Short answer: Sign in at kraken.com, open Settings → Security → Two-factor authentication, and enable 2FA separately for sign-in and for funding (withdrawals). Use a security key if you have one, an authenticator app otherwise, and never SMS. Then turn on the Global Settings Lock and set up a withdrawal address whitelist — on an exchange, those two settings matter as much as the login.
Crypto is different, and the difference is finality
If someone drains your bank account, there is a fraud department, a chargeback process, and usually a resolution. If someone moves crypto off an exchange, it is gone. No reversal, no dispute, no insurance for most account-level compromises.
That changes the calculation. On an exchange account, security is not about reducing hassle — it is about making the irreversible outcome impossible rather than unlikely.
Kraken has a reputation for taking this seriously, and gives you more controls than most. Use them.
Step 1: Enable 2FA for sign-in
- Sign in at kraken.com.
- Click your profile icon → Settings.
- Open Security → Two-factor authentication.
- Under Sign-in, choose your method and follow the setup.
Kraken supports:
- Security key (FIDO2/WebAuthn or YubiKey) — the strongest option, and the one to choose if you hold meaningful value. It cannot be phished, because it refuses to authenticate on a lookalike domain. See hardware security keys and phishing-resistant MFA.
- Authenticator app (TOTP) — solid, universally available, and the practical choice for most people.
- Passkey — where offered, same cryptography as a security key.
Scan the QR code with any standard authenticator — Google Authenticator, Aegis, 2FAS, Microsoft Authenticator. New to it? What is an authenticator app.
Do not screenshot the QR code, and store the setup key offline. Kraken shows the key so you can back it up — write it down on paper and keep it with your other critical documents, or scan it into a second device while it is on screen. Never in a cloud note or a photo.
Step 2: Enable 2FA for funding separately
This is the setting people miss, and it is arguably the more important of the two.
Kraken lets you require a second factor specifically for withdrawals and funding operations, independent of sign-in 2FA. Enable it, and consider using a different method or a different device from your sign-in factor.
Why it matters: if an attacker somehow obtains a live session, sign-in 2FA has already been passed. A separate funding factor means they still cannot move anything out — see session hijacking for why that scenario is realistic.
Step 3: Turn on Global Settings Lock
Global Settings Lock (GSL) freezes your account settings. While it is on, nobody — including someone who has fully compromised your login — can change your security settings, add withdrawal addresses, or alter API keys.
Unlocking requires a deliberate action and a waiting period, which is exactly the point: it puts time between an attacker and your funds, and time is when you notice something is wrong.
Turn it on. Accept the friction. Unlock it only when you genuinely need to change something.
Step 4: Whitelist withdrawal addresses
Under funding settings, add the specific addresses you withdraw to and enable address whitelisting. Withdrawals can then only go to addresses you have pre-approved.
This defeats the entire class of attack where malware or a compromised clipboard swaps a destination address at the moment of withdrawal — a genuinely common way people lose crypto, and one that no amount of login security prevents.
Combine with GSL, and adding a new address becomes slow and deliberate. That is a feature.
Step 5: The rest of the account
- Master key — Kraken offers a master key that can be required for account recovery and support requests. Set one and store it offline; it blocks social-engineering of support.
- API keys — if you use trading bots or portfolio trackers, review every key. Disable withdrawal permission on any key that does not absolutely need it, and restrict by IP address. A leaked API key with withdrawal rights bypasses your 2FA entirely.
- Email account — it must have the strongest protection you can give it, ideally a passkey or security key. Crypto users are targeted specifically, and the inbox is the way in. See Google account 2FA.
- Remove SMS anywhere it appears — SIM swap attacks are aimed disproportionately at crypto holders, and there are documented cases of exactly this.
- Sign-out and session review after any suspicious activity.
The phishing that targets exchange users
Crypto phishing is better resourced than most, because the payoff is immediate and final:
- Fake “suspicious activity” emails linking to a login page that relays your password and code in real time.
- Fake support on X, Telegram and Discord, contacting you after you post a question publicly. Real support never DMs first.
- Address-swapping malware that changes the destination as you paste it — always verify the first and last characters, and use whitelisting.
- Requests for your code or seed phrase. Kraken will never ask. Nobody legitimate ever will. See OTP scams.
A security key removes the first of these entirely, which is a large part of why it is worth buying one.
Frequently asked questions
Does Kraken support SMS 2FA?
Some account functions have historically offered SMS, but you should not use it for anything. Choose an app or a security key — see SMS vs authenticator apps.
What if I lose my phone?
Use your backed-up setup key on a new device, or your second registered method. Kraken support can help with identity verification, but exchange recovery is deliberately rigorous and slow. This is why backing up the setup key at enrolment matters — see how to back up your authenticator app.
Should I keep funds on an exchange at all?
For active trading, some balance is necessary. For long-term holdings, self-custody in a hardware wallet removes exchange risk entirely — though it introduces seed-phrase responsibility. We compare the trade-offs in 2FA for crypto: exchange vs wallet.
Why is my code rejected?
Usually clock drift on your phone. Turn on automatic network time. See why 2FA codes get rejected.
Is Global Settings Lock worth the inconvenience?
Yes. It is the single best feature Kraken offers, because it converts an instant compromise into a delayed one — and delay is what gives you a chance to react.
Can I use the same authenticator app as my other accounts?
Yes, and most people do. Just make sure it is backed up and that the setup key for your exchange is also stored offline.
The bottom line
Security key if you can, authenticator app if not, separate 2FA for withdrawals, Global Settings Lock on, addresses whitelisted, API keys locked down, and the setup key written on paper. It is more steps than any other account in this guide — and that is appropriate, because it is the only one where a mistake cannot be undone.
Also securing other exchanges? See our guides for Coinbase and Binance.