In the encryption market in 2026, the news of theft has almost never stopped. Blockchain security company CertiK’sFirst half reportAccording to statistics, a total of 344 security incidents occurred from January to June, resulting in losses of approximately US$1.316 billion. The second half of the year was not peaceful either: Bitget was hacked on September 24, and losses were eventually confirmed to be approximately US$388 million; in October, devices sold by Ledger’s Southeast Asian distributor CryptoBilis were found to have physically implanted stealing components, and on-chain analyst Bitquery estimated that the related losses were approximately US$102 million.

The largest one occurred on October 30 (Taiwan time).Binance hot wallet hacked, on-chain analysis company TRM Labs estimated that the loss was approximately US$6.36 billion, making it the largest theft in the history of the encryption industry. The FBI has confirmed that North Korea was responsible. According to Binance November 3Published account of the hack, the attacker used a fake interview to invade the engineer's computer, and then used internal AI tools to obtain wallet permissions.

As more events occur, the order in which users choose platforms also changes. Handling fees, currency listing speed and ease of use of the interface are still important, but "Is it safe for my assets to be placed here?" has become the first threshold. When security changes from a slogan to a competitive edge, the security system of the trading platform must also withstand user inspection. CoinW, founded in 2017, has focused its resources on this matter in recent years.

344 incidents in the first half of 2026, the focus of attacks shifted from program code to "people" and supply chain

CertiK’s numbers need to be looked at a little more closely. On the books, losses in the first half of 2026 are 46.8% lower than the same period in 2025, but the first half of 2025 includes a single Bybit incident of approximately US$1.45 billion; after deducting this amount, the losses in the first half of this year increased by approximately 28%. In other words, there were fewer large single events in the first half of the year, and the overall risk did not decrease.

Attack methods are also changing. According to CertiK statistics, 33 incidents of wallet compromise resulted in losses of approximately US$445 million, while 204 incidents of code vulnerabilities resulted in losses of approximately US$152 million. The SlowMist security team also found that among the 182 incidents it recorded, operational-level errors such as key leaks, social engineering, and supply chain attacks accounted for only 29.1%, but caused 76.6% of the losses.

For newcomers, the encryption market is full of pitfalls: how to keep private keys, what authorizations are signed, whether customer service is fake, high-leverage positions are liquidated overnight, and AI deep forgery makes fake identities more difficult to identify, and the cost of attackers is declining.

When users open the trading platform, the first answer they need most is not which currency will rise, but whether the assets are safe here. CoinW Chief Security Officer Michael Liu told The Block Exclusive interviewShi said: "Without security, everything returns to zero." He switched from software development to banking industry security in 2007, and joined CoinW in 2022. He believes that security is not an accessory to the technical backend, but an infrastructure trusted by users.

Asset custody: three-layer wallet, self-developed MPC and monthly Merkel tree reserve certificate

According to CoinW’s official description, the platform adopts a three-tier wallet architecture of cold, warm and hot, with most assets stored in offline cold wallets. The core cold storage combines M-of-N multi-signature and physically isolated hardware security module (HSM). The generation, storage and use of private keys are completely offline; changes in large amounts of assets must be approved by multiple roles and multiple levels. CoinW also stated that it has developed its own MPC (multi-party computation) wallet, which can complete on-chain signatures without exposing the complete private key, and is equipped with KMS, TEE and other technologies and freeze recovery mechanisms.

Users cannot see where the assets are placed; the reserve certificate allows users to check it themselves. CoinW releases the Merkle tree reserve certificate every month. The page lists the Merkle root, total reserve rate, and reserve rate of each asset. Users can choose to automatically verify, or download a verification program from GitHub to manually verify to confirm whether their assets are covered 1:1. CoinW said that the system makes the on-chain wallet on the asset side and the Merkel tree on the liability side public separately, and users can check the data on both ends without applying to anyone.

In terms of external verification, CoinW collaborates with Hacken for penetration testing, wallet systems audited by CertiK, and a bug bounty program open at HackenProof. Officials say that more than 200 vulnerabilities have been responsibly disclosed in the past 24 months, and major issues are fixed within an average of 48 hours.

Real-time risk control: zero trust architecture, 24-hour SOC and red and blue team drills

CoinW said that the platform focuses on abnormal login, device identification, withdrawal risk control, API permissions, abnormal transactions and market manipulation monitoring, and establishes a risk control process for prevention beforehand, interception during the incident, and response afterwards. The core is a self-developed real-time risk engine. Access management adopts a zero-trust architecture (Palo Alto Prisma), combining SSO, multi-factor authentication (MFA), identity and access management (IAM) and separation of duties, so that each account only gets the minimum permissions required to complete the job.

