Security
Security at Midas
The controls that protect your account and your withdrawals, and the protections Midas plans to add.
Planned
Insurance Cover
Account Protection
Withdrawal Safeguards
Controls that make it harder for someone with your password alone to withdraw your funds.
Address Whitelisting
Restrict withdrawals to the addresses on your whitelist. The whitelist is on by default, and turning it off takes your passkey.
New Address Delay
A new withdrawal address becomes usable 24 hours after you add it.
Withdrawal Limits
Daily withdrawal limits apply per verification level, and unusual withdrawal patterns are flagged for review.
Anti-Phishing Codes
Set a personal anti-phishing code that appears in every official Midas email, helping you instantly identify and discard phishing attempts.
Encryption
Data in transit uses TLS 1.2 or higher. Data at rest is encrypted with AES-256 by our cloud provider.
Asset Protection
SAFU Fund (Planned)
The Secure Asset Fund for Users (SAFU) is a reserve Midas plans to set up as an extra layer of protection for user assets. It is not in place today, and it is not insurance.
Reserve Pool (Planned)
Once the SAFU fund is set up, a share of trading fees will be set aside for it in segregated cold storage wallets.
Third-Party Insurance (Planned)
Midas plans to take out insurance with crypto-native and traditional insurers to cover custodial assets against theft and security breaches. Midas holds no such insurance today.
Transparent Reporting
Once the SAFU fund and any insurance cover are in place, Midas will publish their balances and terms.
Bug Bounty
Responsible Disclosure Program
We work with security researchers to find vulnerabilities. Rewards depend on severity and follow the bug bounty terms.
Report
Email your findings to security@midas.exchange with detailed reproduction steps, an impact assessment, and any proof-of-concept code.
Triage
Our security team acknowledges your report and assesses its severity.
Fix
Our engineering team develops, tests, and deploys a fix. You may be consulted to verify the remediation.
Reward
Once the fix is deployed and verified, you receive your bounty reward based on its severity.
Your Assets, Our Priority
Turn on two-factor authentication, an anti-phishing code and address whitelisting to protect your account.