Before anything else, understand what kind of account you are creating. Upbit is custodial — it holds your private keys, like a bank holds your cash. Your username, password and 2FA are the only things standing between an attacker and the assets Upbit holds on your behalf. That makes the login itself a high-value target. A self-custody wallet (MetaMask, a hardware wallet) is the opposite: you hold the seed phrase, and no support desk can reset it for you. With Upbit, support can help you recover — but only if you set the account up correctly in the first place.
Creating an Upbit account, step by step
Registration is free. The friction is not the sign-up form — it is the verification that follows. Start from the official site only: type or bookmark upbit.com yourself rather than clicking a link from an email or ad.
Open the official site or app
Go to upbit.com directly, or install the app from the Apple App Store or Google Play. Check the developer name (Dunamu) before installing — fake clones exist.
Sign up with email or a linked account
Provide an email address (or, where supported, a linked Kakao / Apple account) and create a password. Use a unique password you have never used anywhere else.
Verify your email
Click the confirmation link Upbit sends. If it does not arrive in a few minutes, check spam — do not request a flood of new links, as that can trigger temporary throttling.
Set up two-factor authentication
Do this immediately, before funding anything. We strongly recommend an authenticator app over SMS (see the dedicated section below).
Complete identity verification (KYC)
Submit the required documents. Until this clears, your account is restricted — in practice you cannot freely withdraw.
Link a bank / payment method where required
For KRW deposits, Korean users link a verified real-name bank account. Available funding routes depend heavily on your region.
Region reality check
Upbit's full feature set — especially KRW deposits via real-name bank accounts — is built around the South Korean market. Access, available markets and funding methods vary by country and can change. Always confirm current availability on the official site (upbit.com) for your jurisdiction.
Identity verification (KYC): what to expect
KYC (Know Your Customer) is not optional theatre — it is a legal requirement for regulated exchanges, tied to anti-money-laundering rules and the travel rule that forces exchanges to share sender/recipient data on transfers above certain thresholds. In 2026 this is only tightening, with frameworks like MiCA in Europe and stricter stablecoin and travel-rule enforcement globally.
Documents you will typically need
- A government-issued photo ID (passport, national ID, or driver's licence).
- A selfie or live 'liveness' check to prove the ID belongs to you.
- For Korean users: a real-name verified bank account and phone number tied to your identity.
- Sometimes proof of address, depending on tier and region.
THE UNVERIFIED-WITHDRAWAL REALITYAn unverified account is effectively a read-only museum. Per the official site, accounts that have not completed identity verification face withdrawal restrictions. You may be able to look around, but moving assets out is gated until KYC clears. Do not deposit serious money before you are fully verified — you may not be able to get it out on your own timeline.
Verification is usually quick — minutes to a few hours when documents are clean — but can take longer during high-volume periods or if your photos are blurry, expired, or do not match. Use good lighting, a flat surface, and an in-date document. Figures and processing times are set by Upbit and can change; treat upbit.com as the source of truth.
Enabling 2FA properly (and why SMS is the weak option)
Two-factor authentication adds a second lock so a stolen password alone is not enough. But not all 2FA is equal. SMS codes can be intercepted through SIM-swap attacks, where a criminal social-engineers your carrier into porting your number to their phone. An authenticator app (Google Authenticator, Authy, Aegis) generates codes on your device with no carrier in the loop.
Authenticator app
- Immune to SIM-swap attacks
- Works offline, no signal needed
- Codes never travel over a network
- Recommended by every serious security team
SMS 2FA
- Vulnerable to SIM-swap / number porting
- Can be delayed or undelivered
- Tied to your phone carrier's security
- Better than nothing, but treat as a last resort
SECURITYTreat 2FA as the lock on your front door, not a nice-to-have. The single biggest gap between an account that gets drained and one that does not is whether an attacker who guesses your password still hits a wall. Use an authenticator app, and back up the setup key offline before you finish.
When you enable authenticator 2FA, Upbit shows a QR code and a secret setup key. Scan the QR, then save the recovery/setup key somewhere safe and offline:
| Item | What it is | What to do |
|---|---|---|
| QR code | Encodes your 2FA secret | Scan it into your authenticator app |
| Setup / secret key | Text version of the same secret | Write it down on paper, store offline |
| Backup / recovery codes | One-time emergency logins | Print and store separately from your phone |
| The 6-digit code | Rotates every ~30s | Enter to confirm setup, then use at each login |
Back up the secret, not just the app
If you lose your phone and never saved the setup key or recovery codes, regaining access means a slow identity-based recovery through support. Saving the offline secret key turns a crisis into a five-minute re-import on a new device. Store it like you would store a seed phrase: offline, never in a screenshot, never in cloud notes.
