How would you do this if it's was you?

[HeatBit]

I read about someone on line who lost alot of Bitcoin simply because their email account was hacked and the hackers patientlu wait for the victim to make deposits on any crypto exchanges they used.

Once they got alert that Bitcoin is deposited they quickly took over and moved the Bitcoin out, so the person who shared the message said it's wrong to back up even your 2Fa authenticator codes in the cloud.

I remember this saving my ass when my smartphone stopped working, when I got a new smartphone it only takes my email account to get everything back, so in the case of avoiding this kind of hack what do you suggest then?

Because if I never backed my 2Fa Auth in the cloud it's forever lost I believe, or I don't get it? Sorry I read through that story very late in the night, I was very sleepy and can't find it again, if not I would share link.

[OmegaStarScream]

You could treat your 2FA backup code just like you would treat your seedphrase. Just write it down on a piece of paper.

If you're that paranoid about the account's security, you should consider getting a couple of YubiKeys instead (a main one, and a spare one).

[Upgrade00]

Anything backed up electronically is at risk of being hacked or seen by someone wjo has access to the device which you carry around, more so cause people tend to keep everything in one place, password, 2fa codes and all.
A written backup takes you offline.

[Findingnemo]

2FA adds a layer of protection on exchanges but it is not ultimate security. We are talking about the exchange here so we can't do much other than not leave the email details saved on the cloud. Just use an offline password manager to keep them saved better and in case of an email breach, just change your password as soon as possible.

My personal recommendation: keep a separate email for your crypto-related registration and never login that email in your smartphones by this you can avoid most of them.

[PrivacyG]

If you really want to risk it and not store Bitcoin the right way but instead in a more comfortable way, at least try to add multiple points of failure instead of a single one.  If your Bitcoin exchange account AND your Two Factor Authenticator are both backed up on your e-mail address then if your e-mail is compromised, your Bitcoin will be too.  Separate the Two Factor from your exchange account so if anyone gets access to your exchange account, they at least do not have the Two Factor to be able to withdraw.

[Antidote47k]

I don’t think you should use the same email for both your exchange account and 2fa Authenticator codes. You should separate them and probably don’t login the email that contains the 2fa codes, that way if your exchange email account is compromised, they will still need the 2fa codes but generally it better to just have an offline recovery code,  you can just write down and that’s much safer and if you have a significant amount you should probably consider getting a hardware wallet.

[BALIK]

I remember this saving my ass when my smartphone stopped working, when I got a new smartphone it only takes my email account to get everything back, so in the case of avoiding this kind of hack what do you suggest then?

When setting up 2FA you will find a long text or alphanumeric code below the QR code. You should write that secret code directly in your diary or paper instead of saving it in any digital app or cloud. If you lose your phone, your 2FA code will start re-generating as soon as you manually set that secret key on the new phone. I personally follow this system and it is very safe and useful.

[Renampun]

It's never recommended to back up something as important as your 2FA backup code on the cloud.. you should treat it more carefully and store it on a secure offline media or a physical backup stored somewhere safe.. because once a hacker gets access to your cloud, he can access that backup code and use it to bypass your 2FA protection.

And as suggested by other users, using a different email for your 2FA can also be a good way to secure it. At least if your primary email account is compromised, your 2FA will not be affected.

[Orpichukwu]

Because if I never backed my 2Fa Auth in the cloud it's forever lost I believe, or I don't get it? Sorry I read through that story very late in the night, I was very sleepy and can't find it again, if not I would share link.

What I do if I’m travelling far and I don’t want to go out with my other device which has my 2FA installed on it and I also don’t want to instantly install anything of such in the device I’m travelling with is to copy out where I save my 2FA backup (the code which is generated when you want to set up 2FA newly). I copy and save it either on my WhatsApp or notes without even given it any label that can give out what it’s for or what platform it’s being linked to. This process can also be used; you can back up your 2FA without necessarily using that email/cloud synchronising option. There are better ways which, even if a hacker accesses your mail, will be hard to figure out.

[sunsilk]

Because if I never backed my 2Fa Auth in the cloud it's forever lost I believe, or I don't get it? Sorry I read through that story very late in the night, I was very sleepy and can't find it again, if not I would share link.

You said that the email was hacked, and so if you're going to back up your 2FA in the cloud then it's also hackable.

Why would you put that back up in the cloud if there's also a chance that it can be hacked online? don't save it on any cloud storage.

As mentioned, write it somewhere offline or in a piece of paper or somewhere no gets to access it online.

[NotATether]

I saw that post too.

The method to defend yourself in this situation is to simply change the password, and log out of your accounts.

The hackers did not access the account by guessing the password, but by stealing the cookies stored on his computer.

Changing the password and logging out invalidates the cookies, forcing new ones to be created.

Because hackers can't simply go back to your computer and steal another one, this locks them out.

And also, don't sign into crypto websites with Google or other OAuth ffs. Use email.

[Dr.Bitcoin_Strange]

Yes, something like this has happened to my friend too but she didn't have Bitcoin on the exchange, just USDT, the thief gain access to her email and reset the exchange password and even added a different 2F authenticator which made it Impossible for my friend to gain access to her account on the exchange, even after reporting to support, they could not do much. Just like the first comment said, do not be careless with your 2F key, you should also keep it offline and only use it when necessary. 

The way I always set up any exchange I am using is that before you make a withdrawal, you will have to enter the 2F code, if you want to change my password or email address, you will put the 2F code and even if you make any change on my account, you will have to wait for 24hours before you can withdraw and before all of that is successful, I must have already got a notification from my end.