How to Set Up Two-Factor Authentication (2FA) for Crypto

A strong password is not enough to protect a crypto account on its own. Passwords get leaked, guessed, and phished every day. Two-factor authentication — usually shortened to 2FA — is the single most effective free step you can take to lock down your exchange or wallet account, and it takes about two minutes to set up.

This guide explains what 2FA is, which type is safest, and exactly how to turn it on — described generically so it works on most exchanges and wallets, not just one brand.

Two-factor authentication (2FA) means proving who you are with two different things instead of one. The first factor is usually something you know (your password). The second is something you have (a code from an app on your phone, or a physical key you tap). You'll sometimes see it called MFA (multi-factor authentication) — the same idea with one or more extra factors.

Why it matters: even if a hacker steals or guesses your password, they still can't log in without that second factor. Security guidance from the U.S. Cybersecurity and Infrastructure Security Agency (CISA) states that turning on multi-factor authentication makes you significantly less likely to be hacked. For crypto — where a stolen account can mean permanently lost funds — that extra layer is essential, not optional.

Most exchanges and wallets offer one or more of the three methods below. They are not equally safe.

Bottom line: use an authenticator app or a passkey / security key whenever the option exists. Treat SMS as a last resort, and never as your only protection.

The wording differs slightly from one platform to another, but on most exchanges and wallets — such as Coinbase, Kraken, Bitget, or Bybit — the flow is the same. First, install a trusted authenticator app from your phone's official app store. Then:

1. Open your security settings. Log in, go to your account or profile menu, and find the "Security," "Two-Factor Authentication," or "2FA" section.
2. Choose "Authenticator app" (sometimes labelled "TOTP" or "Google Authenticator") rather than SMS.
3. Scan the QR code. The site shows a QR code. Open your authenticator app, tap "add" or "+", and scan it. The app instantly starts showing a 6-digit code for that account.
4. Enter the code. Type the current 6-digit code from your app into the site to prove the link works. Because codes refresh every 30 seconds, do it before it expires.
5. Confirm and save backup codes. The site confirms 2FA is on and usually shows a set of one-time backup codes — save these (see the next section).

From now on, each login asks for your password and the current code from your app. If your platform offers a passkey or security key instead, choose "Add security key / passkey" in the same menu and follow the prompt to tap or register your device.

Backup codes (also called recovery codes) are a short list of one-time passwords the platform gives you when you enable 2FA. If you ever lose, break, or wipe the phone that holds your authenticator app, these codes are how you get back into your account.

Store them the same way you would a wallet seed phrase — offline and private:

• Write them on paper and keep it somewhere safe, such as a locked drawer or a home safe.
• Do not save them in email, cloud notes, screenshots, or a chat to yourself — anything online can be breached.
• If you must store them digitally, use a reputable password manager that keeps them encrypted.
• Keep a second copy in a separate safe location in case the first is lost or damaged.

Each backup code usually works only once, so cross one off after you use it. If you run low, most platforms let you generate a fresh set in the security settings.

• Prefer an authenticator app or passkey. Only fall back to SMS if a platform offers nothing else — and switch to a stronger method as soon as one is available.
• Protect the device that holds your authenticator app with a screen lock (PIN, fingerprint, or face) and keep it updated.
• Avoid SMS 2FA for anything holding funds, because of the SIM-swap risk. Ask your mobile carrier to add a port-out PIN or account lock for extra protection.
• Enable 2FA everywhere it matters — not just exchanges, but also the email account you use for crypto, since that email can reset your other logins.
• Keep backups. Save your backup codes offline and, for hardware keys, register a spare key.
• Never read your code to anyone. No real support agent will ever ask for it.

2FA is one layer of a bigger habit. For the full picture, read our guide on how to protect crypto from hackers.

• Losing the phone with no backup. If your authenticator app is only on one device and you never saved backup codes, you can be locked out for good.
• Using SMS only. A text-code-only account is exposed to SIM-swap attacks — add an authenticator app or passkey.
• Screenshotting the QR code or secret key. A screenshot sitting in your photo roll or cloud backup hands an attacker the keys to your 2FA.
• Entering your code on a link from an email or message. Always type the site address yourself; a phishing page will happily forward your code to the real site in real time.
• Enabling 2FA on the exchange but not on your email. A hacked email can be used to reset your other accounts.

Yes — any 2FA is safer than a password alone. But SMS is the weakest option because of SIM-swap attacks, where a scammer takes over your phone number. Use an authenticator app or passkey instead whenever you can.

You use one of the backup codes you saved when setting up 2FA to log in, then re-add the authenticator on your new phone. If you saved the setup key offline, you can restore the account directly. Without backups, you may have to go through the platform's account-recovery process, which can take time.

No. One authenticator app can hold codes for many accounts — your exchange, email, and more all live side by side in the same app, each with its own rotating code.

A passkey or hardware security key proves your identity using cryptography tied to the real website, so it can't be tricked by a fake login page. It's the most phishing-resistant option. If you hold meaningful funds, it's well worth the small cost.

A hardware wallet is already a form of second factor because transactions must be approved on the device itself. The 2FA in this guide mainly applies to online accounts like exchanges and the email tied to them. To understand the difference, see our guide on what a crypto wallet is.

2FA adds a second check to your login so a stolen password isn't enough to break in. An authenticator app or a passkey / security key is far safer than SMS, which is exposed to SIM-swap attacks. Turning it on takes minutes: open security settings, choose authenticator app, scan the QR code, enter the code, and save your backup codes offline. Do that on your exchange and your email, and you've closed one of the biggest gaps a beginner can leave open.

Next step: see the full security checklist in how to protect crypto from hackers, or get the big-picture view in is crypto safe?

• CISA — Turn on multifactor authentication
• Google — Get verification codes with Google Authenticator