2FA for a self-custody crypto wallet, explained

Ask a self-custody wallet for two-factor authentication and the answer is "that's not possible." It is true of the wallet. It is not true of the assets.

Why a wallet can't do it

Your bank can ask for a code because the bank holds the money and decides when to move it. A self-custody wallet holds a key, and the blockchain moves anything that key signs. There is no one in the middle to ask a second question. A code on your phone changes nothing, because the signature is already valid. Anyone with your seed phrase has the key, and the key is the whole login.

People ask for it anyway, in wallet forums and support threads, and the answer is the same every time: a wallet cannot add a second factor without holding your assets or your data somewhere else.

Where a second factor can live

In a smart contract. A Vault is a smart-contract account you own, added under the wallet you already have. The contract, not the wallet, decides when something leaves, and it asks for more than one key.

What GeoSafe's second factor is

Something you have. Your phone. It holds its own key in the device's secure hardware, and a Vault needs your wallet and your phone to sign. One registered phone per Vault.
Something you do. Every withdrawal sends a request to that phone. You tap Approve with Face ID or a PIN, or you tap Deny. There is no third option.
Somewhere you are. At the moment you tap, your phone checks its own position. Inside a Safe Zone you chose, the withdrawal goes through now. Anywhere else, it waits.
Time. The away wait is how long it waits: 1, 3, 7 or 14 days, 7 by default. After the wait it still needs your Approve. Time alone never signs.

The second factor is your phone's key. Where you are and how long you wait decide how fast it signs, not whether it signs. Your seed phrase still opens your wallet. The wallet can ask the Vault for a withdrawal. Nothing moves until your phone says yes. Deny it and that's the end of it.

What it doesn't do

It guards only what you move into the Vault. Withdrawals go only to the wallet you linked. An unlocked phone in someone else's hand is the risk that remains, which is why every approval needs Face ID or your PIN, and why anything approved away from a Safe Zone waits.

Under the hood

Two signatures. A Vault needs your wallet and your phone to sign. Your phone holds its own key in the device's secure hardware, behind Face ID or your PIN. One registered phone per Vault.
The check runs on your phone, and your phone signs it. When you tap Approve, your phone checks its own position and signs either an immediate execution or a delayed one. A faked location without your phone and your face or PIN is nothing. GeoSafe's servers see only the result, inside or outside a zone, never a stream of your movements, and your zones are never stored by GeoSafe in readable form.
The contract enforces the wait. Once a withdrawal is delayed, the Vault contract on the blockchain holds it for the full away wait, and it only ever pays out to the wallet you linked. GeoSafe holds one emergency key. It can stop a withdrawal or a recovery to protect you, but it cannot move funds, start a withdrawal, shorten a wait or change where a recovery goes. A recovery you start completes without GeoSafe, and if GeoSafe disappears the Vault keeps working. We never hold your funds.
Ethereum and EVM chains first. The Vault is a smart-contract account on Ethereum, connected to the wallet you already have through WalletConnect. The Vault contract has had internal security review; an independent audit is planned. The auditor's report, the verified contract address and the documented way to withdraw without the GeoSafe app will be published on the Security page.

Alongside what you already use

GeoSafe connects to the wallet you already have through WalletConnect and is open to wallet partnerships. A hardware wallet keeps protecting your key; the Vault protects what you move into it. Use both. Multisig needs more than one key; a Vault adds permission on top of either. See how the approaches compare.

GeoSafe is an invite-only iOS app. Leave your email and we send your invite as places open. Request my invite

Questions

Is there 2FA for a self-custody wallet?

Not inside the wallet itself. A wallet is a key, and whoever holds the key can sign. GeoSafe adds the second factor underneath the wallet: a Vault that needs your wallet and your phone to sign, with your location checked at the moment you tap Approve.

Why don't self-custody wallets have 2FA?

Because the key is the only thing the blockchain checks. A code on your phone cannot stop a valid signature. The second factor has to live in a smart contract that holds the assets and asks for more than one key. That is what a Vault is.

Is a hardware wallet two-factor authentication?

No. It keeps the key on a device, which protects it from malware on your computer. It is still one factor: the seed phrase written on the card recreates the key anywhere. Keep it; put a Vault under it.

What if I lose my phone?

Lose your phone? Your linked wallet plus your recovery places, places you chose at set-up and reproduce on a map, restore the Vault on a new phone. There is no seed phrase for the Vault to write down. How recovery works is on the Security page.

What if someone has my unlocked phone?

Every approval needs Face ID or your GeoSafe PIN, which should differ from your phone passcode. Away from your Safe Zones, every withdrawal still waits for your away wait, and you can deny it from your next phone.

Can GeoSafe approve something for me?

No. GeoSafe cannot sign on its own, cannot start a withdrawal and cannot shorten a wait. Time alone never signs: after the wait, the withdrawal still needs your Approve.

Two-factor authentication for self-custody.