Crypto exchange account security: 2FA, passkeys, whitelist

Crypto exchange account security comes down to five settings: a unique password, 2FA that does not rely on SMS (ideally a passkey or hardware security key), a dedicated and well-protected email address, a withdrawal address whitelist, and a time lock on settings changes. Two-factor authentication exists so that a stolen password alone is not enough to sign in and withdraw. But 2FA methods are not equal: SMS codes can be intercepted through a SIM swap, authenticator codes can be phished on a fake site, and a passkey simply will not work on a fake site.

What 2FA is and what it protects on an exchange

Two-factor authentication means proving who you are with two different kinds of evidence: something you know (a password) plus something you have (a phone, a key) or something you are (a fingerprint, a face). On an exchange the second factor is usually requested not only at sign-in but also for withdrawals, API key creation and security changes.

The numbers show why it matters. The FBI IC3 2025 annual report lists account takeover as its own line: roughly 4,700 complaints and $359.7 million in losses, or about $76,500 per complaint (our calculation from those two figures). That covers the US only, and only people who filed a report. An FBI alert dated November 25, 2025 describes the typical playbook: a criminal poses as a financial institution's support staff, talks the victim out of their login and one-time code, resets the password and moves the money out, often through crypto wallets.

A blockchain transfer cannot be reversed, so a mistake costs more on an exchange than at a bank. Once coins leave, they rarely come back.

Which second factor to choose: methods compared

The US cybersecurity agency CISA ranks methods from strongest to weakest in its fact sheet on phishing-resistant MFA (October 2022): FIDO/WebAuthn sits at the top, followed by one-time-code apps and push notifications with number matching. For SMS and voice codes, the fact sheet separately notes exposure to SIM swapping and to SS7 protocol vulnerabilities.

Why the difference? Under RFC 6238, a TOTP code is computed on the device itself from a shared secret and the current time, with a recommended 30-second step. It never travels over the carrier network, so a SIM swap does not touch it. But a person types it by hand, which means it can be typed into the wrong site.

A passkey works differently. The device creates a key pair, the private key never leaves it, and each signature is tied to the website's domain. That binding is part of the WebAuthn standard that passkeys are built on, as the FIDO Alliance describes them. On a look-alike domain, the key for the real exchange will not respond, whatever the user clicks.

NIST's SP 800⁠–⁠63B, Revision 4 puts the same idea into formal language: manually entered one-time codes are not considered phishing-resistant; codes sent over the phone network (SMS and voice) are a "restricted" authenticator, for which a service must offer an alternative; and email may not be used to deliver such codes.

Why SMS is the weak link

In a SIM swap, a fraudster persuades a mobile carrier to move the victim's number to a SIM card they control. From then on they receive every text message, including sign-in and password reset codes. They never need to hold the victim's phone.

FBI IC3 reports show the number of complaints edging down, while the sums remain large:

The source is the tables in the 2025 IC3 report; the 2025 average works out to about $17,900 per complaint (our calculation).

How much weaker SMS is was measured by Google together with New York University and UC San Diego. In their study, published May 17, 2019, an SMS code blocked 100% of automated bots, 96% of bulk phishing and 76% of targeted attacks; an on-device prompt blocked 100%, 99% and 90%. Among users who signed in exclusively with security keys, none fell victim to targeted phishing during the study. One caveat: those were Google accounts and 2019 data, and the owner of a crypto exchange account is more likely to face exactly the targeted kind of attack.

The takeaway is simple. SMS beats nothing, but anyone holding coins should treat it as a stopgap. And if SMS stays enabled as a fallback for sign-in or recovery, the account is only as strong as SMS.

Why an authenticator app does not stop phishing

Modern phishing kits act as a relay (adversary-in-the-middle). The fake page passes the password and code to the real site in real time, receives a session cookie in return and hands it to the attacker. Microsoft described one such campaign on July 12, 2022: since September 2021 it had attempted to target more than 10,000 organizations and got past MFA. Microsoft names FIDO2 and certificate-based sign-in as the defense.

For an exchange user, this means an authenticator app protects against a leaked password and a SIM swap, but not against a link in a "confirm your withdrawal" email or a search ad. The same FBI alert describes fake ads that push a phishing site above the real one. We covered other schemes in our guide to spotting crypto scams.

