michimeme.com

Locked and lost exchange accounts

You log in one morning, and instead of your portfolio, you see "Account temporarily locked." Maybe your authenticator app was wiped when your phone died. Maybe you switched carriers and can no longer receive SMS codes. Maybe you never wrote down your backup codes, or you did, but now they're gone.

This page covers the full range of locked and lost accounts - on centralized exchanges and in self-custody wallets. It covers what goes wrong, what you can do about it, and where the line is between recoverable and gone forever. Each major problem has its own dedicated page; this one maps the territory and points you to the right one.

Why accounts get locked

The most common reason people see a lock screen is a straightforward login failure: too many wrong passwords, a new device, a new IP address. Exchanges automatically freeze accounts to prevent brute-force attacks or credential-stuffing. That error - "Too many login attempts" - is usually a temporary block that clears after an hour or a day.

But there are deeper triggers. An exchange may lock an account when "Unusual activity detected" - a login from a country you've never visited, a withdrawal pattern that doesn't match your history, or a sudden change to your 2FA settings. Some locks happen because of sanctions screening: if your IP address or KYC region conflicts with exchange policies, you may see "Region not supported" even if you've been a customer for years. Another common cause is email compromise: if an attacker gains access to your email and attempts a password reset, the exchange may freeze the account before either you or the attacker can act. That scenario - "Email Hacked and Exchange Account Locked Recovery Steps" - has its own page detailing how to prove identity after the freeze.

Sometimes there is no obvious trigger at all. The page "Exchange Locked Me Out of My Account for No Reason What Happened" walks through the automated systems - AML flags, device fingerprint mismatches, dormant account reviews - that can lock an account without any visible error message. The distinction between an account freeze (temporary, usually resolvable) and an account closure (permanent, funds may be forfeited) is critical, and that page explains the difference.

Two-Factor authentication: the most common lockout cause

Losing access to your 2FA method is the single most frequent reason people cannot log in. The recovery path depends entirely on what kind of 2FA you used.

SMS 2FA and Its Risks

SMS-based two-factor authentication seems simple: a code arrives by text, you type it in. But SMS is the least secure 2FA method for exchange accounts. A SIM-swap attack allows an attacker to convince your mobile carrier to transfer your phone number to a SIM card they control. Once they have your number, they receive your SMS codes, reset your password, and drain your account. The page "Why SMS Two-Factor Authentication Is Not Safe for Exchange Accounts" walks through the full chain of events - from phone number compromise to drained account - and explains why exchanges themselves recommend against SMS for large balances.

If you have already lost your phone number - you cancelled the line, moved countries, or the number was reassigned - the situation is different. You cannot receive any SMS, and the exchange's 2FA reset flow typically requires sending a code to that number. The page "Lost Phone Number Cannot Receive SMS for Exchange 2FA Reset" covers the identity re-verification path that bypasses the need for SMS entirely.

Authenticator App Loss

Deleting Google Authenticator, switching phones without transferring your secrets, or resetting your phone without a cloud backup - these are the fastest ways to lose 2FA access. Google Authenticator does not sync by default; if you delete the app, the TOTP seeds are gone. The page "Deleted Google Authenticator App No Backup Exchange 2FA Lost" explains the recovery difference between Google Authenticator (no cloud backup) and Authy (multi-device sync), and what to do when the app is gone and no backup codes exist.

If you have used all your backup codes and lost your authenticator app, you face the hardest recovery path. The page "Used All Backup Codes and Lost 2FA Exchange Account Recovery" details the only remaining option: complete identity re-verification through the exchange's support team, with no shortcut bypassing KYC.

Hardware security keys and passkeys

Hardware keys like YubiKey (FIDO2/U2F) are more resistant to phishing and SIM-swap than SMS or TOTP, but they introduce their own failure mode: physical loss of the key. If you have no backup key and no registered second method, recovery requires the exchange's identity re-verification process. Some exchanges now support passkey-based recovery using biometrics on your device, but this is new and not universally available. The page "Exchange 2FA Reset vs Self Custody Wallet 2FA Loss Compared" contrasts the exchange's ability to reset 2FA through identity verification with the permanent-loss risk of losing 2FA on a self-custody wallet.

Identity verification and KYC: the exchange recovery gate

For any exchange account lockout where 2FA cannot be reset through backup codes or SMS, identity verification is the only door. The exchange will ask you to submit government-issued ID, a selfie, and sometimes proof of address. This process can fail.

"KYC Identity Verification Failed on Exchange Account Recovery" explains why: expired passports, name mismatches between your account and your ID, poor image quality, or automated systems that flag your documents as suspicious. When automated KYC rejects legitimate documents, the escalation path involves manual review by a compliance team - and that can take days or weeks.

Even after successful identity verification, you may find that withdrawals remain disabled. The page "Withdrawals Disabled on Exchange Account Under Review What to Do" distinguishes between a temporary withdrawal hold (often due to suspicious activity detection or a change in withdrawal behavior) and a permanent freeze. A common cause is the withdrawal address whitelist feature: if you added a new address, a timer - typically 24 to 48 hours - must expire before withdrawals to that address are allowed. The page "Withdrawal Address Whitelist Lockout Timer Exchange Security Wait" explains how this mechanism protects you even if an attacker has bypassed your 2FA.

