Securing CoinW: How a former financial services developer built a culture of safety in crypto

When Michael Liu began his career in software development, cybersecurity wasn’t his primary concern. That all changed in 2007 when, working in banking, he saw firsthand that trust in finance depends entirely on the safety of customer data. From that point on, he focused his career on security.

Nearly two decades later, he’s still driven by the same motivation — no longer in traditional finance, but in a new frontier: crypto.

Today, Liu serves as Chief Security Consultant at global crypto exchange CoinW, where he leads a team safeguarding the digital assets of tens of millions of users on the platform. The challenge of staying ahead of threats in this fast-moving space is immense — and, for Liu, fundamental to maintaining trust.

Building CoinW’s security foundation

Founded in 2017, CoinW is a digital asset platform recognized for its robust security. At present, cybersecurity ratings platform CER.live displays an AAA rating for CoinW under its independent exchange assessment methodology.

Liu, who joined the exchange in 2022, credits its track record to a company-wide commitment and leadership that grasps security at a technical level.

“Our boss has an IT background and security background; he knows that security is key for the crypto industry,” Liu said. “This is actually very important, because you can’t build robust security on a shoestring budget — but with leadership that fully prioritizes it, we have the resources to invest adequately.”

That backing has enabled CoinW to assemble an agile security team. Beyond a core team of security engineers, the exchange maintains an internal red team of penetration testers who continuously probe the company’s systems to root out vulnerabilities before they can be exploited.

CoinW’s defenses go beyond technical expertise, Liu added, as they’re woven into the fabric of the organization. Employees receive security training from their first day in the office, with regular refreshers. On a monthly basis, their vigilance is tested with simulated phishing attacks, as the platform seeks to gauge whether its security hygiene is improving.

“When a phishing email comes in, our staff won’t click the link. When potential risks emerge, they report them promptly, and they know how to protect their personal information,” Liu added. “Every part of the company has different security mechanisms to not just protect the data but also our people.”

The unseen threats to CEXs

Despite CoinW’s strong record, Liu said the biggest risks for centralized exchanges today often come from third parties: so-called “supply chain” attacks.

“When you’re building your own system, you may use other people’s code but at the same time you don’t know how safe that code is,” Liu said.

Citing examples from the broader exchange industry, he pointed to recent wallet integration failures as cautionary tales. CoinW’s approach is to keep its systems in-house, from wallets to data infrastructure, rather than outsourcing critical components.

“We seek to retain direct control over critical systems instead of relying on suppliers because third-party dependencies must be carefully assessed and monitored," Liu said.

To fortify its operations, CoinW applies layered technical and procedural controls across its infrastructure. The exchange, for example, has adopted a Zero Trust security model and multi-person authorization controls intended to reduce unauthorized access and single-point-of-failure risks. It has also developed its own MPC wallet, securing cold wallet assets via HSM and secure chips, under strict hot-cold wallet isolation.

“These technologies allow us to create a comprehensive security framework,” Liu explained. “They enable real-time monitoring of both external threats and internal systems, complete with early warnings and rapid responses. This includes automated threat detection across relevant corporate systems and communications channels, together with access controls designed to limit unauthorized lateral movement.”

While much is built in-house, CoinW still draws on external expertise to test its systems. Key partners include Hacken, which runs penetration testing, and CertiK for rigorous wallet system audits. The platform also maintains an open bug bounty program for independent researchers.

“Penetration testers have their own capabilities and backgrounds, so they may do the simulation attack in a different way,” Liu said.

Artificial intelligence: the new battleground

Liu sees artificial intelligence as both the greatest tool and the greatest threat to future exchange security.

“AI is very powerful,” he said. “Not just on the positive side, but on the negative side too.” He expects AI systems will soon play a central role in defense, monitoring vast amounts of internal log data to detect anomalies that might signal an attack.

“In the past, the security team needed to build their own model to find malicious behavior or abnormal data and then do their in-depth analysis,” Liu said. “But when we employ AI, it can make this kind of data analysis work more efficiently.”

CoinW is already investing in this vision through in-house development of AI-powered security agents. Once deployed, these agents will transform the exchange’s security operations into a highly intelligent and automated ecosystem, according to Liu.

Yet the veteran security expert warned that these same capabilities can be used maliciously. Attackers can train AI to scan APIs or identify weak points in infrastructure faster than humans ever could. This is leading to something of an arms race, as attackers and security teams both utilize AI-powered tools in an attempt to gain an edge.

A culture that doesn’t compromise

From Liu’s standpoint, CoinW’s greatest strength isn’t a specific technology but a mindset shared across the company. With that culture in place, the exchange aims to keep its record intact and stay ahead of a rapidly evolving threat landscape.

Looking ahead, Liu said his team confronts a series of critical imperatives: deepening collaborations with partners, expanding detection and monitoring, and forging an advanced security framework that fuses AI agents with human expertise.

“Ultimately, we are establishing a comprehensive security system that envelops every application, every access to the system, every business operation, and every employee.”

Disclaimer: This article is provided for general informational purposes only and does not constitute financial, investment, legal or security advice, or an offer, recommendation or solicitation to engage in any transaction. References to cybersecurity controls, assessments and ratings reflect information available as of the date of publication and do not guarantee that CoinW or any other platform will be free from security incidents, losses or operational disruption. CoinW services are available only where legally permitted and may be restricted or unavailable in certain jurisdictions. Any third-party security rating or assessment relates only to its stated scope and methodology and does not constitute regulatory approval, licensing status or a guarantee of platform security.

This post is commissioned by CoinW and does not serve as a testimonial or endorsement by The Block. This post is for informational purposes only and should not be relied upon as a basis for investment, tax, legal or other advice. You should conduct your own research and consult independent counsel and advisors on the matters discussed within this post. Past performance of any asset is not indicative of future results.