Rebuilding Exchange Access After Losing Your Authenticator

Losing the device that generated your two-factor authentication codes feels like losing your keys in a busy market: the account is still there, but the door will not open. The important thing to understand first is that the exchange account itself is not gone. What is gone is one proof of identity, and every major platform has a documented process for replacing it. Your job is to work through that process slowly, use only the official help centre for that exchange, and keep a written record of every step so you do not have to repeat it. This guide covers what to do in the first hour, how to prepare the evidence a review team will ask for, how to submit and track the request, and how to set up the replacement so the same situation is easier next time. It applies whether you use Binance, OKX, Bybit or Bitget, and it assumes you are in Kenya and working from a stable connection. Nothing here is a shortcut around verification; the goal is to complete the legitimate recovery path properly the first time.

First hour: secure the account and stop guessing

Before you contact anyone, deal with the obvious risks. If the phone was lost or stolen rather than simply wiped, change the password on the email address tied to the exchange account first, because that inbox is usually the recovery channel. Then change the exchange password from a device you still control, if the platform lets you log in with password alone. If it does not, do not keep hammering the login screen with guessed authenticator codes; repeated failures can trigger a temporary lock that makes the whole process slower.

Next, check whether you saved the original two-factor secret anywhere legitimate. When you first enabled the authenticator, most platforms showed a backup key or a set of recovery codes and asked you to store them offline. Look in your password manager, a printed note, or an encrypted file. If you find the secret key, you can re-add the same entry to a new authenticator app and codes will match again, which is by far the fastest route. If you find nothing, accept that and move to the formal recovery route instead of buying time.

Write down what you know while it is fresh: the email address on the account, the phone number registered, the approximate date you opened it, the last time you logged in successfully, and any deposit or withdrawal you remember. This timeline becomes the backbone of your recovery request and is much harder to reconstruct a week later.

Gather the evidence the review team will expect

Recovery teams are not trying to trap you; they are trying to confirm that the person asking for access is the person who owns the account. That means they will compare your request against the identity records already on file. Open the verification or account settings area of the exchange and note what level of identity verification your account holds, because that determines what you can reasonably be asked to provide. If your account was never verified, expect a longer conversation and be ready to explain the account's history in detail.

Prepare clean, well-lit photographs or scans of the identity document you originally used, plus a clear selfie if the help centre asks for one. Follow the exact instructions on the recovery page about what must be visible and whether anything should be handwritten. Do not edit, crop or enhance the images, and do not send documents through social media messages or to anyone who contacts you first claiming to be support. Genuine support works through the help centre ticket system, not through direct messages.

Also prepare proof of activity that only the owner would have: the device models you used, the approximate dates of your first deposit and last withdrawal, the methods you used to fund the account, and any sub-account or API key names you created. Keep this in a single document so you can paste it into the ticket without scrambling for details under time pressure.

Submit the request and track it properly

Go to the official help centre for your exchange and search for the article on lost or reset two-factor authentication, then start the ticket from inside that article rather than from a general contact form. The article will tell you which fields are mandatory and which document format is accepted. Fill everything in one pass, attach the evidence you prepared, and describe the situation in plain chronological order: what device was lost, when, what you have already tried, and what access you still have. Avoid emotional language and avoid repeating the same sentence; reviewers read many of these and clarity saves days.

After submitting, note the ticket number, the date and time you submitted, and the email address that will receive replies. Check that inbox including the spam folder daily, because a request for one extra document can stall the case until you respond. If the help centre shows a status page for your ticket, screenshot it at each change so you have your own record of the sequence.

Set a personal stop condition: if a reply asks you to move the conversation to a messaging app, to pay a fee to a personal account, or to share your password or authenticator secret, stop and report it through the official help centre. No legitimate recovery process needs those things. If the ticket goes quiet for longer than the help centre's stated response window, reply once on the same ticket asking for a status update rather than opening duplicates, which split your case across queues.

Rebuild access and prevent a repeat

Once the exchange restores access, you will usually be asked to set up two-factor authentication again during the next login. Do it immediately, and this time treat the backup material as the most valuable thing you own. Store the secret key or recovery codes somewhere offline and separate from the phone, such as a printed copy in a locked place plus an encrypted digital copy. Consider enabling more than one authentication method if the platform allows it, so a single lost device is no longer a single point of failure.

Then review the security settings page and confirm nothing else changed during the recovery: check active sessions, authorised devices, withdrawal address whitelists, API keys and any linked email or phone number. Remove anything you do not recognise. If you had API keys, revoke and recreate them, since old keys may have been exposed along with the device.

Finally, update your own records. Note the date access was restored, which documents you supplied, and how long the process took. That note turns a stressful event into a known procedure, so if it ever happens again you can move straight to the right help centre article and the right evidence instead of starting from panic. For anything specific to fees or account limits you notice afterwards, check the fee page for that exchange rather than relying on memory.

Risk boundary: Kenya Crypto Guide

Digital assets are volatile and derivatives can amplify losses. This website has no login, wallet connection, deposit form or customer-support chat. A referral link only records attribution; it does not guarantee access, pricing, rewards, approval or investment results. Availability can differ by residence, legal entity and product, so no regional access is assumed from language or branding alone.

Scenario checkpoint

• Change the password on the linked email account first if the phone was lost or stolen, then change the exchange password from a device you still control.
• Search your password manager, printed notes and encrypted files for the original authenticator secret key or recovery codes before starting a ticket.
• Write a short timeline: account email, registered phone, approximate opening date, last successful login and any remembered deposit or withdrawal.
• Open the lost-two-factor article in the official help centre and submit the request through that page, attaching unedited identity documents exactly as instructed.
• Record the ticket number, submission time and reply inbox, and check that inbox daily including spam until the case closes.
• After access is restored, re-enable two-factor authentication, store backup material offline and review active sessions, API keys and withdrawal whitelists.