Trust is a claim. Proof is a file you can check.

Every exchange says it is safe. This page explains exactly where client assets sit, who can move them, what we publish each month, and what happens if any of it goes wrong.

98%

Cold storage by default

Client assets are held in air-gapped multi-signature vaults spread across three jurisdictions. Withdrawals from cold storage need quorum approval from separate key holders.

Monthly

Proof of reserves

We publish a Merkle-tree attestation every month so you can verify your own balance is included in total reserves, alongside a liabilities report from an independent auditor.

$320M

Insurance and reserve fund

A dedicated fund covers losses from platform failure or a breach of our custody stack, backed by a syndicate policy and an on-chain reserve you can inspect.

Account takeovers to date

Hardware key support, withdrawal allow-lists, per-device session control and a 24-hour hold on any new withdrawal address. No customer account has been drained on our watch.

Proof of reserves

Check that your own balance is in the total

On the first business day of each month we publish a Merkle tree of every client balance alongside an independent report of what we hold on-chain. Your account page gives you a leaf hash and the path to the root, so you can verify your balance was counted without seeing anyone else's.

Latest attestation

Snapshot taken 1 September, verified by an independent accounting firm

Assets held against client liabilities by asset
Asset	Held	Owed to clients	Coverage
BTC	42,118	41,204	102.2%
ETH	388,402	381,976	101.7%
SOL	1,942,600	1,910,884	101.7%
USDC	612,480,000	604,118,000	101.4%
USDT	418,900,000	412,644,000	101.5%

Figures shown are an illustrative sample of the published report. Coverage above 100% reflects our own capital held alongside client assets.

How custody actually works

Client assets are segregated from company funds, are never lent out, and are never used as collateral for anything we do. Moving anything out of cold storage takes several people in several places.

Multi-signature vaults requiring a quorum of geographically separated key holders
Keys generated and stored in hardware security modules that never touch a network
Hot wallet balances capped at the rolling 48 hour withdrawal average
Every withdrawal path replayed in a staging environment before it reaches production
Third-party penetration tests twice a year, with summaries published to clients
Quarterly disaster recovery drills, including a full cold vault reconstruction

What you control on your own account

Most losses in this industry start with a compromised account, not a compromised exchange. These controls are free, and we would rather you turned all of them on.

Hardware security keys and authenticator apps, with SMS available only as a fallback
Withdrawal address allow-lists with a 24 hour hold on anything newly added
Per-device session management, so you can end any session from any other device
API keys scoped separately for read, trade and withdraw, with IP allow-listing
Alerts on sign-in, password change, new device and every withdrawal request

Bug bounty

Break it, and we will pay you for it

Our bounty programme is open to everyone, has no maximum payout cap for asset-loss reports, and we publish a median triage time of under six hours.

Report a vulnerability

Critical

Up to $250,000

Theft of client assets, remote code execution, authentication bypass

High

Up to $60,000

Privilege escalation, order book manipulation, sensitive data exposure

Medium

Up to $12,000

Stored cross-site scripting, broken access control on account data

Low

Up to $2,000

Rate limit bypass, information leaks with limited impact

Compliance

Where we are registered

Aurex holds registrations in each market it serves, and we do not operate in a jurisdiction before the paperwork is finished.

United Kingdom: Registered cryptoasset firm, reference 972104
European Union: MiCA authorised, passported across the EEA
United States: FinCEN registered money services business
Singapore: Major payment institution licence, in progress

Registration is not an endorsement, and it does not protect you from market losses. Digital assets are not covered by deposit guarantee schemes in any of the jurisdictions listed above.