Safe login habits that actually matter
Most account takeovers do not come from breaking encryption — they come from tricking you. A few boring habits stop the vast majority of attacks:
- Bookmark the official URL and only ever log in from that bookmark. Never from a search ad, an email link, or a DM.
- Check the address bar every time. Phishing sites use lookalike domains (upb1t, up-bit-login, upbit-secure) that mimic the real login page pixel-for-pixel.
- Never reuse a password. If one site is breached, credential-stuffing bots will try that combo everywhere — including your exchange.
- Use a password manager (Bitwarden, 1Password). It generates long random passwords and, crucially, will refuse to autofill on a fake domain — a built-in phishing alarm.
- Set an anti-phishing code if Upbit offers one, so genuine emails carry a phrase only you know.
- Log in on devices you control. Avoid public or shared computers entirely.
PHISHING WARNINGFake Upbit login pages are everywhere and they are convincing. A cloned site can copy the exact logo, layout and login form, then harvest your password and2FAcode the instant you type them. Once they have a live code, they log in and drain the account in seconds. The address bar is your only reliable defence — if the domain is not exactly the official one, close the tab. No real login page will ever ask you to 'verify' by entering yourseed phraseor a withdrawal address.
Login problems: what to do if...
...you forgot your password
Use the 'forgot password' link on the official login page only. You will get a reset link by email; if you have 2FA enabled, you will also need your authenticator code. This is exactly why backing up your 2FA secret matters.
...your account is locked
Accounts can be locked after repeated failed logins, suspicious activity, or a security flag. Do not keep retrying — that can extend the lock. Wait out the cooldown if one is shown, or contact official support through the site. Have your verification details ready, because they will confirm your identity before unlocking.
...you lost your 2FA device
If you saved your setup key or recovery codes, re-import the secret into a new authenticator app and you are back in. If you did not, you must go through Upbit's identity-based account recovery via support. This is slower and deliberately strict — that strictness is what protects you from an attacker pulling the same trick.
...you are logging in from a new device
Expect an extra verification step — an email confirmation, a code, or a device-approval prompt. This is normal and good: it means a stranger with your password still cannot get in from their own machine. If you get a 'new device login' alert you did not trigger, change your password immediately and review your sessions.
Golden rule for every recovery
Upbit support will never ask for your full password, your 2FA secret, or a seed phrase over chat or email. Anyone who does is an impostor. Real recovery is always driven by verifying your government ID, never by you handing over secrets.
Locking down your account after login
Getting in safely is half the job. The other half is making sure that even if someone does get in, they cannot move your assets.
- Withdrawal allowlist (address whitelisting): register the only wallet addresses funds may be sent to. With this on, an attacker cannot add their own address and instantly cash out — new addresses often face a time delay.
- Device & session management: review the list of logged-in devices and active sessions periodically. Revoke anything you do not recognise.
- Withdrawal alerts: enable email/push notifications for every withdrawal and login so you hear about trouble in real time.
- Keep only what you trade on the exchange: for long-term holdings, move assets to self-custody (a hardware wallet). Remember — on the exchange, Upbit holds the keys.
NETWORK MISMATCH = BURNED FUNDSWhen you do start withdrawing, the send network must match the receive network. Sending anERC-20token to aTRC-20address (or vice versa) can permanently destroy the funds — no support desk can recover them. Double-check the chain, send a small test amount first, and never paste an address from your clipboard without verifying the first and last characters.
For more on holding and moving assets, see our Upbit wallet guide. If you mostly use your phone, the app guide covers mobile login and security.
Frequently asked questions
Re-importing 2FA from a saved setup key is instant. Full identity-based recovery (lost 2FA with no backup, locked account) is slower — anywhere from hours to several days — because support must verify your government ID first. Times are set by Upbit and can change; check upbit.com.
Often minutes to a few hours when your documents are clear and in-date, but it can stretch longer during busy periods or if photos are blurry or mismatched. Use good lighting and a valid ID to avoid resubmissions.
Only in a limited way. Per the official site, unverified accounts face withdrawal restrictions — in practice you cannot freely move assets out until identity verification is complete. Do not deposit meaningful funds before you are verified.
An authenticator app. SMS codes are vulnerable to SIM-swap attacks where someone hijacks your phone number. An authenticator app generates codes on your device with no carrier involved. Back up the secret key offline when you set it up.
Check the address bar matches the exact official domain before typing anything. Always log in from your own bookmark, never from an email link or ad. A password manager helps too — it refuses to autofill on a fake lookalike domain.
Custodial. Upbit holds your private keys, like a bank holds your money — so your login and 2FA are what protect your assets. For self-custody, you'd use a hardware wallet where you hold the seed phrase and no one can reset it for you.