Enhancing Security and Privacy in Cryptocurrency Exchanges

Abstract

Centralized exchanges (CEXs) dominate cryptocurrency markets due to liquidity and low latency, but their opaque internal ledgers create custodial risk. Meanwhile, privacy concerns motivate private exchanges that blind the platform to user balances and order flow. Recent work such as Pisces [1] explores private and compliable exchanges, but one critical piece in compliance, public verifiable full solvency, remains unresolved. When liabilities are hidden from the platform, the platform cannot construct plaintext-based commitments and cannot be trusted to disclose complete liability sets at audit time, creating a fundamental privacy–solvency conflict. We address this conflict by designing two systems that enforce both solvency and platform-side privacy: * **Audit-then-Check Private and Solvent Exchange System:** Uses an RSA accumulator to provide constant-size membership witnesses; users verify inclusion after the auditor publishes an audit snapshot, and omission yields publicly verifiable evidence. * **Certify-then-Audit Private and Solvent Exchange System:** Eliminates user participation by introducing trusted hardware that certifies each transaction acceptance via a monotonic counter log, enabling the auditor to verify completeness without learning transaction contents. We provide rigorous security analysis that formally establish privacy against a malicious platform and solvency soundness against a malicious user-platform coalition. We implement both schemes and evaluate performance against the state-of-the-art baselines. Our prototype achieves average per-procedure computation under 35 ms, communication bounded by 14 KB per operation. For solvency verification, our online prover time remains nearly constant across user scales, achieving a 41.6× speedup over the state of the art and a 268.6× speedup over deployed baselines at $N = 2^{14}$ users, demonstrating that frequent auditing remains feasible at scale.