How to protect your crypto exchange account: 2FA, passkeys and common questions

Victims told the FBI they lost $11.37 billion to crypto-related crime in 2025, across 181,565 complaints, the bureau’s Internet Crime Complaint Center reports. A thief who takes over your account has no need to break the exchange. To protect your crypto exchange account, start with the second factor.

Which second factor to choose

The US cyber agency CISA ranks login methods from strongest to weakest. It calls FIDO/WebAuthn, the standard behind passkeys and hardware security keys, “the only widely available phishing-resistant authentication”. The order for your exchange:

• hardware security key or passkey: phishing-resistant, and your best choice;
• authenticator app: strong against SIM swaps, but a phishing site can capture the code;
• SMS or voice code: the weakest, open to SIM swaps and attacks on the phone network.

Move off SMS first. CISA says attackers can talk a carrier into moving your number to their SIM card, and then read your codes. The FBI logged 971 SIM swap complaints and $17.4 million in losses in 2025, and that line misses thefts filed under other crime types.

A passkey works only on the real site, so a lookalike page cannot use it, Kraken explains. Set up at least two: a second key saves you when you lose the first. Coinbase also advises adding methods beyond SMS, its default.

Anti-phishing code and withdrawal whitelist

Binance lets you set an anti-phishing code of 4 to 20 characters under Profile, Security. Genuine Binance emails then show that code, so an email without it deserves suspicion. Turn on the withdrawal whitelist too: the account can then send only to addresses you approved in advance, so a thief cannot send the funds to their own wallet.

Give the exchange a separate email address with its own passkey, since password resets land there. Log in through a bookmark or the official app, never through a link in a message or a search ad.

Frequently asked questions

Someone from support called me. Is that real? Hang up. The FBI recorded about 4,700 complaints and $359.7 million of losses in 2025 from account takeover by people posing as financial institution support. Nobody from a real exchange needs your password or code.

Is SMS better than no 2FA? Yes. “Any form of MFA is better than no MFA,” CISA says. Treat SMS as a stopgap until you set up a passkey.

What if I lose the phone with my authenticator app? Without a backup, you face a slow account recovery. Save your recovery codes on paper and add a second method now. Kraken also warns that codes synced to a Google, Apple or Microsoft account fall if that account falls.

Does 2FA protect me if the exchange itself gets hacked? No. In the Binance hack attackers went through an engineer’s laptop, and your settings play no part in that. Keep what you do not trade in a cold wallet you control, and read our wallet guide first.

Someone got into my account. What now? From a clean device, change the password, remove unknown devices and API keys, and contact support through the official app. Then call your carrier if you suspect a SIM swap. US victims can file at ic3.gov. Crypto transfers do not reverse, so act within minutes.

What to do today

If you have ten minutes today, replace SMS with a passkey, then switch on the whitelist. Together they block a thief who holds only your password.

Based on the FBI’s 2025 IC3 report, CISA’s fact sheet on phishing-resistant MFA, and Kraken, Coinbase and Binance help pages, checked on 9 November 2026. Menu names vary by exchange and region. This is not investment advice.