For centralized exchanges (CEXs), security is fundamental to protecting user assets, maintaining operational stability, and building market trust. As trading volumes and business operations become more complex, exchanges face risks that go beyond private key exposure. These include compromised backend systems, excessive internal permissions, unauthorized withdrawals, and human errors during asset transfers.

Recent security incidents have reinforced the importance of a comprehensive approach. Binance's October 30 security update described an investigation involving a potentially compromised DevOps engineer's device and unauthorized withdrawal transactions submitted through a service container. The incident highlights that backend systems and operational permissions can become attack vectors even when there is no evidence of wallet private key exposure.

Exchanges therefore need more than a wallet solution. They need a multi-layer security framework covering key management, transaction authorization, asset custody, access permissions, and operational auditing.

SoonTech's underlying wallet infrastructure works with Fireblocks, combining professional digital asset wallet infrastructure with platform-level security management to support a more robust foundation for exchange asset management and custody controls.

1. Why CEXs Need Multi-Layer Wallet Security

Centralized exchanges manage multiple wallet and asset-operation scenarios, including user deposits and withdrawals, treasury management, internal transfers, and routine on-chain transactions.

If security relies on a single private key or a small number of administrator accounts, compromised credentials may create opportunities for unauthorized asset transfers.

A comprehensive security framework needs to address several questions:

• How are private keys generated, stored, and used to reduce single points of compromise?
• Who can initiate transactions, and who can approve and sign them?
• How should large transfers, unfamiliar addresses, and sensitive operations trigger additional reviews?
• How can exchanges prevent one employee or compromised account from independently completing high-risk operations?
• Can every asset operation be traced, audited, and reviewed?

These questions form the foundation of exchange wallet security and custody management.

2. Fireblocks Wallet Infrastructure: Starting with MPC Key Management

SoonTech works with Fireblocks for its underlying wallet infrastructure, providing professional support for platform digital asset management. Fireblocks' security architecture goes beyond conventional private key storage by combining Multi-Party Computation (MPC), secure execution environments, and policy management.

1. MPC-CMP: Reducing the Risk of Single-Point Private Key Exposure

Multi-Party Computation (MPC) is a cryptographic approach that distributes key-related information across multiple shares.

Fireblocks uses its MPC-CMP protocol to manage cryptographic key shares across different components. During key generation and transaction signing, the complete private key is not brought together in one location. Instead, multiple participants cooperate to generate transaction signatures.

This approach reduces the risk that compromising a single device, server, or credential will expose the complete private key.

For exchanges, it provides a more resilient foundation for key management rather than relying entirely on one private key file or administrative workstation.

2. Secure Execution Environments: Protecting Sensitive Data and Operations

Fireblocks also uses Trusted Execution Environments (TEEs) and hardware isolation technologies to protect sensitive operations.

These environments provide isolated protection for key shares, policy enforcement, and certain critical operations, helping reduce the risk of sensitive data being accessed or manipulated if a standard system environment is compromised.

Wallet security is therefore not only about how keys are distributed, but also where sensitive operations take place and how their execution is protected.

3. Policy Engine: Applying Rules to Every Asset Operation

Key protection addresses how signing capabilities are secured. Exchanges must also answer another important question: Does the ability to initiate a transaction automatically mean that the transaction can be completed?

Fireblocks' Policy Engine enables organizations to configure and enforce transaction rules. Depending on business requirements, policies can be based on transaction sources, destination addresses, asset types, and transfer amounts.

For example, organizations can:

• Define permitted transfer rules for approved wallet addresses;
• Restrict or block transactions to unapproved destinations;
• Require additional approvals for transfers above specified thresholds;
• Apply different authorization requirements to selected assets or transaction types;
• Establish multi-approver requirements for sensitive operations.

Based on configured policies, a transaction can be approved, blocked, or routed for additional signatures.

This is particularly relevant to CEX operations. Exchanges process large numbers of deposit, withdrawal, and internal transfer requests. Policy-based controls can reduce reliance on manual judgment and establish clearer approval boundaries for critical asset movements.

4. Permission Management and Approval Workflows: Reducing Internal Risks

Exchange security threats do not come exclusively from external attackers. Compromised accounts, poorly configured permissions, and insufficient review of sensitive operations can also create significant risks.

Fireblocks provides administrative approval mechanisms and multi-device approval capabilities that help organizations separate transaction initiation, approval, and signing responsibilities.

Platforms can design their permission frameworks around their own governance requirements:

Role-Based Access: Assign different permissions to operations, finance, technology, and management teams instead of giving every employee the same asset-operation privileges.

Multi-Party Approval: Establish approval thresholds for large transfers, address allowlist changes, and critical configuration updates to prevent one individual from independently completing sensitive operations.

Multi-Device Approval: Sensitive actions can be confirmed through separate devices, with device integrity checks and authentication helping reduce risks associated with compromised endpoints.

Admin Quorum: Sensitive administrative actions, such as adding users, approving address allowlists, and changing key workspace configurations, can require approval from a defined number of administrators.

These mechanisms help reduce internal permission abuse and single-point compromise risks while making asset management more structured.

5. Operational Logs and Auditing: Making Asset Movements Traceable

A security framework must not only prevent unauthorized transactions before they happen. It should also preserve records that allow activity to be reviewed afterward.

Fireblocks provides activity and transaction logging capabilities that help organizations review asset operations and administrative changes.

For exchanges, a comprehensive audit process should focus on:

• Which account initiated a transaction;
• Which assets, amounts, and destination addresses were involved;
• Whether additional approvals or policy restrictions were triggered;
• Which individuals approved the transaction;
• Whether the transaction was approved, rejected, blocked, or failed;
• Whether administrative permissions or wallet configurations were changed.

These records support routine security reviews, internal audits, and investigations into abnormal activity.

6. How SoonTech Integrates Wallet Infrastructure into CEX Security Architecture

Professional wallet infrastructure is an important part of exchange security, but complete platform protection also requires business-specific controls and operational management.

SoonTech's CEX platform solution works with Fireblocks for underlying wallet infrastructure, supporting enterprise digital asset management. During platform planning, businesses can also establish management processes suited to their operational models:

• Wallet and Asset Management: Plan wallet structures and asset management workflows for different business scenarios.
• Permissions and Approvals: Define responsibilities and access boundaries for operators, administrators, and asset managers.
• Withdrawal and Transfer Management: Establish appropriate review rules based on transaction types, amounts, and destination addresses.
• Security Auditing: Maintain records of critical operations and conduct regular reviews.
• Risk Response: Prepare procedures for restricting abnormal transactions, revoking permissions, and handling security incidents.

It is important to distinguish between the underlying wallet and security infrastructure provided by Fireblocks and the broader risk management responsibilities of the exchange. Businesses still need to configure their systems, manage personnel permissions, and establish operational rules appropriate to their own requirements.

Conclusion: Exchange Security Requires Both Technology and Governance

CEX asset security cannot rely on cold wallets alone, nor can it be solved by a single cryptographic technology.

From MPC key management and secure execution environments to transaction policy enforcement, multi-party approvals, and operational auditing, each layer helps address a different category of risk.

SoonTech's collaboration with Fireblocks for underlying wallet infrastructure provides professional support for exchange digital asset management. Combined with platform-level permission controls and operational risk management, businesses can build a more systematic approach to asset protection and custody.

Exchange security is not a one-time configuration before launch. It is an ongoing capability that must extend across asset management, transaction execution, and daily operations.