Two-Factor Authentication

Two-factor authentication (2FA) is a login protection that requires a second proof of identity beyond your password, so that a stolen password alone is not enough to access an account. The second factor is typically something you have, such as a code from an authenticator app or a hardware security key, in addition to something you know.

For example, logging into a crypto exchange with 2FA enabled means entering your password and then a six-digit code generated by an app like Google Authenticator, or touching a physical security key. An attacker who phished your password from a fake site still cannot log in or withdraw funds without that second factor.

Not all second factors are equal. SMS codes are the weakest option because attackers can hijack phone numbers through SIM swap attacks, a technique used repeatedly against crypto holders; authenticator apps are substantially better, and hardware security keys using standards like FIDO2 are the strongest because they resist phishing entirely. A common misconception is that 2FA protects self-custody wallets; it protects accounts with a login, such as exchanges and email, while a blockchain wallet is controlled purely by its private key. Securing the email account tied to your exchange with strong 2FA matters too, since email is usually the recovery route.