Passkeys and Two-Factor Authentication on Exchanges

Exchange accounts hold a large share of many people's crypto. They are protected by logins rather than seed phrases, which makes account security the main defence against theft. Attackers use phishing, password leaks and SIM swaps to take over exchange accounts and withdraw funds. Strong authentication stops most of these attacks.

Authentication options compared

Method	How it works	Protection level
Password only	Something you know	Weak
SMS codes	Code sent to your phone number	Vulnerable to SIM swaps and interception
Email codes	Code sent to email	Only as strong as your email security
Authenticator app	Time-based codes on your device	Strong against remote attacks, vulnerable to phishing sites
Security key	Physical device confirms login	Very strong, resistant to phishing
Passkey	Device-based cryptographic login	Very strong, resistant to phishing

Security keys and passkeys verify the real website domain, so they do not work on phishing sites. That makes them particularly valuable for crypto.

Passkeys explained

A passkey replaces or supplements a password with a cryptographic key stored on your device or in a password manager. When you log in, your device proves possession of the key, usually after a fingerprint, face scan or PIN.

Benefits include:

• No password to steal or reuse
• Built-in phishing resistance
• Simple login experience

Where exchanges support passkeys, they are often one of the best options available. Keep at least two passkeys or a backup method so losing one device does not lock you out.

Setting up strong protection

A practical setup for an exchange account:

1. Use a unique password generated by a password manager, even if you add a passkey
2. Add a passkey or hardware security key as the main second factor
3. Add an authenticator app as a backup if security keys are not available everywhere
4. Remove SMS as a second factor or recovery option where possible
5. Save backup codes offline in a secure place
6. Secure the email address linked to the exchange with the same strong methods

Withdrawal protections

Many exchanges offer extra safeguards:

• Withdrawal address allowlists, so funds can only go to pre-approved addresses
• Time delays after adding new withdrawal addresses
• Anti-phishing codes shown in genuine emails
• Login and withdrawal notifications
• Device management, showing and revoking logged-in devices

Enabling an allowlist is one of the strongest protections. Even if an attacker logs in, they cannot withdraw to their own address without passing extra checks and delays.

Recognising exchange phishing

Attackers imitate exchanges with:

• Emails about suspicious logins with links to fake pages
• Search ads leading to lookalike login pages
• Fake support calls requesting codes
• Messages about account verification or tax forms

Always reach the exchange through a bookmark or the official app. Never share authentication codes with anyone, including people claiming to be support.

Managing backup codes

Backup codes let you recover access if you lose your authentication device. Treat them like keys:

• Store them offline, such as printed in a safe
• Do not store them in email or cloud notes
• Replace them if you think they were exposed

Regular security reviews

Every few months, check:

• Active sessions and devices
• Connected API keys and their permissions
• Withdrawal allowlist entries
• Security settings after exchange interface updates

Remove API keys you no longer use, and never give withdrawal permissions to third-party tools unless necessary.

Use exchange withdrawals safely

When paying merchants directly from an exchange, use withdrawal allowlists for addresses you pay regularly and double-check the network. Proud Globe order pages show the exact network and amount so exchange users can set up withdrawals correctly when they claim a tile.