In recent times, the digital assets industry has experienced a series of security incidents, with multiple attacks and fund thefts once again bringing platform security to the center of market attention. As attack methods continue to evolve, risks are no longer confined to single wallets or technical vulnerabilities, but may involve account permissions, private key management, asset transfers, and third-party infrastructure across multiple layers.
For users, a more practical question than “Is the platform secure?” is: Can the platform detect and block risks earlier when anomalies actually occur? Are there sufficient authorization and checks-and-balances mechanisms for critical operations? And as assets expand into new categories such as U.S. stocks and RWA, can the security and risk management systems keep pace with these evolving business boundaries?
Against this backdrop, the global digital financial services platform BIT (formerly Matrixport) has officially released the BIT Trust Whitepaper V2.0, which systematically outlines BIT’s current risk governance, security architecture, regulatory compliance, and independent verification mechanisms, with expanded coverage of regulatory, governance, and transparency arrangements across diverse business scenarios including U.S. equities, RWA, and asset management.
As a platform hosts more assets and services, how can security and trust scale accordingly?
What can the platform do before risk actually occurs?
No platform can eliminate all risks with just a claim of “security.” What users should pay closer attention to is whether there are safeguards in place before risks emerge, and whether mechanisms exist to promptly detect and contain anomalies when they occur.
BIT emphasizes in its whitepaper that risk management is not merely a reactive measure, but should be integrated throughout pre-trade assessment, in-trade monitoring, and post-trade handling. In specific business scenarios such as leverage financing and collateralization, this framework is further implemented through due diligence, risk parameter setting, real-time monitoring, risk alerts, and default and liquidation procedures.
These mechanisms ultimately translate into enhanced account and asset security that users can easily perceive. For example, BIT continuously monitors high-risk activities such as unusual logins, suspicious devices, and abnormal withdrawals 24/7, and triggers alerts, delays processing, or initiates manual review based on risk levels. The security system’s goal is not just to “detect what happened after the fact,” but to identify risks during the event and intervene promptly.
At the level of digital asset protection, the majority of assets are stored in cold wallets; private keys are stored in FIPS 140-3 Level 3 hardware security modules (HSMs) and cannot be accessed or exported in plaintext.
But a more critical question than technical tools is: who has the authority to say "no" when business progress conflicts with security requirements?
The whitepaper discloses that if there are significant security risks in the product solution, system architecture, or deployment changes, or if they fail to meet security baselines and compliance requirements, the BIT security team holds veto power; for critical operations such as asset transfers, permission changes, and transaction instructions, the "four eyes principle" is enforced, requiring at least two authorized personnel to participate jointly.
The logic behind this mechanism is not to promise that risks “won’t happen,” but to prioritize security ahead of potential risks—identifying anomalies earlier, establishing constraints sooner, and minimizing the impact of any single point of failure.
From digital assets to U.S. stocks, how can security keep pace with new business boundaries?
As the business expands from digital assets to areas such as U.S. stocks, RWA, and asset management, the meaning of "security" also evolves. Users are no longer only concerned with whether their accounts are secure or how digital assets are stored, but also with who operates the business, what regulations it is subject to, and through which stages the assets pass.
Taking the U.S. stock business as an example, BIT further disclosed the regulatory, account, clearing, and asset custody arrangements for the relevant business in its updated white paper. BIT’s securities business is operated by Matrix Gelephu Pte Ltd and is regulated by the Gelephu Financial Services Office (GFSO); the business is supported by appropriate regulatory and licensing arrangements, client asset protection mechanisms, and participation by licensed third-party financial institutions to ensure compliance and infrastructure support.
What the user sees as a single "buy" action is connected behind the scenes to multiple processes including operations, regulation, trade execution, clearing, and asset custody. For financial platforms, the broader the business scope, the more essential it becomes to extend corresponding risk governance and compliance mechanisms in tandem—rather than simply adding new product entry points.
The same logic extends to other businesses of BIT. The updated whitepaper further elaborates on the regulatory and governance framework of Matrixport Asset Management (MAM) and outlines BIT Group’s compliance footprint across multiple jurisdictions, including Hong Kong, Bhutan, Singapore, Switzerland, the United Kingdom, the United States, and the British Virgin Islands.
From digital assets to traditional financial assets, BIT presents not a point-in-time security mechanism for a single product, but a risk governance and trust framework that scales with expanding business boundaries.
Beyond security, why does trust also need to be “verifiable”?
Risk management addresses how risks are identified and controlled, but for a financial platform covering multiple assets and services, simply telling users “we have risk management” is not enough. If security, compliance, and asset arrangements can only be explained by the platform itself, trust remains merely at the level of “believing what the platform says.”
Therefore, BIT has established compliance and regulatory foundations, independent audit and assurance mechanisms, and technological and operational transparency as the three pillars of its overall trust framework, enabling "trust" to be broken down into more specific questions: Who regulates the platform? How are assets protected? How are risks controlled? Can these mechanisms be independently verified?
At the audit and assurance level, BIT establishes a multi-tiered, complementary verification system through mechanisms such as ISO management system audits, SOC independent attestations, annual financial audits, and internal audits, tailored to the applicable scope of different entities and business lines, thereby avoiding over-reliance on any single audit or assurance mechanism.
Transparency addresses whether information can be seen; verifiability further answers whether that information can be independently verified.
As the industry once again places "security" at the forefront of all platforms, what truly matters may not be repeating the phrase "we are secure," but rather whether users can see the mechanisms behind that statement.
Trust does not come from a single promise or audit, but rather from long-term, consistent institutional operation and external verification. Security requires continuous operation; trust requires continuous validation.
Full version of the BIT Trust White Paper V2.0: https://www.bit.com/whitepaper