happen with correct credentials, which is why Spot a crypto scam covers a separate class of loss. The decision about how much to leave on a platform at all is in Self custody vs exchange custody, and if you are still choosing where to buy, start from an asset page such as Buy Bitcoin.
Frequently Asked Questions
Is an authenticator app good enough, or do I really need a hardware key?
An authenticator app stops password reuse, credential stuffing, and SIM swaps, which covers most real attacks. A hardware key additionally stops phishing, which is the attack that catches careful people. The larger the balance, the more that last category is worth buying out.
What happens if I lose my phone with the authenticator app on it?
You use the recovery codes saved at setup. Without them you enter the exchange's account recovery process, which typically means repeating kyc identity verification and waiting. Save the codes when you enable the factor, not later.
Can I use the same security key on several exchanges?
Yes. One key registers with many sites, and each credential is separate and scoped to its own site. Register a backup key everywhere you register the primary.
Does two-factor authentication protect me if the exchange itself is breached?
Only partially. It protects your login, and it does not protect assets the exchange holds if the company is compromised, insolvent, or freezes withdrawals. That risk is addressed by moving funds out, as described in Move crypto off exchange.
Should I turn off SMS once I add an authenticator app?
Where the platform allows it, yes. Leaving SMS enabled as a fallback means an attacker can choose the weakest method, so a backup channel you never use is still an open door.