Blockchain.info 2FA Email Delivery Failure — December 2017 Access Lock
ConstrainedCustodial platform became inaccessible — recovery ran through a lengthy institutional process.
In early December 2017, the user crando discovered they could not access their Blockchain.info hosted wallet after the platform failed to deliver two-factor authentication emails required for login. The account had remained in active use for several years, holding Bitcoin, Bitcoin Cash, and Ethereum. On December 5, crando initiated internal transactions to exchange BCH for ETH via ShapeShift integration before logging out.
When login attempts resumed on December 6, the standard 2FA email prompt appeared, but no confirmation email arrived in inbox or spam folder. Investigation revealed the failure was not isolated: multiple other Blockchain.info users (JaniBaram, nickflyer, msyuin, BitsGate, olushakes) reported identical 2FA email delivery failures occurring simultaneously, indicating a platform-wide infrastructure failure rather than individual account compromise. Crando filed support tickets seeking assistance.
One response incorrectly advised resetting 2FA; this reset process changed the registered email address but did not restore functionality—2FA emails failed to arrive from the new address as well. A second support ticket was generated but received no substantive response. During this window when 2FA was temporarily disabled and Tor address access was enabled, the account remained theoretically vulnerable but experienced no unauthorized access. Crando successfully accessed BTC and ETH holdings via the Blockchain mobile app by December 6, though BCH remained inaccessible through that interface and the desktop web wallet remained locked entirely.
Community responses universally recommended migration to non-custodial wallets (Electrum, hardware wallets, paper wallets) to eliminate platform dependency. Crando held a 12-word recovery seed on paper but expressed uncertainty about recovery procedures and whether using the seed would recreate the same 2FA problem. By thread conclusion, partial access persisted via mobile app, but full access and BCH withdrawal remained blocked pending either Blockchain.info support response or platform email system restoration.
| Stress condition | Vendor lockout |
| Custody system | Exchange custody |
| Outcome | Constrained |
| Documentation | Present and interpretable |
| Year observed | 2017 |
| Country | unknown |
Why custodial Bitcoin fails differently than self-custody
Exchange custody transfers the custody problem from the holder to the institution. The holder no longer needs to manage seed phrases, maintain hardware, or understand cryptographic concepts. They need only to maintain their account. This simplicity has a cost: the holder no longer controls the private keys. Access depends entirely on the continued operational, financial, and regulatory health of the exchange.
Cases in this archive show that exchange failures cluster around specific event types: bankruptcy and insolvency, regulatory seizure, geographic sanctions, and account-level access failures (lost 2FA, forgotten email credentials). Each event type has a different recovery path and a different timeline. Bankruptcy proceedings typically take 6-24 months and produce partial recovery. Regulatory seizure timelines depend on legal process. Account access failures may be resolvable through platform support or may not.
The distinguishing feature of vendor lockout cases is that recovery — when it occurs — happens through processes the holder did not design and cannot control. They become claimants in a process rather than holders of an asset.
The primary protection against vendor lockout is not using a vendor for custody beyond what is needed operationally. Holdings intended to be stored long-term are most exposed to institutional risk. Exchange custody is well-suited for active trading and conversion; it is poorly suited for long-term storage of significant value. Moving Bitcoin off exchange into self-custody eliminates platform dependency at the cost of taking on personal custody responsibility.
Translate