Two-Factor Authentication for Crypto Accounts

SIM swapping has cost crypto holders hundreds of millions, and it defeats SMS two-factor authentication completely.

Why SMS is not enough

A SIM swap means an attacker persuades your mobile operator to transfer your number to their SIM card. They typically use personal details gathered from data breaches and social media, and sometimes a bribed insider. Once the number is theirs, every SMS code goes to them — including password resets.

The attack has been used repeatedly against crypto holders specifically, with individual losses in the millions and total reported losses in the hundreds of millions. Prosecutions have followed in several countries, which has not stopped it.

Defences worth applying regardless of which second factor you use:

• Add a port-out PIN or account passcode with your mobile operator.
• Remove your phone number from accounts that do not need it.
• Avoid publicly linking your phone number to crypto activity.
• Use an email address for crypto accounts that is not used anywhere else.

The options, ranked

Authenticator apps generate a time-based code from a secret stored on your device. Nothing is transmitted, so there is nothing to intercept. This is the minimum standard for any crypto account.

Hardware security keys are stronger for a specific reason: the key verifies the website it is talking to. A phishing site at a lookalike domain cannot obtain a valid response, because the cryptographic challenge is bound to the real origin. This defeats the attack that beats every code-based method, since a code you can read out is a code you can be tricked into reading out.

Avoiding lock-out

Stronger authentication creates a new risk: losing access yourself. Plan for it before it happens.

• Save the recovery codes the service issues when you enable two-factor authentication. Print them and store them offline with your other important documents.
• Save the TOTP secret — the QR code or text string — when setting up an authenticator app, so you can re-add it on a new phone.
• Register two hardware keys. One kept with you, one stored securely elsewhere. Single-key setups fail badly when the key is lost.
• Do not rely solely on a cloud-synced authenticator, which reintroduces the risk of the cloud account being compromised.

Beyond two-factor

Two-factor authentication protects an account login. It does not protect a wallet, because a wallet has no login — possession of the key is the only authorisation. The two problems need different solutions.

For exchange accounts, additionally enable: withdrawal address whitelisting (so funds can only leave to addresses you pre-approved, usually with a delay), withdrawal confirmation by email, anti-phishing codes that appear in genuine emails, and session and device management so you can see and revoke active logins.

For self-custody, the equivalent controls are a hardware wallet, a passphrase, and multi-signature arrangements for larger amounts. No password protects a seed phrase someone has already read.