Security

How your account, your withdrawals and the funds on the exchange are protected.

Account protection

Passwords are stored only as an Argon2 hash: nobody can read them, including us. Your email is confirmed with a one-time code from a message.

A code from an authenticator app at sign-in, on withdrawals and when you change your email. If you lose your phone, you have 8 backup codes.

The number of sign-in attempts and code entries is limited. Sign-in and registration also pass an “I am human” check.

You learn about every new sign-in right away. Changing the password ends all sessions on every device; a session lasts no longer than 30 days.

For 60 seconds after you create a withdrawal you can cancel it — in case you notice a mistake in the address or amount.

Withdrawals above 10,000 USDT are sent only after an administrator has checked them.

The exchange checks the address format before creating a request and will not send a withdrawal to the token contract address.

If an account shows signs of being compromised, withdrawals and checks can be paused until things are cleared up — write to support.

Every user has their own address. Addresses are derived from a public key: the exchange server does not hold the private keys to them.

Every balance change is written to a ledger; balances are regularly reconciled with the ledger and with the funds on the network.

The site works only over HTTPS, and a strict content security policy keeps foreign scripts from running.