WEEX Security Construction Panorama: How Multi-layered Protection Covers User Assets and Platform Operations?

Recently, discussions about platform security in the cryptocurrency industry have noticeably intensified. From asset custody and wallet management to internal permission control and abnormal transaction monitoring, security issues have once again become the focus of industry attention. As the scale of digital asset trading and the complexity of platform operations continue to increase, security risks are no longer limited to the traditional notion of private key protection but are gradually extending to system architecture, personnel permissions, third-party services, and various aspects of daily operations.

This raises a more thought-provoking question: What kind of security system does a cryptocurrency trading platform need to establish to cope with the ever-changing risk environment?

In fact, security construction is difficult to achieve through a single technology or measure. Proof of reserves addresses the issue of asset transparency, account protection focuses on risks during user operations, while wallet management, system security, and data protection involve deeper infrastructure construction of the platform. Different aspects must work together to form a continuously operating security mechanism.

In these areas, WEEX has gradually established a multi-layered security system that includes asset protection, third-party security verification, account protection, and underlying platform defense. From publicly verifiable proof of reserves and a 1,000 BTC protection fund to ISO/IEC 27001:2022 information security management system certification, HackenProof vulnerability bounty program, and internal security measures covering wallets, trading, and data management, WEEX's security construction presents multiple dimensions from externally verifiable information to internal system protection.

Asset and Fund Protection: Ensuring Reserve Information Can Be Verified

When users deposit assets into a trading platform, the first thing they need to understand is whether the platform has the corresponding asset reserves and whether this information can be verified.

In terms of asset transparency, WEEX provides a 1:1 Proof of Reserves. Users can check relevant reserve information through the official PoR page and use the verification methods provided on the page to independently verify whether their personal balance falls within the corresponding proof of reserves. Compared to solely relying on the platform to publish reserve data, users can understand relevant information through publicly verifiable channels, which is an important part of building reserve transparency.

WEEX does not actively promote a single reserve ratio figure as a focal point; the specific reserve situation is based on the information displayed on the official PoR page, and users can query and verify it themselves.

In addition to proof of reserves, WEEX also has a 1,000 BTC protection fund, with the relevant on-chain address publicly available, allowing anyone to check the address balance through a blockchain explorer. This provides users with an independently verifiable channel to understand the public asset information of the protection fund.

It should be noted that the protection fund is a supplementary security mechanism within the platform's security system and does not equate to unconditional compensation for all trading losses or asset losses. If an event that may meet the protection conditions occurs, users need to submit an application according to official rules, and the platform will review each case. According to current rules, relevant applications should be sent to support@weex.com within 30 days of the event, and the final processing results will be based on specific rules and review conditions.

To make it easier for users to access relevant information, WEEX has also established a Trust Center that consolidates proof of reserves, protection fund, security information, and official contact information. Users can understand the publicly available security construction information of the platform through this entry, reducing the cost of searching across different pages.

Relevant links:

WEEX Proof of Reserves: https://www.weex.com/zh-CN/proof-of-reserves

WEEX Protection Fund: https://www.weex.com/zh-CN/protectfund

WEEX Trust Center: https://www.weex.com/zh-CN/trust-center

Certification and Third-Party Verification: Allowing Security Construction to Be Subject to External Scrutiny

The completeness of a security system cannot rely solely on the platform's own introduction. Third-party certification, security assessments, and the involvement of external security researchers are also important components for the platform to continuously discover and improve security issues.

In terms of information security management, WEEX has officially obtained ISO/IEC 27001:2022 information security management system certification, independently audited by Swiss Approval, with certification number 260826/1.

ISO/IEC 27001:2022 focuses on the organization's information security management system, involving aspects such as information security risk identification, information asset protection, access control, and continuous improvement of the management system. For trading platforms, the value of such certification lies not only in obtaining a qualification but also in incorporating information security management requirements into daily operations and management processes.

In terms of external security evaluation, WEEX also continuously pays attention to relevant assessment information provided by third-party platforms such as CoinGecko, CORE3, and CER.live. In the existing security assessment data, CORE3 Security, CER.live Server Security, and User Security have all received very high ratings, and CoinGecko also provides security evaluation information related to exchanges. The relevant scores may be affected by the assessment system, data updates, and page adjustments, with specific indicators and scores based on what each platform actually displays.

In addition to security assessments, WEEX also pays attention to evaluations of the overall performance of exchanges by third-party platforms. For example, CoinGecko's spot exchange ranking has reached a historical high of 15th place.

WikiBit's exchange ranking record is 5th place.

In the evaluation materials related to WEEX by Coin Bureau, the security rating is 4.8/5.

This information pertains to exchange rankings, comprehensive evaluations, or third-party assessments.

In proactive vulnerability discovery, WEEX maintains a long-term partnership with HackenProof, inviting external security researchers to participate in platform security testing through a vulnerability bounty program. Researchers can submit discovered potential vulnerabilities according to project rules, and the platform will verify, assess, and address the relevant issues. This open collaboration mechanism helps introduce external professional perspectives and expand the scope of potential security issue discovery.

At the same time, WEEX has hired external professional security agencies for annual security audits and assessments for several consecutive years, inspecting and reviewing the platform's security construction from a third-party perspective. Such auditing work is part of the platform's ongoing security management and provides references for subsequent security improvements.

