By Tony Acuña-Rohter, CEO, EDX Markets

On October 29, attackers moved around $6.3 billion out of wallets controlled by Binance. It was the largest theft in the history of crypto. Binance suspended withdrawals for several days, said it would cover the losses from its own resources and is restoring withdrawals in phases. The company deserves credit for its response, taking decisive action to protect customers in the aftermath of an extraordinary event. 

Binance had the balance sheet to commit to covering the losses this time. But that was Binance’s decision, backed by its own financial resources, not a guarantee that extends to every exchange. If the next breach is bigger – or if the next exchange is smaller – customers may find that nobody is coming to bail them out.

That leads to a question that should inform how every institution evaluates a trading venue: how can you protect your customers’ assets without making it harder or more expensive to trade?

Traditional markets offer an answer to that question. They separated key roles a long time ago – the exchange matches, the clearinghouse guarantees, the custodian holds – and therefore insulate their members from much of the risk that announced itself with the Binance hack. 

EDX was built on that structure from day one. Custody is distributed. Each member’s assets sit with a custodian, title stays with the member and funds only move at settlement, so there is no single wallet holding everyone’s assets.

How distributed custody minimizes the risk

The risk in an event like this comes from centralized custody: one company holding every customer’s trading assets in wallets it controls. Most crypto exchanges are built this way. The same company runs the exchange, acts as the clearinghouse, holds your assets as custodian and often runs a brokerage and a market maker on top. To trade, you deposit first. Your trading balance becomes an entry on the exchange’s ledger, and the assets behind it sit in wallets the exchange controls, usually pooled with those of every other customer. Some venues offer segregated custody to institutional clients for assets at rest, but whatever you have ready to trade must be in the exchange’s trading wallets.

That concentration creates risks even when an exchange takes its responsibilities seriously. A single company holds your trading assets, runs the wallets that hold them, decides when you can withdraw and is the only backstop if something goes wrong. There is no independent party between you and the venue, so its security, its solvency and its decisions determine your outcome. And because every customer’s trading assets sit in the same wallets, those wallets are the target of breaches. Even if your assets are not the ones taken, you lose access while withdrawals are frozen, and any delivery obligations you have elsewhere are now your problem.

Prime brokers help mitigate this risk by enabling an institution to trade at a venue without funding it directly. The broker holds the balance at the exchange (or arranges a mirrored credit line against assets at a custodian) and settles with the client afterward. Broadly speaking, we believe in this model. But it doesn’t solve for everything.

Even using a prime broker on a pre-funded exchange with instant settlement still requires the digital assets to be on hand at the moment of the trade, so someone’s inventory necessarily sits at the venue. In an event like the Binance hack, that crypto inventory is what gets frozen, and the broker has to settle with its clients from whatever else it holds. This structure puts the squeeze on the intermediary. On a venue with daily net settlement, a prime broker can intermediate for its clients without keeping inventory at the exchange at all, which reduces risk for everyone involved.

Below is a simple illustration showing how EDX compares to centralized custody models.

How EDX works

EDX is an institutional-only digital asset exchange with a central clearinghouse. To protect our customers’ assets, we make a few basic commitments:

• You do not pre-fund your trading. You post collateral and trade on limits against it. The full value of a trade is never deposited in advance. In addition, because collateral can be posted in fiat, you can trade without parking any crypto at all.
• Your assets stay yours. When you deposit fiat or digital assets with EDX as collateral, title stays with you. They are fully segregated from EDX’s own assets and bankruptcy remote. Any digital assets posted as collateral are held 100% in cold storage at third-party sub-custodians. Members can also keep collateral at an approved custodian of their choice under an account control agreement.
• Money moves once a day, only on the net position. EDX becomes the counterparty to every trade and nets obligations in real time. At the daily settlement window, you deliver one net amount per asset. Given how much nets out, members typically settle between 5% and 50% of their gross trading activity, and that is the only time funds move.
• EDX does not compete with you. We do not onboard retail, do not run a brokerage and do not make markets. We are the exchange and the clearinghouse, and nothing else.

This is how Citadel Securities, Fidelity Digital Assets, Robinhood Crypto, Virtu Financial and other large, sophisticated institutions trade on EDX today.

The controls behind our venue

Structural protections minimize risk. Operational controls cover what is left:

• Segregation of duties. Assets only move to previously whitelisted addresses, and the people permissioned to whitelist an address are separate from the people permissioned to move funds. Whitelists are enforced at EDX and, separately, at the sub-custodian, so two independent systems need to agree before assets move.
• Cold storage. 100% of client assets held at EDX are held in cold storage.
• Multi-admin approval. Every withdrawal must be confirmed by multiple designated approvers, each of whom occupy distinct job roles.
• Risk managed before settlement. Between settlements, member exposure is managed with collateral requirements, risk limits and a clearinghouse default fund under rules every member signs.

The risk EDX manages, therefore, is not a breach of our venue, because there are no pre-funded assets at the venue to take. It is a member failing to deliver at settlement, whether due to a hack, an outage or funds stuck at another venue. That risk is limited to a single member’s net obligation for one settlement cycle, with several layers of protection in place: the member’s own collateral; receivables owed to that member that the clearinghouse can withhold; borrowing and liquidity facilities to ensure other members receive delivery on time; the close-out of the defaulting member’s positions; and a clearinghouse default fund as the final backstop. No other member’s assets are touched.

That is not just theory. On October 29, EDX as the central counterparty and guarantor:

• Activated our response plan, contacting every member of EDX to confirm they could meet their delivery obligations. 
• Because EDX settles once a day on a net basis, members with exposure to the Binance event could reduce or close positions ahead of the next settlement cycle.
• EDX avoided a settlement disruption and insulated its members by using its established clearinghouse tools. In this case, that meant working with our settlement and liquidity partners to acquire the inventory needed to complete settlement, ensuring that other members received delivery on time.

Through these tools, if and when a member cannot deliver in full on time, we can manage the disruption by closing out positions ahead of the window and arranging a buy-in for the balance or borrows, with every other member receiving delivery on time without seeing the problem.

Two models. Pick one.

The way a trading venue holds assets and manages risk becomes crucial when something goes wrong.

In one model, customer assets are concentrated at the exchange, and a breach can expose every participant to losses or disrupted access. The ability to make customers whole depends heavily on the exchange’s financial resources and response. In the other, your assets sit with you, money moves once a day on the net and if a member fails, the loss is bounded to that member’s net obligation and covered by that member’s collateral and a clearinghouse. 

That second model is how markets should work, and it is how EDX works today.

If you trade on a pre-funded venue today, reach out and we will show you what it takes to move.