Security

Last updated 13 November 2026

xXTrade is a non-custodial interface. Your funds stay in accounts that your own wallet controls. This page sets out what the interface can and cannot do with them, who holds which key, how that is checked, and how to report a security problem.

No third-party audit. No independent security audit of the xXTrade interface, its servers or its deposit relayer has been done. The checks described below are automated tests that run on every change. They are not an audit, and they do not cover the exchanges, bridges, wallets or login provider the interface connects to.

What the interface can and cannot do

The interface can	The interface cannot
Show prices, balances and positions, and prepare an order, transfer or withdrawal for you to review.	Withdraw or send your funds. Every withdrawal and send needs a signature from your own wallet, which you see and approve.
Place and cancel orders, change leverage and move funds between your trading balance and a vault in your own name (Earn), with a trading key created in your browser after your wallet approves that key once.	Use that trading key to withdraw or send. The exchange (Hyperliquid) does not accept a withdrawal or send signed by an approved trading key, and the interface never builds one.
Submit a gasless USDC deposit for you: a relayer pays the Arbitrum gas and forwards the deposit permit you signed.	Send your deposit anywhere else. The relayer can only call the exchange’s deposit bridge (Bridge2, `0x2Df1c51E09aECF9cacB7bc98cB1742757f163dF7`), credited to the address that signed the permit.
Create optional mirror wallets in your browser. You are shown their recovery phrase and keys to keep.	Move funds out of a mirror wallet to anyone but you. The interface only sends a mirror wallet’s balance back to the wallet you connected.
Block access from restricted regions and check connected addresses against a sanctions list.	Freeze, reverse, recover or reset your wallet, your keys or a transaction.

Who holds which key

Your own wallet (browser extension, mobile or hardware wallet): you. xXTrade never sees its key or recovery phrase.
Email login wallet: if you sign in with email, an embedded self-custodial wallet is created by our login provider, Privy, and its key is managed under Privy’s own key-management design and unlocked by your login. xXTrade’s servers hold no copy or share of that key and cannot sign with it.
Trading key: created in your browser and stored there. Only its address and its signatures leave the browser. It can trade for your account; it cannot withdraw or send. Approving a new trading key from your wallet replaces the old one.
Mirror wallets (optional): created in your browser, with the recovery phrase shown to you to keep. A copy of the key stays in your browser, encrypted once you unlock it with a wallet signature. These are full wallet keys, so fund only what you intend to trade with them.
Deposit relayer key: held by xXTrade on its server, used only to pay gas for the deposit bridge call above. It holds no user funds, and the only thing it can do with your signed permit is deposit that amount into your own exchange account.

No xXTrade server holds a key for a user account on any chain. The operator’s own wallets are listed publicly on the wallets page.

The automated checks

These facts are tested on every change, both by running the real signing code against a stubbed network and by checking the source:

The trading key is created on the client; requests carry its address and signatures, never the key. No server file can create or receive a key.
The deposit relayer can only send to Bridge2. A request that names another destination still goes to Bridge2.
Withdrawals and sends are signed by the user’s wallet, never by the trading key and never by a server.
Each withdrawal and send goes in one request straight to the exchange, carrying exactly the destination and amount the user signed. Mirror wallets sign their own sends and only send back to the connected wallet. No server holds a key that could sign for a user.

Read the test itself: non-custody invariant tests (the exact source that runs in the checks).

Sanctions and regions

Access is blocked from restricted regions, and connected addresses are compared in your browser against the public U.S. OFAC list of sanctioned digital-currency addresses. The rules are in section 2 of the Terms (restricted regions and prohibited persons) and in the Privacy Policy (how the region and address checks work).

What stays on your side

Read what your wallet asks you to sign. A withdrawal or send shows its destination and amount in the signing request.
Anyone who controls your browser or device, for example through a malicious extension, can use the trading key stored there to place orders. If you suspect that, stop using that device and approve a new trading key from a clean one.
Only use xXTrade at xxtrade.xyz and app.xxtrade.xyz.

Reporting a security problem

If you find a vulnerability in the xXTrade interface, its servers or the deposit relayer, email security@xxtrade.xyz with a description, the steps to reproduce it and the impact you expect. A machine-readable contact is at /.well-known/security.txt.

Test only against your own accounts and wallets, with small amounts.
Do not access, change or move anyone else’s data or funds, and do not run denial-of-service, spam or social-engineering tests.
Give us a reasonable time to fix the problem before you publish details; we suggest 90 days.

We aim to acknowledge a report within 5 working days and to tell you what we will do about it. This policy does not offer payment for reports. Problems in the exchanges, bridges, wallets or login provider that xXTrade connects to belong with those projects.