Two-factor authentication (2FA)

Two-factor authentication (2FA) adds a second check when you log in or withdraw, on top of your password. Even if someone steals your password, they also need the second factor.

The options are not equally strong. SMS codes are the weakest, because attackers can hijack your phone number through a SIM swap. Authenticator apps such as Google Authenticator, Microsoft Authenticator or Authy generate time-based codes on your phone and are much safer. Hardware security keys and passkeys using the FIDO2 standard, such as YubiKey, are the strongest because they resist phishing websites.

On crypto exchanges, turn on 2FA for logins and withdrawals, use an authenticator app or security key rather than SMS where possible, and enable a withdrawal address allowlist if offered. Save the backup codes offline, since losing your phone without them can lock you out. Never share a 2FA code with anyone, including people claiming to be from support.