The 24-hour Security Operations Center (SOC) integrates alerts and threat intelligence, and the internal red team continuously launches simulated attacks on the system, with the goal of patching vulnerabilities before they are exploited. CoinW said that penetration testers have different abilities and backgrounds, and the methods of simulating attacks will also be different. In addition to technology, the human aspect is also included: employees receive security training from the first day on the job, and there are simulated fishing drills every month to test whether security habits continue to improve.

Liu specifically mentioned the risks of third-party dependence: "When you build your own system, you may use someone else's code, but you don't know how secure that code is." CoinW prefers to directly control key systems and continuously evaluate and monitor external suppliers. In April 2025, CoinW also cooperated with CoinCover to introduce a non-managed disaster recovery solution and an instant fraud protection risk engine; this technology is guaranteed by Lloyd's of London underwriters, and CoinCover itself does not provide insurance for assets.

Contract insurance: The platform invested more than 8 million USDT in liquidation subsidies

Safety is not just about the platform not having an accident, but also about the trading tools not amplifying the risk of losing control. CoinW stated that there are multiple risk funds at the bottom of the contract transaction, which correspond to different contracts. Daily settlement is dynamically adjusted in the manner of "deposit if there is a surplus, and make up if there is a loss." The funds come from the reserves reserved in advance by the platform and the remaining surplus after liquidation.

For users, it is “contract insurance”. This mechanism was launched as the "Contract Guarantee Plan" in May 2025 and will be renamed from July 1, 2026. The platform will invest at least 500,000 USDT every month. Users can apply for subsidies based on their personal accumulated quota, and can receive up to 500 USDT when liquidating their positions; the fund pool quota for each period is fixed and is available while supplies last.

Yoka Zhou, Chief Communications Officer of CoinW, said in an interview with The Block in October that the plan has been carried out for 16 phases, and the platform has invested more than 8 million USDT in total. According to official data in December 2025, the plan has covered more than 116,000 traders, and the positions that comply with the rules are approximately 3.3 billion USDT.

In terms of strategy products, CoinW provides strategy tools such as contract martingale, contract platter, movable grid and CTA. Officials stated that these products not only pursue returns, but also have built-in position management, retracement control and extreme market response mechanisms in their designs, allowing users to set a bottom line for extreme situations when chasing rewards.

Third-party ratings and milestones: CER.live AAA, ISO/IEC 27001:2022

External ratings are another reference for users to judge a platform. As of October 31, 2026, exchange security rating website CER.live Giving CoinW the highest AAA rating, a security score of 90. CoinW has obtained ISO/IEC 27001:2022 information security management system certification. The certificate was issued on September 24, 2025 and is valid until September 23, 2028.

CoinW stated that the platform has not experienced major security incidents since its establishment in 2017, and was awarded the "Most Trustworthy Exchange" at the Next Block Expo in Warsaw in March 2026. CoinW also stated that it is establishing a complete security system covering every application, every system access, every business operation and every employee; this in-depth defense extends from terminals, networks, systems, applications, identities, data, operations and compliance, and uses an "autonomous defense + open collaboration" approach to exchange security issues with partners such as Alibaba Cloud and Slow Mist.

CoinW believes that AI is the next battlefield: AI is both the most powerful tool and the biggest threat to future exchange security. Attackers can train AI to scan APIs and identify infrastructure weaknesses faster than humans. CoinW stated that it is promoting AI-driven Agentic Security, covering program code security, attack surface management, intrusion testing and drills, alarm triage, intelligence summary and response suggestions, and is developing AI security agents internally to improve the efficiency of abnormal data analysis.

What the exchange does is what the users themselves have to do

What the platform can do is lock the door and open the account. CoinW provides two-step verification, anti-phishing codes, withdrawal whitelists, authorization management and official verification channels, and regularly releases anti-fraud guides to remind users to pay attention to fake officials, phishing text messages and fake customer service. The rest of the journey is up to the user: turning on two-step verification, setting up anti-phishing codes and withdrawal whitelists, not clicking on links from unknown sources, and when contacted by “officials”, first go to the official verification channel to check.

Proof of Reserves is not an announcement that “we have the money,” but an invitation to “verify it yourself.” In the encryption market, where narratives and hot topics are taking turns to be staged, CoinW chooses to put resources in places that are not easily seen, but determine whether users can feel at ease.

This article is sponsored by CoinW.

Disclaimer: The above industry dynamics and news events are compiled from public information, including but not limited to public reports on industry news information platforms and various news media. Digital asset trading carries high risks, and users must bear full responsibility for their financial decisions. The content of this article is only an introduction to the platform mechanism and does not constitute any investment advice, income commitment or invitation to offer. Service content may vary by jurisdiction and may not be available in all areas.

this article Security turns from bonus points to admission ticket: dismantling CoinW’s security system first appeared in Chain News ABMedia。