Locking Down Your Kraken Account: Passkeys, Master Key, Global Settings Lock and More

The strongest Kraken setup has four layers: passkey sign-in 2FA (ideally two passkeys), a Master Key stored on a different device, the Global Settings Lock with a multi-day waiting period, and separate 2FA on withdrawals. Add a dedicated email address and tight API keys, and someone who steals your password still can't empty the account. Everything below comes from Kraken's own security support articles as they read in October 2026.

Layer 1: sign-in 2FA, and why passkeys win

Kraken supports three ways to add a second factor at sign-in:

Kraken's 2FA article says it strongly recommends passkeys over every other method. The reason is simple. A phishing site can ask for your authenticator code and replay it in real time. A passkey won't respond to a site that isn't kraken.com.

Kraken's account security guide also says to register more than one passkey. A passkey lives only on the device you enabled it on, so if that phone dies and you have no backup, recovery gets slow.

If you stick with an authenticator app, Kraken suggests keeping its backup code offline and turning off cloud sync for the app. A synced authenticator is only as safe as the cloud account behind it.

Turning on sign-in 2FA also activates step-up 2FA, which asks for confirmation before anyone can change your 2FA settings.

Layer 2: the Master Key

The Master Key is an extra credential with three jobs, according to Kraken:

• It's required to reset your sign-in password, even if someone controls your email.
• It can be used as an alternate sign-in 2FA method.
• It can turn off the Global Settings Lock immediately.

Kraken accepts a passkey (recommended), an authenticator app, or a legacy static password, which it advises replacing. The key rule: store the Master Key on a different device from your sign-in 2FA, and never in the same authenticator app. If both live on one phone, one stolen phone defeats both.

To set it up, open Security, then Advanced Settings, choose to enable the Master Key, complete step-up 2FA, and pick your method.

Layer 3: the Global Settings Lock

The Global Settings Lock (GSL) freezes your account settings. Kraken's account security guide says it blocks changes to settings and withdrawal addresses. To unlock it without a Master Key, you have to wait out a period you choose, from 1 to 30 days (3 by default). Kraken emails you whenever someone tries to unlock it.

Why it matters: an attacker who gets into your account usually wants to add their own withdrawal address. With the GSL on, they'd have to start the unlock timer, which triggers an email to you, then wait days. That's your window to react.

In Kraken Pro: profile icon, Settings, Security tab, Advanced Settings, Activate, then set the unlock period.

Layer 4: 2FA for funding, trading and API keys

Kraken lets you require a second factor for specific actions:

• Funding 2FA asks for a code on withdrawals of any asset and on transfers into the Futures wallet. Kraken suggests it for high-value accounts and people who hold funds without moving them often. You can use a hardware security key or authenticator app.
• Trading 2FA asks for a code before orders go through.
• API key 2FA adds a second factor to a specific key, if the software using it supports that.

One catch Kraken spells out: funding 2FA does not stop someone from adding a new withdrawal address. The GSL does that. And these extra 2FA settings only protect you if sign-in 2FA or the GSL prevents an intruder from switching them off. Treat them as add-ons to layers 1–3, not replacements.

API key hygiene

If you connect Kraken to tax software, portfolio trackers or trading bots, every API key is a door into your account. Kraken's guidance boils down to a few rules:

• Grant the minimum permissions. A tax tool only needs to query balances, ledger entries and trade history. A trading bot needs order permissions. Almost nothing outside your control needs Withdraw Funds.
• Restrict by IP address when the service gives you fixed IPs.
• Set an expiration date so a forgotten key stops working on its own.
• Store keys in a password manager or encrypted form, never in plain text.
• Rotate keys periodically and delete ones you no longer use.
• Vet the third party. Kraken suggests confirming the service stores keys securely and protecting your account there with 2FA too.

A verified individual account can create up to 16 API keys, and up to 25 at the higher-limits level. You probably need two or three.

Phishing and social engineering

Most account takeovers start with a person being talked into something. Kraken's account security page flags these patterns:

• Search-ad clones. Bookmark the sign-in page and use the bookmark. Kraken's real domains include kraken.com, id.kraken.com, pro.kraken.com and support.kraken.com.
• Fake apps. The official apps are Kraken, Kraken Pro, Krak and Kraken Wallet. Any other app using Kraken's name and asking for your login is phishing.
• Fake support. Kraken says its support team will never ask for your password and will never ask you to install remote-access software such as AnyDesk, TeamViewer or Quick Assist.
• "Let me set it up for you." Never let anyone open or manage your account on your behalf.
• Paste-this-command tricks. Never paste a command into your computer because a website told you to.
• Unsolicited contact. Crypto pitches on dating apps, social media or messaging apps are a classic scam setup.

For what exchanges do and don't cover if an account is breached, see our exchange safety and insurance guide.

Your email and phone are part of your Kraken security

• Use a dedicated email address just for Kraken, with its own unique password and passkey 2FA. Avoid SMS 2FA on that email.
• Remove your phone number from accounts that don't need it. Kraken notes a phone number can be used for password resets.
• Protect against SIM swaps: set a carrier account PIN, ask for a port freeze, and set a SIM PIN.
• Keep Kraken's security emails turned on and act fast on any you didn't expect, like a new device or new withdrawal address.
• Review Device Management in Kraken now and then and remove sessions you don't recognize.

How the layers work together

Picture the most common attack: someone phishes your password and gets into your email.

• With nothing set up, they reset your Kraken password through email, sign in, add their own withdrawal address and send your coins out.
• With passkey sign-in 2FA, the password alone doesn't get them in, and a fake site can't capture a passkey the way it can an authenticator code.
• With a Master Key, owning your email isn't enough to reset your password.
• With the Global Settings Lock, even a full login can't add a withdrawal address without starting a multi-day timer that emails you.
• With funding 2FA, sending funds to an address already on file still needs another factor.

No single layer is perfect. Stacked, they turn a five-minute theft into something that takes days and sets off alarms.

The 20-minute lockdown checklist

1. Change your password to a unique one of 15+ characters, stored in a password manager.
2. Add two passkeys for sign-in, on two different devices or one device and one hardware key.
3. Create a Master Key on a device separate from your sign-in 2FA.
4. Turn on funding 2FA for withdrawals.
5. Audit API keys: delete unused ones, strip withdrawal permissions, add expirations.
6. Enable the Global Settings Lock with a waiting period that gives you time to react.
7. Secure your email and phone as described above.
8. Bookmark the real sign-in page and delete any saved links from emails or search results.

Sign up and secure Kraken

If you think your account is already compromised, Kraken's support center has a self-service option to lock the account. Use it first, then contact support through support.kraken.com.