Protecting user assets is a foundational responsibility at XT Exchange. Our security approach combines 1:1 asset backing, verifiable Proof of Reserves, layered wallet protection, account safeguards, risk monitoring, and ongoing security testing.

These measures work together to protect assets, strengthen individual accounts, identify suspicious activity, and support reliable platform operations for the users and businesses that rely on XT Exchange.

XT Exchange Security at a Glance

• 1:1 asset backing: XT Exchange maintains corresponding assets to support user balances on the platform.
• Proof of Reserves: Users can review published reserve ratios for mainstream assets within the current reporting scope.
• Merkle Tree verification: Eligible users can verify whether their balances were included in the relevant reserve snapshot.
• Layered wallet protection: The majority of user assets are held in offline cold wallets, supported by multi-signature controls.
• Account safeguards: Users can enable two-factor authentication, set an anti-phishing code, verify official XT channels, and restrict API access.
• Risk monitoring: XT Exchange monitors for potentially unauthorized, fraudulent, or abnormal activity.
• External security testing: A public HackenProof bug bounty allows independent security researchers to report eligible vulnerabilities.

Together, these controls create multiple layers of protection around assets, accounts, transactions, and platform operations.

---

1. Assets Are Backed and Verifiable

XT Exchange maintains user assets on a 1:1 basis, helping ensure that corresponding assets remain available to support user balances.

Through the XT Proof of Reserves page, users can review published reserve ratios for mainstream assets within the current reporting scope. PoR focuses on whether reported assets cover the user balances included in a particular snapshot. XT Exchange plans to expand the range of covered assets over time.

For each included asset, the reserve ratio is calculated as:

XT wallet assets ÷ included user assets × 100%

A reserve ratio of at least 100% indicates that the reported XT wallet assets equal or exceed the user balances included in that particular reserve snapshot.

Merkle Tree verification

XT Exchange uses a Merkle Tree to organize included user balances into cryptographically hashed records.

Eligible users can verify whether their balances were included in the relevant reserve snapshot without requiring XT Exchange to publicly disclose individual identities or holdings. This turns asset backing into information users can examine directly.

Through the verification process, users can check:

1. Whether their eligible balance was included in the reported dataset.
2. Whether the published wallet assets covered the user balances included in that snapshot.

Proof of Reserves provides a focused view of asset backing at a particular point in time. Users should review the latest report for its covered assets, reserve ratios, snapshot information, and verification scope.

---

2. Assets Are Protected Through Layered Custody

Digital asset platforms need online, or hot wallets to process routine deposits and withdrawals. Because these wallets connect to operational systems, they generally face greater exposure to online threats than offline storage.

XT Exchange stores the majority of user assets in offline cold wallets. Keeping assets offline reduces their exposure to internet-connected systems, while controlled hot-wallet capacity supports routine platform operations.

The wallet-security framework also uses multi-signature protection. Multi-signature controls require multiple authorizations for designated wallet transactions, reducing reliance on a single key or approver.

Cold storage and multi-signature authorization form part of a broader custody approach that includes secure access management, transaction reviews, and operational controls. Each layer serves a different purpose:

• Cold storage reduces online exposure.
• Multi-signature protection strengthens transaction authorization.
• Access controls limit who can interact with sensitive systems.
• Operational monitoring helps identify potentially suspicious activity.

By combining these measures, XT Exchange can support routine deposits and withdrawals while maintaining additional protection around asset custody.

---

3. Accounts and Platform Activity Are Safeguarded

Platform infrastructure is only one part of digital asset security. Attackers may also target individual users through phishing, impersonation, stolen passwords, compromised devices, or exposed API keys.

XT Exchange provides several account-level safeguards that users can activate and manage.

Two-factor authentication

Two-factor authentication adds another verification step beyond the account password.

Users can enable Google Authenticator and supported email or SMS verification through the XT Security Center. Enabling 2FA helps reduce the risk that a stolen password alone can be used to access an account.

Users should also protect the email address and mobile device associated with their XT account.

Anti-phishing codes

An anti-phishing code is a unique combination of letters and numbers selected by the user. Once enabled, the code appears in legitimate XT email and SMS communications.

If the expected code is missing or incorrect, users should treat the message as suspicious and avoid opening links, sharing information, or transferring funds.

Users can configure an anti-phishing code through the XT website:

1. Sign in and open Profile.
2. Select Security Center.
3. Find Anti-Phishing Code and select Setting.
4. Create a unique code and complete the required verification.

Official-channel verification

Scammers may impersonate digital asset platforms through fraudulent websites, email addresses, social media profiles, contact handles, or payment addresses.

The XT Official Verification tool allows users to check whether a source is officially associated with XT Exchange. The tool can be used to verify:

• Websites
• Sender email addresses
• Social media accounts
• Contact handles
• Wallet or payment addresses

If a source cannot be verified, users should not interact with it, provide account information, or transfer funds. Suspicious contacts can be reported to XT Support for review.