Account Security: Multi-layer Protection from Login Identity to Transaction Permissions

Account security is the security aspect that users encounter most frequently in their daily interactions. Password leaks, phishing emails, abnormal device logins, and API Key abuse can all become entry points for account security risks. Therefore, account protection cannot rely solely on password verification but needs to cover multiple aspects such as login, identity confirmation, and fund operations.

In terms of identity verification, WEEX has launched a Passkey feature that supports all endpoints. Passkey is based on public key cryptography, allowing users to complete identity verification through device-supported fingerprint or facial recognition, reducing reliance on traditional passwords and thus lowering the risks associated with password leaks, reuse, and phishing attacks.

To address the increasingly common impersonation emails and phishing behaviors, WEEX provides a phishing code feature. After users set a unique identification code, official emails will display the corresponding phishing code, allowing users to verify identification information to assist in judging the email's source. Additionally, the platform provides weak password detection and reminder mechanisms to help users identify low-security passwords and strengthen account protection in a timely manner.

In sensitive operation scenarios, WEEX supports two-factor authentication (2FA), adding an extra layer of verification for account-related operations; through withdrawal whitelists, users can restrict withdrawal addresses to an approved range, reducing the risk of assets being transferred to unauthorized addresses.

For users engaging in programmatic trading using APIs, WEEX provides API permission configuration and IP binding features. Users can configure corresponding permissions for API Keys based on actual needs and restrict the source of calls by binding IPs. Configuring according to the principle of least privilege helps reduce the risk of API credentials being abused after leaks.

From identity verification to fund flow management, and API call permission control, these measures together form a multi-layered protection mechanism for account security.

Platform and Asset Security: Extending Protection to the System's Underlying Layer

The security features that users can directly see are only part of the platform's security construction. For trading platforms, real security work needs to delve into internal aspects such as system operation, product development, fund flow, wallet management, and data protection.

In daily operations, WEEX is equipped with a professional security team to conduct 24/7 security operations, continuously monitoring, detecting threats, and responding to incidents to pay close attention to potential security risks that may arise during platform operations. Security monitoring is not only initiated after problems occur but is integrated into the platform's daily operations.

In product research and development, WEEX integrates security requirements into the Secure Development Lifecycle (SDL), covering stages such as product design, development, testing, and release. By prioritizing security requirements in the R&D process, potential issues can be identified and addressed as early as possible before the product goes live, rather than relying entirely on remedial measures after launch.

In the capital flow process, WEEX has established a multi-layered inspection mechanism for the recharge and withdrawal processes, including identity verification, transaction risk identification, and abnormal behavior monitoring. For withdrawal operations, the platform also verifies key information such as withdrawal addresses and amounts. Suspicious withdrawals may trigger additional verification to reduce the risk of critical transaction information being tampered with.

In terms of anti-fraud measures, WEEX continuously monitors account and transaction behaviors, triggering user alerts, additional identity verification, or corresponding risk control measures based on identified risk situations. The relevant mechanisms aim to help the platform detect abnormal activities in a timely manner and take further risk control measures when necessary.

Wallet security is also an important component of asset protection on the platform. WEEX employs layered management and strict permission control mechanisms, setting corresponding verifications for key operations and enhancing wallet management through continuous risk monitoring. According to the publicly disclosed certification-related information from WEEX, the platform also involves technical arrangements such as MPC hot wallets and offline multi-signature cold wallets. Specific wallet architecture, the ratio of hot to cold wallets, key management details, and internal permission configurations are considered sensitive security information and are not disclosed externally.

In terms of data security, WEEX extends protective measures throughout the entire data lifecycle, involving encrypted transmission, data encryption and key management, backup recovery, data leakage protection (DLP), isolation and least privilege, as well as monitoring and auditing mechanisms. Data security not only involves encrypting information but also needs to cover different aspects such as data transmission, storage, access, backup, and usage, employing multi-layered measures to reduce the risks of data leakage, unauthorized access, and other potential threats.

Security construction is a long-term investment that requires continuous effort

Different security mechanisms serve different purposes. Reserve proof focuses on the transparency of asset information, ensuring that funds provide supplementary guarantees under compliant conditions. Third-party assessments and audits help the platform examine security construction from an external perspective, while account and system protection runs through users' daily operations and the platform's operational processes.

For trading platforms, security is not a task that can be declared complete through a single certification, a specific function, or a single number. It requires continuous investment and improvement as the business develops, technology changes, and the risk environment evolves.

WEEX will continue to promote security construction around user asset protection, account security, platform infrastructure, and data protection, and provide users with more open and verifiable information to understand the platform's actual investment in security.

About WEEX

WEEX was established in 2018 and is a comprehensive trading platform aimed at global users, currently serving over 10 million users. The platform focuses on security, liquidity, and trading experience, supporting over 2,700 trading pairs, and ranks among the top 2 globally in BTC contract liquidity. WEEX offers up to 400 times leverage and 0% Maker Fee for some contract trading pairs, providing deep liquidity, efficient execution, and flexible trading options for different types of traders. Additionally, the platform has set up a 1,000 BTC user protection fund and continues to build a security system that meets international mainstream standards, providing a safe, stable, and reliable trading environment for global users. For more information, please visit: Website | Twitter | Telegram | Linkedin