You switch carriers, let the old plan lapse, and months later a sign-in screen asks for a code that is being sent to a number you no longer own. The account is not gone, and the blockchain has nothing to do with the problem. What decides how hard the next hour is, is which of three separate jobs that phone number was doing for the account.
A phone number does up to three jobs at once
An account can attach your phone number in three different places. It can be the login identifier, the thing you type where someone else types an email address. It can be a delivery channel for a one-time code, which is what SMS two-factor authentication is. And it can be a contact detail inside the identity record, sitting next to your legal name and your document number.
Nothing on the sign-in screen tells you which of the three you have, and the three fail at different moments. A contact detail fails silently: notices stop arriving and you do not find out until you go looking. A delivery channel fails at the next sign-in that asks for a code. An identifier fails at the first keystroke, because there is nothing left to type.
That count also decides how much work remains after you fix the obvious part. Moving your second factor off SMS closes the second job and leaves the other two exactly where they were, which is how an account stays tied to a dead number long after you were satisfied you had dealt with it.
| What the number was doing | How the loss shows up | What has to replace it |
|---|---|---|
| Login identifier | The sign-in cannot be started at all | Another identifier already on file, or provider recovery |
| Delivery channel for a code | The password works, the code never arrives | Another second factor, or provider recovery |
| Contact detail on the identity record | Nothing arrives and nothing announces it | An updated record, changed from inside the account |
The number can stop being yours in more than one way
A lapsed number is not a dead line. Announcing its reassigned numbers database, the United States Federal Communications Commission wrote that millions of phone numbers are reassigned each year, and that callers using the database would be able to find out whether numbers had been disconnected and made eligible for reassignment. A code sent to a released number can therefore be delivered perfectly normally, to whoever holds it now.
The other route is that the number is taken while it is still yours. In a SIM swap the attacker convinces your carrier to transfer your service to a phone in their possession; in port-out fraud they pose as you, open an account with a different carrier, and arrange for the number to be transferred there. In November 2023 the Commission adopted rules requiring wireless providers to use secure methods of authenticating a customer before redirecting that customer's number to a new device or provider, and to notify customers immediately whenever a SIM change or port-out request is made on their accounts.
Both routes point the same way for whoever designs the recovery flow. The digital identity guidelines published by the United States National Institute of Standards and Technology mark use of the public switched telephone network for out-of-band verification as restricted, and tell verifiers to weigh risk indicators such as device swap, SIM change, and number porting before sending a secret over it. A phone number cannot be what proves you are you, precisely because the phone number is the part that may have been moved.
A custodial account has an administrator
An exchange account can be reopened at all because somebody else is holding the keys. In a custodial arrangement the provider controls the private keys and runs an account layer on top of them, so there exists a party with the authority to change what that account accepts as proof of you.
Self-custody has no such office. No one can issue a replacement secret, which is why a lost seed phrase and a lost phone number are different categories of problem even though both feel like being locked out. Recovery on a custodial account is not the retrieval of anything. It is the provider detaching one authenticator and attaching another to the same subscriber, and the question it has to settle first is not whether you hold the phone but whether you are the person the account belongs to.
What replaces the missing code is the identity record
The file that opened the account is the file that reopens it. Because the platform ran identity verification on you at sign-up, it holds a legal name, a date of birth, and a document it can ask you to present again. A recovery request is graded against that record, so what you supply has to reconcile with what was submitted then rather than with how things stand today.
Kraken publishes the shape of this plainly. If you have lost access to your sign-in two-factor authentication and to your Master Key, the documented step is to select Recover account when the code is requested during sign-in. Where that route is unavailable, you submit a support request, and an agent follows up by email to lift the two-factor requirement from the account so it can be enabled again on your device.
The same documentation carries a sentence worth reading twice: it is not possible to set up a Master Key once you have already lost your sign-in two-factor authentication. A backstop counts only if it was armed while you still had access, and that is a general property of recovery design rather than one platform's quirk. The national guidelines put the same point as a recommendation that subscribers keep at least two valid authenticators of each factor they will be using.
