Short answer. Every major exchange has an official 2FA reset process, usually requiring identity verification such as a selfie and ID. Use the 'lost access' or 'reset 2FA' option on the exchange's own login page. Expect a security hold on withdrawals afterwards. Never give anyone your password or backup codes to 'help' with the reset.
Need help applying this to your notice? Request a free written assessment: Coinbase case assessment Binance case assessment Kraken case assessment. We reply within one business day. Paid preparation is quoted separately; the platform decides the outcome.
Check for backups first
- Authenticator backup codes saved when you set up 2FA
- Cloud-synced authenticator apps on another device
- An old phone that still has the authenticator installed
The official reset
Start from the exchange's real login page. The reset flow typically asks for identity documents and a liveness check, and may take several days. Withdrawals are often paused for a period after the reset as a security measure.
If the reset fails
Open a support case and explain clearly what changed. Provide any records that link you to the account: deposit bank statements, previous emails from the exchange and old device information.
Prevent it next time
Save backup codes offline, use an authenticator that supports encrypted backup, and keep the account email secured with its own strong 2FA.
FAQs
Can support turn off 2FA by email?
Not usually. Exchanges require identity checks so that a stolen email account cannot be used to remove 2FA.
Why can I not withdraw after resetting 2FA?
Security holds after changes are standard and protect you if the reset was done by someone else.
Is SMS 2FA safe enough?
It is better than nothing, but SIM swap attacks make app-based or hardware key 2FA safer.
Official sources