Fourteen Replies to Reset One Password
Kraken locked me out on January 9. My password reset emails worked fine the whole time. The 2FA code lived on a phone I traded in during November. Fourteen support replies over 19 days. Eleven were boilerplate. A specialist read the login logs and fixed it in 11 minutes.
Fourteen replies. That is the count on support ticket 12663402, opened January 9 at 6:12 pm and closed January 28 at 9:04 pm, and I know both timestamps cuz the whole thread now sits on my desk as a 19-page PDF, next to a coffee mug I abandoned somewhere around reply nine.
The account held $2,340 in Bitcoin and $180 in USD, which is not a fortune, but it was mine, and the login screen kept replying with the same five words every single night: sign-in blocked, contact support. I could change my password all day. The 2FA code I actually needed lived in Google Authenticator on an iPhone 12 I had traded in thru Gazelle in November, boxed and shipped to a warehouse in Louisville, and no reset link on earth reaches into a phone that is gone. That fact took me three days to fully believe.
The peculiar part, the part that bent my head sideways, is that the password resets worked perfectly the entire time — fresh link in four seconds, new password accepted, success banner and everything — and then the login would die on the six-digit screen as if nothing had happened. The fault was never the password. Nobody in the first eleven replies asked me where my authenticator app lived. Nobody asked til reply twelve.
the email that kept working
Nine times across the first three days I ran the full loop: request reset, receive link in four seconds, set a new password, watch the success banner, get refused on the six-digit screen. The consistency was almost impressive. My password was demonstrably fine and demonstrably mine, and the system agreed with both facts right up til the screen where it wanted a code from an app on a phone I no longer owned. Success, then refusal. Nine times.
reply number three
Reply three set the tone on day two. Please clear your cache and cookies, disable any VPN, and attempt sign-in again. I cleared, disabled, and attempted at 11:40 pm on a Tuesday, kneeling next to my router in the hallway in slippers, restarting things that did not need restarting. It changed nothing. I replied explaining that cookies cannot resurrect a deleted authenticator seed, and reply four thanked me for my patience in a font I have come to hate.
what I ruled out
Halfway thru I began keeping a paper list, cuz the thread was outgrowing my memory. Password: ruled out, resets worked. Browser: ruled out, tried three. VPN: ruled out, off the entire time. Email compromise: poked at it, checked forwarding rules, found nothin'. Malware: two scans, both clean. That left one candidate standing, and I sat with it for a whole day before typing it into the search bar: can you move Google Authenticator to a new phone without the old phone. The answer is no, unless you saved the setup QR code. I had not.
the setup qr code
That is the detail I should have known in 2021, when I created the account and chose authenticator app as my master key method. The same screen offered backup codes, and offered a chance to re-save the setup QR, and I clicked past both cuz it was 2021, the market was moving 6 percent a day, and printing a PDF felt like somethin' my father would do. Four years later that thirty-second click cost me nineteen days, a passport photo, and a video call from my kitchen. The QR code lives in the fire safe now. Laminated.
day nineteen, a human named marisol
Reply twelve arrived on day nineteen at 8:31 am, and the name at the bottom was different: Marisol. Actual sentences, referencing things I had actually written, no stock phrases anywhere. She asked for two things — a passport photo and permission to pull my sign-in logs — and I had both to her before 9:00 am. At 9:26 am she wrote the sentence this entire story exists to deliver: the same device hash appears in your 2024 logins and your January attempts. I read it four times. Someone had finally looked.
the logs said one device
The logs were the whole case, and Marisol walked me thru 'em like a person narrating security footage. Every successful login from early 2024 through November 2025 came from one MacBook hash, and every blocked attempt in January came from the identical hash. One laptop, mine, the entire time. The system was never wrong to challenge me — it had no way to know that the person failing the 2FA check was the same person who set the 2FA up in 2021. What it lacked was proof of continuity, and the logs provided it. She reset the authenticator binding after the passport verification. Working time on the actual fix: 11 minutes.
fourteen replies, one answer
The final count: eleven boilerplate replies, two verification-request replies, one human who read the logs. I have stopped being angry about the ratio, cuz the arithmetic explains it — exchanges process millions of tickets, boilerplate is nearly free, and a person who reads logs is not. Still, the fix itself took one person eleven minutes once a person opened the right file. Fourteen replies. One answer. The answer had been sitting in the logs since the first night.
what I do differently now
Three changes, none of 'em clever. Backup codes printed and laminated in the fire safe, not stored as a PDF on the same laptop that holds my sessions. Authenticator moved to an old iPad that will never be traded in, boxed, or repaired at a mall kiosk. And a recurring calendar reminder every 180 days to log in to all three exchanges I actually use, so no account can quietly go odd on me. The PDF sits on my desk. Nineteen pages, fourteen replies, one name worth keeping. Marisol. That is the whole post-mortem.