2FA (two-factor authentication)
2FA is a second lock on your account. Besides the password there is one more step: a code from an authenticator app, a hardware key or an SMS. If your password leaks, an attacker still cannot get in without the second factor.
Turn on 2FA on your exchange, your email and everywhere money or access to it lives. It takes five minutes and blocks most simple takeovers.
You enabled 2FA with an authenticator app. A scammer found your password in a leaked database but has no code, so the login is blocked. Save the backup codes during setup: if you lose your phone, they bring access back.
What not to do
Do not keep SMS as the only option when an app or hardware key is available: a SIM card can be hijacked. Do not store backup codes in notes on the same phone or screenshot the QR code. Never read one-time codes to anyone, even "support".