Account security and two-factor methods

A service that holds crypto on your behalf is protected by whatever stands at its login. A password alone can be guessed, reused from a leaked site or captured by a fake page. Two-factor authentication adds a second proof that an attacker is unlikely to have. The common methods differ in strength. A code sent by text message is better than nothing, but a phone number can be moved to a different device by a determined thief. An authenticator app generates codes on the handset itself. A physical security key goes further, because it answers only to the genuine website and so resists cloned login pages. NIST's authentication guidance reflects this ordering.

The method is only part of the setup. Use a long, unique password kept in a reputable manager, so one breach cannot unlock several accounts. Save the one-time backup codes that the service offers and store them offline, apart from the phone. Keep the email account that receives resets as well protected as the service itself, because whoever controls that mailbox can often reset the rest. Review the list of signed-in devices now and then, and switch on withdrawal address allow-lists if the service has them. These steps matter even more for an account whose stolen contents cannot be reclaimed through the network.