Crypto 2FA: Authenticator App, SMS, Passkey and Reset Steps

A password alone is one stolen string away from an empty account. Two-factor authentication (2FA) adds a second step: a code or a device that only you have. This guide compares the 2FA methods each exchange supports, shows how to set up an authenticator app, and explains what happens when the phone is lost.

Short version

Turn on 2FA before depositing anything. An authenticator app or a passkey is the usual choice; SMS is weaker and Gate does not offer it. During setup, save the backup key offline. It is what lets you move 2FA to a new phone without a support case. If 2FA is lost anyway, expect a waiting period: on Binance, withdrawals stay disabled for 48 hours after a reset.

What most often goes wrong with 2FA

• Phone lost, no backup key: a reset through support, with waiting periods and sometimes a video check.
• Codes given away: scammers posing as support ask for “the 6-digit code to verify your account”.
• SMS as the only factor: whoever takes over the phone number receives the codes.

Who this guide is for

Item	Details
Good fit	New account holders turning on 2FA for the first time
Good fit	Users still relying on SMS who want to switch
Good fit	Anyone who lost a phone and needs to reset 2FA
Not for	Self-custody wallets: they use a seed phrase, not exchange 2FA
Not for	Recovering a hacked account: contact the exchange’s official support directly
You need	A smartphone, an authenticator app, paper for the backup key

Setup in five steps

1. Install an authenticator app the exchange accepts.
2. Open the exchange’s security page and choose authenticator 2FA.
3. Scan the QR code or paste the key into the app.
4. Write the backup key on paper and store it offline.
5. Enter the 6-digit code to confirm, then test a login.

Which 2FA methods each exchange supports

The four exchanges below are in alphabetical order. Support is not the same everywhere, especially for SMS and passkeys.

Exchange	Security key	Authenticator app	Passkey	SMS	Email
Binance	Yes (e.g. YubiKey)	Binance Authenticator, Google Authenticator	Not in the list checked	Yes	Yes
Bitget	Not listed	Google Authenticator	Yes	Yes	Not listed as 2FA
Bybit	Not listed	Google Authenticator (“Google 2FA”)	Yes (FIDO, biometrics)	Not listed as 2FA	Not listed as 2FA
Gate	Not listed	Google Authenticator or Gate Authenticator (the only two Gate recognizes)	Has a passkey page; its role in the 2FA menu was not confirmed	No	Not listed as 2FA

Checked November 8, 2026; the official pages are the reference.

What the differences mean

• Bitget officially recommends Google Authenticator or Passkey over SMS.
• Gate gives no SMS option, so an authenticator app is required.
• Binance is the only one of the four with a hardware security key in its list.

Which method is harder to steal

No method is perfect. The question is what an attacker needs to get past it.

Method	What an attacker needs	Weak point
SMS code	Control of the phone number (for example, moving it to another SIM)	Depends on the mobile carrier, not on you
Email code	Access to the email inbox	Email passwords leak often; one inbox may open several accounts
Authenticator app	The phone, or the backup key	Phishing pages can still ask for a live code
Passkey	The device and its unlock (fingerprint, face or PIN)	Losing the device without another 2FA method set up
Security key	The physical key	Losing the key without a backup method

So what to do: use an authenticator app or a passkey as the main method, keep SMS only if the exchange forces it, and never type a code into a page you reached from a link in a message.

The weak link people forget: the email account

Most exchanges send login alerts, withdrawal confirmations and reset links by email. If the email account falls, the exchange account is much easier to attack, even with an authenticator app on the exchange.

• Turn on 2FA on the email account too, with an app or passkey.
• Use an email address that is not shared with social media or shopping sites.
• Check the email’s recovery phone number and backup email; old ones are an easy way in.
• Read every “new login” or “new device” alert. An alert you did not trigger is the moment to change the password.

Setting up an authenticator app, step by step

Official steps for each exchange:

Exchange	Where to set it up
Binance	Security settings page; follow the steps for the chosen method (scan for an app, link for SMS, etc.)
Bitget	Open Google Authenticator, tap ”+”, scan the QR code or enter the key; save the backup key
Bybit	Go to “Security”, click “Set up” next to Google two-factor authentication; save the recovery key phrase
Gate	Web: “Security Verification” > “Two-Factor Authentication” > “Bind Now”, scan the QR code or copy the key into Google or Gate Authenticator. App: profile icon > “Security Center” > “Google/Gate Authenticator (unverified)” > “Copy Key”

Storing the backup key

1. Write the key on paper the moment it appears.
2. Label it with the exchange name and the date.
3. Keep it apart from the phone, ideally with other important documents.
4. Do not store it as a screenshot, a cloud note or an email to yourself.

With the key saved, moving to a new phone means adding the same key to the new app. Without it, a reset through the exchange is the only route.

Lost phone: how to reset 2FA on each exchange

Exchange	Reset process	Waiting period or condition
Binance	Log in, open the “Reset Security Verification” page, select the lost method, confirm	After a reset, withdrawals, P2P selling and payment services are disabled for 48 hours
Bitget	Self-service area of the Bitget Support page, choose “Reset 2FA”	About 1 to 3 business days; losing two or more methods may require a live video check
Bybit	On the 2FA screen, click “Having trouble verifying”, pick the method that no longer works; support resets it after approval	Approval time not stated officially
Gate	Lost phone or deleted authenticator: contact [email protected]. Lost or leaked passkey: contact Gate right away	Removing an existing passkey requires that passkey or another 2FA method

Reset mistakes that cost more time

• Starting a reset from a link in an email or chat: fake “reset” pages are a common way to steal accounts. Open the exchange site by typing the address.
• Removing the old method before adding a new one: keep at least one working method until the new one is confirmed.
• Losing several methods at once: on Bitget, that can mean a video check. Set up a second method while everything works.

So what to do: set up two methods while the account is healthy, so losing one phone is an inconvenience, not a lockout.

Final check

1. 2FA is on, with an authenticator app or passkey.
2. The backup key is on paper, offline.
3. A second method is set up where the exchange allows it.
4. You know the reset route and the waiting period of your exchange.
5. You never type a code into a page opened from a message.

Fees and features side by side: exchange comparison. Sign-up links, alphabetical: Binance · Bitget · Gate. Bybit has no referral link on this site.

Related guides

• Verification problems before 2FA: KYC verification problems.
• A second account as a backup: two exchanges and a wallet.
• P2P scams that target codes and payments: P2P trading safety.
• Keys you hold yourself: crypto wallet basics.

FAQ

Content is for education only and is not investment advice. Crypto and stocks can lose value. Risk disclaimer · Affiliate disclosure

Sources

1. Binance — How to reset 2FA
2. Bitget — How to reset 2FA
3. Bitget — Passkey setup
4. Bybit — Bind Google Authenticator
5. Bybit — Enhance account security
6. Gate — Introduction to Passkey