3 ms·
First employee of a major exchange here. You were correct a few years ago, but it's not strictly true anymore. Some oversight and accountability comes from the
by contingencies 9y ago
First employee of a major exchange here. You were correct a few years ago, but it's not strictly true anymore. Some oversight and accountability comes from the VCs that own them and sit on the boards, some from the compliance requirements of banks they work with to obtain financial connectivity, and some from people they outsource customer onboarding to or work with for additional financial settlement options. Also, third party penetration testing should be common by now. There is also something to be said for "zero legacy infrastructure", from a security perspective.
- xiphias 9y agoI'm still waiting for an exchange taking proof of reserves or multi-sig with other exchanges seriously. We know it can be done, and we k ow that none of the exchanges do it anymore. As hopeful as I am, I know that scaling number of users is much more important for exchanges than advancing security through cryptography that users can verify.
- STRML 9y agoAt BitMEX we do 100% offline multi-sig. Unfortunately, that also means any form of live proof-of-reserves is quite difficult to do, as the keys are offline. Early in our history, we thought once-a-day withdrawal would be a problem customers would be quite vocal about. Instead, we found many of them appreciate what it means - that the keys aren't hooked up to a hackable webserver, but are actually protected. Accessing funds should be difficult and should require human interaction.
- jameskegel 9y agoPardon me for sounding ignorant, but how does this process work out procedurally each day?