If your authenticator app disappears, the most important question is not “Which code should I enter?” It is “What else might an attacker now control?” A lost phone can expose an active session, email notifications, or recovery messages, while a deleted authenticator app may simply mean that you need an account-recovery check. Treat the incident as a security event until you have verified otherwise.
This practical reference covers Coinbase, Binance, Kraken, and OKX. The services do not use one universal reset process. Menu names, identity checks, waiting periods, and withdrawal restrictions can vary by country, account status, and app version. The exchange links below were checked on September 16, 2026; use the official support page for the current wording before you submit a request.
Two-factor authentication (2FA) adds a second proof of identity after the password. An authenticator app normally creates a time-based one-time password, often called a TOTP code. A backup code is a single-use recovery code saved when 2FA was enabled. A setup key is the secret that can recreate the authenticator entry manually. A passkey or hardware security key is a different authentication method and may offer another way into an account.
These terms are related but not interchangeable. A backup code may let you pass one sign-in challenge; it does not automatically restore every exchange security setting. A setup key can recreate a TOTP entry, but it is as sensitive as a password and must not be pasted into chat or sent to support. If your phone was stolen, assume anything stored visibly on it may be exposed.
| What happened | Best first move | What to expect |
|---|---|---|
| Authenticator app deleted, email and password still work | Try a saved backup code, passkey, security key, or the exchange’s unavailable-method flow. | You may be able to reset 2FA after an identity check. |
| Phone lost or stolen | Lock the phone and secure email before attempting recovery. | Regaining access may trigger a temporary withdrawal hold. |
| Email or phone number also unavailable | Use the exchange’s formal account-recovery process. | Expect stronger identity checks and a longer review. |
| Unknown login, withdrawal, API key, or device | Secure email, change the exchange password if possible, and contact official support through the account’s security flow. | Prioritize containment over restoring convenience. |
On the exchange sign-in screen, look for wording such as “Try another way,” “Authentication method unavailable,” “Security verification unavailable?” or “Recover account.” Only use an option that appears inside the official app or domain. A backup code, passkey, security key, or already trusted session may let you reach security settings without immediately opening a manual support case.
Do not keep guessing time-based codes. If the app is still available but codes are rejected, first enable automatic date and time on the device. OKX lists clock synchronization as an initial troubleshooting step. If the phone is gone, skip this check and use recovery instead.
An existing trusted session can be valuable, but it is not proof that the account is safe. Open the exchange’s security center, review the current 2FA method, and follow the option to change or replace the authenticator. Coinbase directs signed-in users to its 2-step verification settings and then to “Lost access to your 2-step verification?” before identity verification. OKX similarly places the reset under the Security Center and provides an unavailable-method route.
Before closing the session, save the recovery reference or case number, confirm the email address on the account, and check whether the exchange warns about a temporary withdrawal lock. Do not remove the only working factor until the replacement is ready unless the official flow requires it.
The routes below are the practical differences that matter. Start with the row for your exchange and then open the linked official instructions. If the labels on your screen differ, do not improvise from a third-party tutorial; return to the official help center and search for the exact error message.
| Exchange | Official recovery route | Checks and restrictions documented by the exchange |
|---|---|---|
| Coinbase | If another 2FA method works, use it. If not, use Coinbase account recovery. A signed-in user can open 2-step verification settings and choose the lost-access option. | Identity verification may be required. Coinbase’s support material does not establish one universal withdrawal hold for every recovery case, so follow the warning shown in your account. |
| Binance | Choose the unavailable verification method at sign-in, then “Security verification unavailable?” and the reset-security-verification flow. Select the lost 2FA-device option and complete the remaining checks. | Binance says a reset request may be reviewed for up to 24 hours. Withdrawals, P2P selling, internal transfers, and payment services can be disabled for up to 48 hours after a 2FA-device reset. |
| Kraken | Use a Master Key or the backup code if one was set up. If neither is available, use Kraken’s account-recovery or support path; if the lost device may expose the account, secure email and password first. | Kraken advises changing 2FA as soon as access is regained. A Master Key should be stored separately from the sign-in device. |
| OKX | Use the self-service “Reset 2FA” route. On the web, use Profile, Security, Security Center, then the relevant change option and “Authentication method unavailable?” | OKX may ask for an ID document and facial recognition. Its guidance says withdrawals or P2P trading may be disabled for 24 hours after an authenticator reset. |
For direct instructions, consult Coinbase’s 2-step verification troubleshooting, Coinbase’s lost-access recovery guide, Binance’s lost 2FA-device procedure, Kraken’s lost-phone guidance, and OKX’s 2FA reset instructions.
