Crypto glossary
Two-factor authentication (2FA)
Two-factor authentication (2FA) is a login method that requires a second proof of identity, such as a one-time code or a security key, besides the password.
With 2FA, knowing a password is not enough to access an account. The user must also provide something they have, usually a six-digit code generated by an authenticator app, a code sent by SMS or a confirmation from a physical security key. Codes from authenticator apps change every 30 seconds and are derived from a secret stored on the device.
Crypto exchanges and custodial services ask for 2FA at login and again for sensitive actions such as withdrawals, changing the email address or adding a new withdrawal address. Combined with withdrawal allowlists and anti-phishing codes in emails, it blocks many account takeovers that start with leaked passwords.
Not all second factors are equally strong. SMS codes can be intercepted through a SIM swap, and one-time codes can still be phished on a fake login page. Hardware security keys based on the FIDO2 standard resist both attacks. Backup codes should be stored offline, because losing the device can lock the owner out.
Example
An attacker who buys a user's leaked exchange password still cannot withdraw funds, because every withdrawal also requires a code from the authenticator app on the user's phone.
