Crypto exchange security built into every account and every withdrawal
Most stolen funds leave an exchange through a taken-over account, not a broken server. CryptoTech makes account takeover hard, and makes it hard to move money out even when it happens.
Strong sign-in without frustrating users
Every extra step at sign-in costs some users. The platform offers strong options and lets each user pick what suits them.
- Two-factor authentication with an authenticator app or by SMS, plus recovery codes for a lost phone
- 2FA turns on only after the first correct code, so nobody locks themselves out by mistake
- Passkeys: sign in with fingerprint, face or device PIN. Passkeys only work on your domain, which makes them resistant to phishing sites
- Google, Apple and Telegram sign-in, which still asks for the 2FA code and refuses blocked accounts
- QR sign-in from the mobile app with one-time codes tied to the browser that shows them
- Cloudflare Turnstile on sign-up and sign-in to stop bots without puzzles
- Password reset gives the same answer whether an account exists or not, so it cannot be used to find your users
Users know what is happening on their account
Sign-in alerts
A sign-in from a new device sends an email or SMS and a push notification, so users notice a stranger at once.
Devices
Every signed-in browser and app, with the option to sign out any of them.
Anti-phishing code
A word the user chooses appears in every email from you. An email without it is not from you.
Confirmed changes
Changing email, phone, password or 2FA needs the password and the current second factor.
Connected accounts
Linking Google, Apple or Telegram needs the password first, so an attacker cannot attach their own login.
Notices for every change
Security changes trigger a notice, and an email change also warns the old address.
Withdrawal protection: the last line of defence
If someone does get into an account, these rules stop them from emptying it.
- 2FA on every withdrawal, and each code works only once
- 24-hour security hold after a password reset or change, an email or phone change, or 2FA being turned off. You set the length; 0 switches it off
- Address book with labels, protected by password and 2FA
- Whitelist-only mode: crypto can leave only to saved addresses. Turning it off takes 24 hours and sends an email the user can use to cancel
- Withdrawal limits per VIP level, and a lower cap for unverified users
- Manual approval by your staff for withdrawals that need a second look
The hold also covers fiat withdrawals and selling on P2P, so it cannot be dodged by another route.
API keys that cannot be turned against their owner
- Read, trade and withdraw permissions chosen per key
- IP whitelist with single addresses or ranges, IPv4 and IPv6
- Keys that can withdraw must have an IP list
- No key can change passwords, 2FA or other security settings
- The secret is shown once and stored only as a hash
More on the crypto exchange API page.
Protecting the funds behind the balances
Cold storage rules
Keep only what you need for daily withdrawals in the hot wallet. Rules move anything above a threshold to an offline address you control. With the Enterprise package, Fireblocks custody can hold funds instead.
Correct balances under load
Each order reserves exactly the funds it needs, and each market is locked while an order is matched. Many requests at the same moment cannot spend the same balance twice. Deposits are credited once per transaction, and staking, voucher and airdrop payouts are protected the same way.
No double sends
If a blockchain does not answer while a withdrawal is being sent, the withdrawal is held for review instead of being retried. Your team checks the chain and settles it.
Security for your own team
Roles
Staff see only the admin sections their role allows. Sensitive ones are for super administrators.
Separate admin sign-in
Its own sign-in page with the visitor's IP and a warning on unencrypted connections.
Masked secrets
API secrets and private keys are masked in settings and in error details.
Safe service controls
The admin panel can start and stop only known services, never run arbitrary commands.
Own uploads only
Users can attach only files they uploaded themselves to KYC, appeals and support requests.
Signed webhooks
Merchant webhooks carry an HMAC-SHA256 signature.
Because you host the platform, server security is in your hands too: firewall, SSL, backups and who has server access. Our installation follows a clean-server setup, and we are happy to review your hosting plan before launch.
Crypto exchange security questions
Which 2FA methods are supported?
Authenticator apps (TOTP), SMS codes and recovery codes. Passkeys can replace the password at sign-in.
What is the withdrawal security hold?
After a password, email, phone or 2FA change, withdrawals are paused for a period you set (24 hours by default). It gives the real owner time to notice and react if the change was not theirs.
Can users limit withdrawals to their own addresses?
Yes. In whitelist-only mode, crypto can be sent only to addresses in their address book. Turning the mode off takes 24 hours.
How do users recognise fake emails?
They set an anti-phishing code, and every genuine email from your exchange shows it.
Are API keys safe to give to trading bots?
Keys can be limited to reading or trading, locked to IP addresses, and can never change account security. Keys that can withdraw must have an IP list.
Who is responsible for server security?
You host the platform, so you control the server, network and backups. The application handles account, withdrawal and API security.