API security

XT API keys use query permission by default. Trading and withdrawal permissions must be authorized separately, allowing users to grant only the access required for their intended use.

API users can also bind keys to trusted IP addresses. Users should enable IP restrictions where possible, avoid unnecessary withdrawal access, securely store API credentials, and remove unused or potentially exposed keys.

Risk monitoring

XT Exchange monitors for potentially unauthorized, fraudulent, or abnormal activity, including stolen credentials, unauthorized account use, fraud, money laundering, wash trading, and market manipulation.

When necessary, additional verification or temporary restrictions may be applied while suspicious activity is reviewed. These measures help protect users, counterparties, and the integrity of the platform.

---

4. Security Is Continuously Tested and Improved

Security threats change continuously. Protecting a trading platform therefore requires ongoing testing, monitoring, response, and improvement.

XT Exchange operates a public bug bounty through HackenProof, an external Web3 security platform. The program enables independent security researchers to report eligible vulnerabilities affecting XT’s website and applications.

This external reporting channel supplements XT’s internal security work by helping identify potential weaknesses for investigation and remediation.

Incident response and recovery

Preparedness also means responding quickly when unusual activity is detected.

In November 2024, XT Exchange detected an abnormal transfer involving platform-wallet assets and temporarily suspended withdrawals while completing an investigation, wallet maintenance, and security upgrades.

The affected assets belonged to the platform, and user balances were not affected. Services subsequently resumed, and XT Exchange continued strengthening asset transparency through its Merkle Tree-based Proof of Reserves system.

The incident reinforced the importance of rapid containment, clear communication, operational recovery, and continued investment in security controls.

Four Steps Users Can Take Now

XT Exchange builds security safeguards into the platform, but users also play an important role in protecting their accounts.

Every user should take these four steps:

1. Enable two-factor authentication. Use Google Authenticator or another supported verification method.
2. Set an anti-phishing code. Confirm that the correct code appears in communications claiming to come from XT Exchange.
3. Verify unfamiliar contacts. Use XT Official Verification before interacting with unfamiliar websites, accounts, representatives, or payment addresses.
4. Review API access. Limit permissions, enable IP restrictions where possible, and remove unused keys.

Users should never disclose passwords, private keys, seed phrases, API secret keys, or complete authentication codes. XT representatives will not request this information.

So, Is XT Exchange Safe?

XT Exchange uses multiple layers of protection around user assets and accounts. These include 1:1 asset backing, Proof of Reserves reporting, Merkle Tree balance verification, majority cold-wallet storage, multi-signature protection, account-security controls, risk monitoring, external vulnerability reporting, and incident-response procedures.

These safeguards provide users with practical protections and reserve information they can examine directly. Security, however, is not created by one feature or a single point-in-time check. It depends on custody controls, account protection, monitoring, transparent communication, effective response, and responsible user behavior working together.

No platform or security measure can eliminate every risk. XT Exchange continues to review and strengthen its safeguards as threats, products, and user needs evolve.

Users can take an active role by reviewing the latest Proof of Reserves, enabling all available account protections, and using XT Official Verification before interacting with unfamiliar contacts or addresses.

---

Frequently Asked Questions

1. Does XT Exchange maintain 1:1 asset backing?

Yes. XT Exchange maintains user assets on a 1:1 basis. Its Proof of Reserves page publishes reserve ratios for mainstream assets within the current reporting scope.

2. Can users verify their balances?

Eligible users can use XT’s Merkle Tree verification system to check whether their balances were included in the relevant Proof of Reserves snapshot.

3. How does XT Exchange protect assets in custody?

XT Exchange stores the majority of user assets in offline cold wallets and uses multi-signature protection as part of its layered custody framework.

4. How can users strengthen their XT accounts?

Users should enable 2FA, set an anti-phishing code, use unique login credentials, verify unfamiliar contacts, restrict API permissions, and protect the email address and devices associated with their accounts.

5. How can users verify an XT contact?

Use XT Official Verification to check websites, email addresses, social media accounts, contact handles, and wallet or payment addresses.

This article is provided for informational and educational purposes and does not constitute financial, legal, investment, or cybersecurity advice. Holding or trading digital assets through any platform involves risk.

About XT Exchange

Founded in 2018, XT Exchange is a leading global digital asset trading platform, serving over 12 million registered users across more than 200 countries and regions, with an ecosystem reach exceeding 40 million. XT Exchange supports 1,300+ tokens and 1,300+ trading pairs, offering a wide range of trading options, including spot, margin, and futures, alongside a secure RWA (Real World Assets) marketplace. Guided by the vision “Xplore Crypto, Trade with Trust,” the platform strives to provide a secure, trusted, and intuitive trading experience.

Join the XT Exchange Community: X (Twitter) | Telegram | Facebook | Instagram | LinkedIn | Medium | YouTube