The custodial vs. non-custodial divide

The most important distinction in this entire subject is the difference between losing access to a centralized exchange account and losing access to a self-custody wallet. The page "Exchange Account Locked vs Self Custody Wallet Lost Access Compared" makes this explicit.

On an exchange, your funds are held by the platform. If you lose your password and 2FA, you can prove your identity and the exchange can reset your access. The exchange controls the private keys. There is a human or a process on the other side that can say, "Yes, this is you."

With a self-custody wallet - whether a hardware wallet like Ledger or Trezor, a software wallet like MetaMask or Trust Wallet, or a mobile wallet like Rabby Wallet - you control the private keys. If you lose your seed phrase, no one can restore your wallet. The exchange cannot help you. The blockchain cannot help you. The funds are gone.

This is why the most common and most dangerous error for self-custody users is "Recovery phrase invalid" - the seed phrase you wrote down does not match the wallet. The page "Recovery Phrase Invalid Error When Restoring Crypto Wallet" breaks down the causes: typos, wrong word order, incorrect BIP-39 checksums, clipboard malware replacing the phrase you pasted, or accidentally using a phrase from a different derivation path.

Hardware Wallet Loss

If your hardware wallet is physically destroyed or lost and you have no seed phrase backup, recovery is almost certainly impossible. The page "Hardware Wallet Broken or Lost No Seed Phrase Backup Recovery" addresses whether there is any technical workaround - and the answer is no. No forensic recovery of a damaged chip, no brute-force of a 12- or 24-word phrase, no exchange that can reverse the transaction. This is the permanent-loss scenario.

Seed phrase backup choices

The durability of your seed phrase backup determines whether you ever face this situation. Paper backups burn, get wet, or fade. Metal backups - engraved on stainless steel or titanium - survive fire, flood, and decades of storage. The page "Metal Seed Phrase Backup vs Paper for Crypto Wallet Recovery" compares real-world failure scenarios: a house fire destroys paper but leaves metal readable; water damage turns paper to pulp; metal survives both. The cost difference - a few dollars for paper, $20 - $50 for a metal kit - is trivial compared to the value of the funds it protects.

Advanced Recovery Mechanisms

For users who plan ahead, there are recovery methods that go beyond seed phrases and exchange support tickets.

Multi-signature wallets (like Safe, formerly Gnosis Safe) require multiple private keys to authorize a transaction. If you lose one key, you can still recover with the remaining signers. The recovery threshold logic - for example, 2-of-3 or 3-of-5 - means no single point of failure.

Social recovery wallets (like Argent or Loopring smart wallets) allow you to designate guardians - trusted contacts or devices that can help restore access if you lose your key. The page on social recovery vs. seed phrase recovery covers the trade-offs: convenience and redundancy versus the privacy and sovereignty of a single seed phrase.

Dead man's switch and inheritance triggers allow you to set a time lock: if you do not check in within a certain period, a designated heir or backup wallet gains access. This prevents permanent loss in case of death or incapacitation.

These mechanisms are more complex to set up than a basic seed phrase, but they provide recovery paths that a single lost piece of paper cannot.

When all else fails: costs, risks, and misconceptions

Every recovery path has a cost. Exchange recovery can take days to weeks - Coinbase's typical wait is 48 - 72 hours; Binance and Kraken vary widely. Gas fees for wallet recovery transactions fluctuate with network congestion. If your account has been dormant for years, you may face a dormant account reactivation fee. The page "Exchange Dormant Account Reactivation Fee and Recovery Process" covers what happens to accounts that have been inactive for years: whether they are closed, what identity re-verification is required, and whether any fees apply to withdraw remaining funds.

The most expensive cost is permanent loss. If you lose your seed phrase and no backup exists, the funds are gone. The page on FDIC insurance - "Are My Funds FDIC Insured on a Crypto Exchange Truth Explained" - addresses a common misconception: exchange funds are not insured like bank deposits. FDIC coverage, where it exists, applies only to U.S. dollar balances held in specific partner banks, not to crypto assets. If the exchange becomes insolvent, your crypto is not protected.

Other misconceptions can lead to poor decisions. "The exchange can always restore my account" is false if you cannot pass KYC. "My seed phrase is stored somewhere on the blockchain" is false - seed phrases are never recorded on-chain. "If I can see my balance, I still have access" is false; viewing a balance on Etherscan or a block explorer does not mean you can move it. The page on misconceptions calls out the most dangerous ones.

Which problem are you facing?

This page surveys the entire subject. Each specific problem has a dedicated page that walks through the exact steps, the tools involved, and the realistic outcomes.

No single page can cover every edge case. These pages together cover the full range of locked and lost accounts - from exchange lockouts to burned seed phrases, from SIM-swaps to social recovery guardians. The decision you make before you lose access matters more than any recovery attempt after.

Not financial advice. michimeme.com publishes market data and general information about michi. Crypto assets are volatile and you can lose everything you put in. Nothing here is a recommendation to buy, sell or hold, and we make no price predictions.

Prices are sourced from third parties and may be delayed or wrong. Verify anything you intend to act on against a primary source.