Loading…
Loading…
Loading…
Security
Croleo is spot only. We do not lend out, stake or rehypothecate customer assets. At launch, funds will sit with a regulated third-party custodian, mostly offline, and every withdrawal passes the same checks before it leaves.
This page describes the security model we are building for launch.
Crypto assets are high risk. You could lose all the money you put in. This is not investment advice. Risk disclosure
Custody
At launch, customer crypto will be held by a regulated third-party custodian in accounts kept separate from Croleo Ltd.'s own money. Our trading ledger records who owns what; the custodian holds the keys.
Most assets are kept in offline wallets that cannot sign a transaction without several approvers. A small hot wallet covers day-to-day withdrawals and is topped up from cold storage under the same approval rules.
Target range. The live split will be published with each proof-of-reserves report.
Keys will be held by a licensed, independently audited custodian, not on our own servers. We will name it before launch.
Each blockchain has its own key set, so a problem on one chain cannot be used to move assets on another.
From launch, reserves are to be held at least one-to-one against customer balances, with a regular public proof. During the public beta every balance is a test fund, so the figures shown are examples. See how to check.
We never put customer assets to work. What you hold is what we hold for you.
Withdrawal pipeline
Most finish in minutes. The checks exist so that someone who gets into your account still cannot empty it.
Completed by You
Choose the asset, network, address and amount. The network fee and the amount that arrives are shown before you continue.
Completed by You
Every withdrawal needs a fresh passkey confirmation on your device, even if you are already signed in.
Checked by Croleo
The first withdrawal to an address you have not used before waits 24 hours. Addresses in your allowlist skip the wait once it has passed.
Completed by You
We email a confirmation link showing your anti-phishing code. It expires after 30 minutes. If you did not ask for it, one tap cancels the withdrawal and locks withdrawals.
Checked by Croleo
Automated checks for account takeover signs, sanctioned or high-risk addresses, and the sender and recipient details that travel-rule regulations require.
Reviewed by our operations team
Large withdrawals, and any flagged by screening, are checked by a person before they are released. We may contact you to confirm.
Signed by the custodian
The regulated custodian signs the transaction with keys for that chain only. You get the transaction ID as soon as it is broadcast.
A security change means adding or removing a passkey, or turning off the address allowlist. Daily limits also depend on your verification level.
Public beta
Account protection
Sign in with an email or SMS code, Google, Apple or a passkey. A passkey is a key pair on your phone, laptop or security key, unlocked with your fingerprint, face or device PIN, and it only works on our real domain.
There is no password for a data breach to leak or for someone to guess. The private key never leaves your device.
SMS codes are weaker: a SIM swap can steal one. So withdrawals and API keys always need your passkey too.
Pick a short code in settings. Every genuine email from us shows it. An email without your code is not from us.
See every signed-in device and passkey, sign out remotely, and get an email whenever a new device signs in.
Register at least two passkeys, for example your phone and a laptop, so losing one device does not lock you out. If you lose them all, you can recover the account by email after a 24-hour wait; this signs out everything else and pauses withdrawals. Read about account recovery.
API keys
There is no withdrawal permission to grant. A leaked key can, at worst, place or cancel orders within your own balance; it cannot move funds out of your account.
Every key can read balances, orders and fills, and place and cancel orders. Nothing else: no withdrawals and no account changes.
Every key is locked to the addresses your servers use, up to 20. Requests from anywhere else are refused.
Every private request is signed with HMAC-SHA256 and a timestamp, so it cannot be replayed. API authentication.
Bug bounty
We welcome reports from security researchers and will not take legal action over good-faith research that follows these rules.
Email a description, steps to reproduce and the impact you see. We reply within two business days and keep you updated until the fix ships. Reward amounts will be published when the programme opens at launch.
Use the subject line "Security report".
Your part
If anyone does, it is a scam. Stop, do not send anything, and report it to us. Check the address bar before you sign in: your passkey only works on our real domain.