>Encrypt you users private keys client side with a password only they know. Now I just hold encrypted keys my side. I still wouldn't trust you as an exchange.

>Encrypt you users private keys client side with a password only they know. Now I just hold encrypted keys my side. I still wouldn't trust you as an exchange. There's plenty of email/password dumps available. >Hopefully the users chose passwords secure enough to avoid compromise They won't. They won't. They won't. They won't. And keep repeating that until you hate the idea of exchanges ever holding secrets related to large amounts of currency/fiat that law enforcement will not pursue to reclaim your currency.