Security · Reviewed Aug 19, 2026 · 7 min read
2FA on Exchanges: SMS, TOTP, Hardware Keys and Passkeys
Most exchange account losses start with weak 2FA. Here is the honest ranking of your options.
Reviewed by CryptoExID Editorial · Aug 19, 2026 · Editorial policy · how we make money
Why 2FA is where accounts are won or lost
Exchange-level hacks make headlines, but most individual losses start with an account takeover: a reused password from an old breach, a phishing page, a hijacked phone number. Two-factor authentication is the layer that decides whether a stolen password matters. The type of 2FA you pick matters more than having it at all.
We keep seeing the same story in complaint threads. Someone enabled 2FA years ago, chose SMS because it was easy, and discovered during a SIM-swap that their second factor belonged to whoever controlled their phone number.
SMS: the weakest link
SMS codes fail because your phone number is not yours in any secure sense. It is an account at a carrier, transferable by a support rep who believes a good story. SIM-swap attacks, where a criminal ports your number to their SIM, have drained crypto accounts for a decade, and courts keep filling with cases where six-figure balances vanished this way.
SMS also falls to real-time phishing: a fake login page relays your code to the real site within its validity window. If SMS is your current second factor, replacing it is the single highest-value security change you can make today.
TOTP apps: the sensible baseline
Time-based one-time passwords, from apps like Google Authenticator or Aegis, generate codes from a secret stored on your device. Nothing travels over the carrier network, so SIM-swaps become irrelevant. Every serious exchange supports TOTP, and it should be your minimum standard.
TOTP still has two gaps. A phishing page can relay a code in real time, just like SMS. And the backup seed you saved at setup is a permanent copy of your second factor; store it in a cloud note and a compromised email account becomes a compromised exchange account.
Hardware keys and passkeys: phishing-proof
Hardware security keys and passkeys both use the FIDO2 standard, and both fix the flaw everything above shares. The credential is cryptographically bound to the real domain, so a lookalike phishing site receives nothing usable no matter how convincing it looks. This is the only 2FA class that removes the human judgment call from the loop.
Passkeys are the same protection without the physical dongle, synced through your device platform, which is why exchanges are moving to them: they get hardware-grade phishing resistance with none of the shipping-a-YubiKey friction. Coinbase, Kraken and Binance all support FIDO2 keys or passkeys today. If your venue offers them, there is no good reason to stay on TOTP alone.
Setup choices that decide outcomes
Register two hardware keys or passkeys, keeping one offline as backup, and then remove SMS as a fallback entirely. Attackers do not attack your strongest factor; they ask support to fall back to your weakest one. An account with a hardware key and an SMS fallback is an SMS-protected account.
Apply 2FA to withdrawals and API keys, not just login, and pair it with a withdrawal whitelist. When we evaluate account security in our reviews, we check exactly this stack: passkey or hardware key support, TOTP, whitelists, anti-phishing codes. Venues offering only SMS lose points, because that choice exposes every one of their users.
FAQ
What is the best 2FA for a crypto exchange?
A hardware security key or passkey, because FIDO2 credentials are bound to the real domain and cannot be phished. TOTP apps are an acceptable baseline. SMS should be avoided and removed as a fallback.
What is a SIM-swap attack?
A criminal convinces or bribes your mobile carrier to port your number to their SIM. Every SMS code then goes to them, and they reset their way into your accounts. It has drained crypto accounts for a decade.
Are passkeys as secure as hardware keys?
Against phishing, yes, both use the same FIDO2 standard. The difference is custody of the credential: hardware keys hold it in a dedicated device, while passkeys sync through your platform account, which becomes the thing to protect.
Why do exchanges still offer SMS 2FA?
Convenience and support costs. SMS works on any phone with zero setup, so it maximizes adoption. That trade-off benefits the exchange's funnel more than your security, which is why we score venues down for SMS-only 2FA.
Can 2FA stop a phishing attack?
Only FIDO2 can. SMS and TOTP codes can be relayed through a fake login page in real time. Hardware keys and passkeys refuse to authenticate to the wrong domain, taking the decision out of your hands.