Short answer: On an exchange, 2FA is your main defence — the exchange holds the coins, so protecting your login protects your funds. In a self-custody wallet, 2FA barely applies: whoever has the seed phrase owns the crypto, and no login exists to protect. Different models, different failures. Most people who lose crypto lose it because they applied the wrong mental model to the wrong one.
Two completely different security problems
People talk about “crypto security” as one topic. It is two.
On an exchange — Kraken, Coinbase, Binance — you own an entry in a database. The exchange controls the keys. Your account credentials are what stand between an attacker and your balance, which means 2FA, withdrawal controls and email security are the whole game.
In a self-custody wallet — MetaMask, Ledger, Trezor, Phantom — you hold the private keys, derived from a seed phrase. There is no account, no server, no password reset. Anyone who obtains the seed phrase can recreate your wallet anywhere in the world and empty it. A PIN or password on the app protects the local device only.
The distinction matters because the protective actions are almost entirely different.
Securing an exchange account
Here 2FA does real work. In priority order:
- A security key or passkey. Crypto phishing is well funded and relentless; a FIDO2 credential refuses to authenticate on a fake domain, which removes the most effective attack — see phishing-resistant MFA.
- An authenticator app if a key is not available or supported.
- Never SMS. Crypto holders are the primary target of SIM swap attacks, and there is a long documented history of six-figure losses this way.
- Separate 2FA for withdrawals where the exchange supports it — Kraken does this well.
- Withdrawal address whitelisting, so funds can only leave to addresses you pre-approved.
- Account settings lock or time-delayed changes where offered.
- API keys reviewed, withdrawal permission disabled unless essential, IP-restricted.
- Email account secured with the strongest method available — it is the reset path, and it is what attackers go for first.
Setup guides: Coinbase, Binance, Kraken.
Securing a self-custody wallet
Now forget almost all of that, because the threat model changes completely.
The seed phrase is everything. Twelve or twenty-four words that regenerate your entire wallet. There is no 2FA on it, no recovery process, no support desk. Protecting it is the whole job:
- Never digital. Not a photo, not a note, not a cloud document, not an email to yourself, not a password manager entry if you can avoid it. Infostealer malware specifically hunts for seed phrases in files and screenshots.
- Write it on paper, or stamp it into metal. Metal survives fire and water; paper does not.
- Store copies in two separate physical locations. A single copy is a fire away from total loss.
- Never type it anywhere except your wallet’s own recovery screen. Every “validate your wallet” site asking for a seed phrase is theft, without exception.
- Nobody legitimate ever asks for it. Not support, not a developer, not an airdrop.
A hardware wallet is the real “second factor” in self-custody. The private key never leaves the device, and every transaction requires a physical button press with the details shown on the device’s own screen. That is what protects you from malware on your computer — not a password.
Verify on the device screen, always. Malware can display one address in your browser and send another. The hardware wallet’s screen is the only trustworthy display.
Where people actually lose money
Not by brute force. Almost always one of these:
- Seed phrase entered on a phishing site after a “wallet validation” or “claim your airdrop” prompt.
- Seed phrase stored digitally and taken by infostealer malware — see how infostealers work.
- SIM swap against an exchange account still using SMS.
- Malicious token approvals — signing a transaction that grants a contract unlimited spending rights. Revoke old approvals periodically.
- Address-swapping clipboard malware.
- Fake support on Telegram, Discord and X, contacting you after you post a public question.
- Losing the seed phrase entirely — self-inflicted, and irreversible.
Notice how few of these are defeated by a password. That is the point.
Which model should you use?
The honest answer depends on you rather than on ideology.
An exchange is reasonable if: you trade actively, hold modest amounts, or know you would mishandle a seed phrase. A well-secured exchange account with a security key and whitelisting is genuinely hard to compromise.
Self-custody is better if: you hold long-term, hold significant value, and can manage a metal-backed seed phrase in two locations. Exchange failures — insolvency, freezes, hacks — are a real category of loss that self-custody removes.
Many people sensibly split: a trading balance on an exchange, long-term holdings on a hardware wallet. The rule of thumb that has survived every cycle is simple — do not keep on an exchange more than you would be prepared to lose to that exchange.
Frequently asked questions
Can I put 2FA on MetaMask?
Not in the way you mean. MetaMask has a password protecting local access to the extension, but anyone with your seed phrase can restore the wallet elsewhere without it. The password is device security, not account security — the same distinction covered in is biometrics really 2FA?
Is a hardware wallet the same as a security key?
Related but different. Both are physical devices holding keys that never leave. A security key authenticates you to websites; a hardware wallet signs blockchain transactions. Some devices do both — see hardware security keys.
Should I store my seed phrase in a password manager?
It is better than a plain text file and worse than metal in a safe. If you do, the vault needs a strong master password and its own 2FA — see do password managers get hacked? For significant holdings, offline physical storage is the standard advice.
What if I lose my hardware wallet?
Buy a new one and restore from the seed phrase. The device is replaceable; the phrase is not. This is why the phrase matters more than the hardware.
Are exchange accounts insured?
Some exchanges hold insurance against certain platform-level events, but individual account compromise caused by your own credentials is generally not covered. Do not plan around it.
What is the single highest-impact change?
On an exchange: a security key plus withdrawal whitelisting. In self-custody: getting the seed phrase off anything digital and onto metal, in two locations.
The bottom line
On an exchange, 2FA is the lock on the door and you should fit the best one available. In self-custody, there is no door — there is a key, and your entire job is making sure it exists only in physical form and never touches a screen. Confusing the two models is how people with good intentions still lose everything.
Start with the exchange, since that is where 2FA applies: Kraken, Coinbase, Binance.