Two-factor authentication (2FA)

A password can be phished, reused from a breached site or guessed. Two-factor authentication requires a second thing you have — a code from an app on your phone, a physical security key, a passkey stored on your device — before the login or the withdrawal goes through. On an exchange, where a successful login can empty the account in one transaction, it is the single most effective thing you control.

Not all second factors are equal. SMS codes can be intercepted by moving your phone number to an attacker's SIM, and every major exchange breach involving individual accounts has used that route somewhere. Authenticator apps are better; hardware keys and passkeys are better again, because they cannot be phished — the key only answers the real site. We list which options each exchange supports on its data sheet; all eight support an authenticator app; Kraken, Coinbase and Binance support hardware keys; Binance, Bybit, OKX, Kraken and Coinbase support passkeys.

Set it up before the first deposit, use the strongest option the exchange offers, enable a withdrawal whitelist if the venue has one, and — at Kraken specifically — consider the global settings lock, which blocks changes to security settings for a chosen period even from an authenticated session.