A reset is a security decision, so the exchange may ask for information already associated with the account, an identity document, a selfie or facial check, a new phone number, or a video review. Use a well-lit environment, submit readable documents through the official flow, and make sure the details match your account records. Do not email identity documents to an address copied from a chat or social-media message.
Take a screenshot or save the case reference without exposing document numbers in an unsecured folder. Then wait for the stated review window. Repeatedly opening new cases, changing details, or sending contradictory explanations can make a manual review harder to resolve.
When the exchange approves the reset, install the authenticator app from the device’s official app store and add the new entry using the displayed QR code or setup key. Enter the current six-digit code to confirm the enrollment. Generate backup codes if the service offers them and store them offline or in a reputable password manager. Keep the setup key separate from the phone; anyone with it can recreate the time-based codes.
Do not assume that reinstalling an authenticator app restores old accounts. That only works when the app’s own backup or synchronization was actually enabled and the account was restored correctly. Verify the new code on a second trusted sign-in before relying on it, but do not disable the old method prematurely if the exchange still lists it as active.
After the exchange accepts the new factor, review active sessions, devices, API keys, withdrawal addresses, linked email addresses, phone numbers, and passkeys. Sign out unfamiliar sessions. Disable unknown API keys and remove withdrawal addresses you did not add. Change the exchange password if the phone was stolen or you suspect reuse elsewhere. Then secure the email account again and check its forwarding rules and recovery methods.
A withdrawal hold is a protective restriction, not necessarily evidence that the reset failed. Binance documents up to 48 hours for several services after a 2FA-device reset, while OKX documents a 24-hour restriction for withdrawals or P2P trading after an authenticator reset. Your account may show a different timer or scope. Do not create a second account, cancel a legitimate review, or pay anyone to “release” funds.
During the wait, review login alerts and account activity, confirm your email and phone are correct, and save the official case reference. If the timer passes without an update, use the same official support case or help-center flow rather than a new social-media contact.
Use this checklist only after the exchange confirms the reset or the new authenticator is active:
If any answer is “no,” keep the case open and return to the exchange’s official security workflow. The goal is not merely to generate a new authenticator code; it is to restore a known-good chain of control from your email and device to the exchange account and its withdrawal permissions.
Lost your authenticator app? Learn how Coinbase, Binance, Kraken, and OKX handle 2FA recovery, security resets, identity checks, and withdrawal holds.
Learn how maker and taker fees change your true break-even price, with an exact formula, a worked example, and a beginner checklist for trading costs.
Learn how to calculate net R-multiples, log trade risk and costs, and compare strategies with different position sizes without confusing risk with returns.
Learn why a 50% investment loss requires a 100% gain to break even, how to calculate recovery returns after other drawdowns, and what the math does not predict.
Calculate pip value in the pair’s quote currency, convert it into your account currency, and verify the result with two worked examples, formulas, and broker checks.
Calculate forex lot size from account risk percentage and stop-loss distance. Follow a worked EUR/USD example, compare sizing choices, and account for pip value, costs, and broker limits.
See how U.S. and U.K. daylight saving dates shift the London–New York forex overlap, with 2026 local-time examples and a practical conversion method.
See how the 30-day wash-sale window, partial share matches, basis adjustments, Form 8949, broker reporting, and section 475(f) affect active traders.
Learn why a single stock order can be partially filled at different prices and times, how liquidity and queue priority drive fills, and what to check before trading.
VWAP measures the volume-weighted average for a defined session; anchored VWAP starts from a chosen event. Learn when each benchmark is the better fit.