How to secure your exchange account, step by step

1. Password. Unique, long, generated by a password manager. Kraken's help center recommends at least 15 characters.
2. Email. A dedicated address used only for the exchange, with its own password and non-SMS 2FA. Exchange passwords are reset through email, which makes the mailbox more important than the exchange login.
3. Passkeys. Register two, for example a phone and a hardware key. One lost device should not lock you out.
4. Authenticator app if passkeys are not available. Write the backup code on paper, the way you would a seed phrase; a screenshot in the cloud does not count.
5. Remove SMS from sign-in and recovery methods once a stronger factor is working.
6. Require 2FA for withdrawals, API keys and trading. On many exchanges this is a separate switch from sign-in.
7. Turn on the withdrawal address whitelist and a hold on new addresses.
8. Set an anti-phishing code, a word the exchange inserts into its emails. An email without it is not from the exchange.
9. Lock your settings if the exchange offers it, so changes take effect only after a waiting period.
10. Use a bookmark, not a search. Open the exchange from a bookmark or the app, never from a link in an email, a chat or an ad.

With your mobile carrier, set a SIM PIN and a port-out lock. In the US, FCC rules published on December 8, 2023 require carriers to authenticate customers securely before a SIM change and to notify them of such requests. Elsewhere, the protections on offer depend on the carrier.

Withdrawal whitelist and time locks

A whitelist is the last line of defense if the login is compromised anyway. With it on, funds can go only to addresses approved in advance. According to Binance's help center, the list holds up to 200 addresses, and an extra setting suspends withdrawals to a newly added address for 24, 48 or 72 hours. Kraken's Global Settings Lock plays a similar role: while it is on, settings and withdrawal addresses cannot be changed, and without the master key, removing the lock takes a waiting period of 1 to 30 days (3 by default, per Kraken's help center).

The point of a delay is time. An intruder who adds their own address cannot withdraw right away, while the owner gets an email about the change and can freeze the account. The price is convenience: you cannot send coins to a brand-new address in a hurry. For long-term holdings that is closer to a feature. Active traders should add their own wallets ahead of time.

What it looks like in numbers: November 13, 2026

As of November 13, 2026, 3:00 AM ET, bitcoin traded near $68,594, down 6.9% over 24 hours, with the Fear & Greed Index at 20, "extreme fear" (our data, see Market pulse). At that price 0.25 BTC is worth about $17,150, close to what the average FBI complainant lost to a SIM swap in 2025.

Days with sharp moves carry a second risk. A drop of several percent is a reason to rush into the exchange, and haste and anxiety are what the "suspicious activity on your account" messages in the FBI alert are built on. The live price and market state are on our dashboard and the bitcoin page, and neither asks you to sign in or enter a code.

Limitations: what 2FA does not do

• It does not protect against a hack of the exchange itself. In the Binance hot wallet hack of October 29, 2026, user settings played no part. Only your own cold wallet and a careful choice of exchange address that risk.
• It does not stop malware on your device that steals a session after sign-in or swaps the address in your clipboard.
• It does not cover API keys. A key with withdrawal permission works without 2FA. Grant keys read and trade rights only, and bind them to an IP address.
• Synced passkeys depend on a cloud account (Apple, Google, a password manager), which needs protection that is at least as strong. NIST does not allow such keys at its highest assurance level, which calls for a hardware key that cannot be exported.
• Account recovery is a side door. If support will reset 2FA based on a selfie and an email, that process is what attackers will go after.

Common mistakes

• Enabling a passkey and leaving SMS as a fallback sign-in method.
• Keeping backup codes in notes, email or photos.
• Having a single passkey on a single phone.
• Using your everyday email, with a phone number set for recovery.
• Reading a code to "support staff." Real support never asks for your password or 2FA code.
• Approving a push prompt you did not trigger.

If the account is compromised anyway: freeze it through the official button or support, change the email and exchange passwords from a clean device, revoke API keys and active sessions, save the emails and transaction hashes, and report it to the police in your country (in the US, at ic3.gov). Speed matters, because an exchange can stop a withdrawal before it is broadcast to the network.

FAQ

Which is safer, Google Authenticator or SMS? An authenticator app. Its codes are generated on the device and do not depend on your carrier. It does not protect against a fake website, though; that takes a passkey or a hardware key.

What if I lose the phone with my authenticator app? Sign in with a backup passkey, or restore the app from the backup code you wrote down during setup. Without either, you are left with recovery through support, which takes days.

Do I need a hardware key for a small balance? A passkey on your phone gives the same phishing protection for free. A hardware key makes sense as a second, backup key and for larger balances.

Is 2FA enough to keep coins on an exchange? No. 2FA protects your login, not the exchange. Coins you are not trading are safer in a wallet whose keys only you hold.

This is not investment advice.