2FA and wallet access after a death

Scope: this page is only about two-factor authentication (2FA) as it affects cryptocurrency, wallets and exchange accounts. It does not cover email, social or other online accounts.

Two-factor authentication protects access with something you know plus something you have: an authenticator app on a phone, an SMS code, a backup code, an email code or a hardware security key. It is strong protection while the owner is alive, and after a death it is often the difference between an estate that can proceed and a technical dead end.

What 2FA protects in the crypto context

• Exchange accounts. Logins protected by authenticator codes or SMS. The estate does not need the codes, the official procedure verifies documents, not factors. See exchange accounts after a death.
• Wallet software and password managers. Programs that hold wallet material often require a second factor. Losing it can make the stored material unreachable.
• Hardware wallets. A device PIN is not 2FA in the online sense, but the same problem applies: the factor is lost when the holder passes away, and repeated guesses can wipe the device. See how to preserve a hardware wallet.
• Recovery flows. Some wallets gate recovery behind the same authenticator that the owner used to set it up.

What can and cannot be reset

• Exchange accounts: resettable: with documents, not codes. The exchange’s official procedure for account holders who have passed away confirms legal authority and re-issues access. You never need, and never should need, the codes of the person who passed away.
• Self-custody: nothing to reset. There is no company to call. If the wallet or the password manager holding it was protected by 2FA, the factor is part of the access path. If backup codes exist, they are the way in; if they do not, the factor may be gone forever.
• Backup codes are secrets. These one-time codes, printed when 2FA was set up, are exactly as sensitive as a seed phrase. Preserve them like seed material, and never send or photograph them. See what is a seed phrase.

What to preserve

• Leave phones, authenticator devices, hardware security keys and computers exactly as found. Do not wipe, reset or “try a few codes”, lockouts and wipes are irreversible.
• If backup codes are found, keep them flat, dry and private, in the same secure location as the rest of the secret material.
• Record only that a factor exists and where the guidance points to it, never the codes themselves.

Planning for owners

• Store 2FA backup codes with your other secret material (sealed paper or metal), never inside the secret-free summary or a will.
• Tell the executor where the guidance lives, not what it contains.
• Name a technically comfortable helper who can operate the authenticator, if your plan relies on it.
• Test recovery while you are alive: can your chosen person actually reach the wallet with what you left?

What to do with it

• A second factor protects exchange logins and some wallets, an authenticator app, backup codes, a security key or an SMS code.
• Exchange accounts, when the estate is ready: the platform can usually reset or replace the factor with documents and confirmed authority, see exchange accounts after a death.
• Self-custody: the factor is part of the access path, but the seed phrase is the real key: if it exists, the wallet can be restored without the factor. Losing the factor alone does not mean the funds are lost; no platform can reset it. See what is realistically possible in wallet recovery.
• The classic mistake: guessing codes on the found device, each attempt can lock or wipe the only access path. Preserve backup codes as secrets.
• Until authority is confirmed, preserve the device, the key and any backup codes exactly as found.

What never to do

• Never send codes, authenticator screenshots or security keys to anyone. No official process asks for them, not the exchange, not a lawyer, not a “specialist”.
• Never guess codes on the device of the person who passed away to “check”, each attempt can lock or wipe the only access path.
• Anyone who asks for your backup codes “to verify the estate” is a warning sign: scams targeting crypto estates.

The full access picture (passwords, passphrases and PINs) is in wallet passwords and passphrases.