The delay is the control, not the friction
A recovery flow that binds a new phone number in seconds is a flow that an attacker holding your number can also finish in seconds. Each check that slows you down exists because the identical request arrives from people who are not you, and at the moment it arrives the provider cannot tell the two apart.
This is the same shape as a withdrawal whitelist, where a newly added address has to wait before it becomes usable. The waiting period does not make the address safer. It makes the time needed to drain a stolen account longer than the time you need to notice and intervene. Applied to authenticators, a hold that follows a completed recovery is protecting you against the version of this event in which someone else did the recovering.
Arm the backstop before you need it
The work that makes this painless has to happen while the old number still answers. If you are moving to a new device, check whether your authenticator app can export its accounts to the new one and do the transfer while both phones are in your hands. If it cannot export, add a second method to the account first, then remove the old one.
Port the number rather than letting the plan lapse, and keep the old line reachable until every rebinding is finished. Cancelling first is what turns a settings change into an identity check, because the account is then left with no channel that still belongs to you.
| Do this while the number still works | Which job it covers |
|---|---|
| Save the backup codes offered when two-factor setup completes | Delivery channel |
| Add a second factor of the same kind, such as a security key | Delivery channel |
| Change the phone number in account settings before cancelling | Identifier and identity record |
| Set up the provider's own recovery key or master key | All three |
| Confirm the email on the account is one you still control | Identifier and identity record |
Recovery services cannot rebind anything
Only the provider can change what an account accepts as proof, so no outside party can restore access to a custodial account however it describes itself. The offers that cluster around this belong to the same family as the recovery services that promise to reconstruct a lost seed phrase, and they run on the same asymmetry: from outside, you cannot easily tell which layer of the system a stranger is claiming to reach into.
The signals are practical. A genuine recovery starts where you already are, at the provider's own sign-in screen or its support form, and it never begins with a stranger contacting you. Identity documents belong inside the provider's app or website and nowhere else. An advance fee, a guaranteed timeline, or a request for a one-time code each describe a party that is either powerless or hostile, and handing over your documents makes your position worse in both cases.
The bottom line
Losing the phone number attached to a crypto account is a binding problem, not a lost-property problem. Work out which of the three jobs the number was doing, because that is what separates a settings change from a second-factor swap from a full identity check. Fixing the second factor fixes one of the three.
What replaces a code you can no longer receive is the identity record the account was opened with, and the provider will move at the speed that record allows. Arm a backstop now, while the number is still yours, and keep it somewhere the loss of a single device cannot reach. To keep learning the fundamentals, follow more from Bitbase Academy.
Related reading
Other Bitbase articles on this topic:
- Corporate Crypto Account Verification: KYC Requirements for a Business
- Crypto Dust Conversion and the Records It Leaves
- Missed the Withdrawal Deadline on a Delisted Token
- How to Appeal a Crypto Exchange Account Restriction
- Solana Meme Launches and Token Risks
Disclaimer: This article is educational content from Bitbase Academy, provided for information only. It does not constitute investment, trading, tax, or financial advice. Crypto assets are volatile; assess your own risk. Written as of September 2026; refer to the latest official information.
References
[1] National Institute of Standards and Technology, Special Publication 800-63B, Digital Identity Guidelines: Authentication and Lifecycle Management pages.nist.gov
[2] Kraken Support, How to transfer authenticator app sign-in 2FA to a new phone (and bypass sign-in 2FA for a lost phone) support.kraken.com
[3] Kraken Support, How to recover your Sign-in 2FA (Master Key as a sign-in method) support.kraken.com
[4] Federal Communications Commission, news release, FCC Adopts Rules to Protect Consumers' Cell Phone Accounts, November 15, 2023 docs.fcc.gov
[5] Federal Communications Commission, news release, FCC Establishes Reassigned Phone Numbers Database to Help Reduce Unwanted Calls to Consumers, December 12, 2018 docs.fcc.gov
