When is 2FA required? How many wrong attempts before it locks, and for how long?

Sensitive operations: transactions over 1,000 USDT, unusual logins, new-device logins, withdrawals, binding a wallet or withdrawal address, setting or resetting the fund password, binding or resetting Google Authenticator, and creating or managing an API Key — require the corresponding security verification. Verification codes are valid for 30 seconds; 5 consecutive failed attempts trigger a 15-minute lockout; resetting Google Authenticator triggers a 24-hour withdrawal protection period.

Learn More