财富与信任，经得起时间考验。

Security is Nexo’s top priority, ensuring that your assets remain protected while maintaining seamless access to our suite of services.

Our multi-layered security framework integrates advanced measures, including extensive firewall infrastructure, AES 256-bit encryption, real-time alerts, biometric identification, and rigorous third-party audits. Nexo’s systems have been tried and tested through multiple cycles and have remained resilient since 2018.

Multiple layers stand between your assets and a bad actor, each protecting a different point:

• Your account.
  • Two-factor authentication (2FA). A second factor is required on every login, using an authenticator app, SMS or email verification. The same verification is required again for sensitive actions such as withdrawals, Address Book edits and security setting changes. Authenticator apps are stronger than SMS, which is vulnerable to SIM swap attacks, and switching takes a minute in Security settings.
  • Biometric login with fingerprint or facial recognition on supported devices.
  • Withdrawal address whitelisting. Locks withdrawals to addresses saved in your Address Book (up to 500), with a configurable Extra Security delay before a newly added address can be used.
  • Real-time notifications for account activity, including logins and withdrawals, so you can quickly spot anything you do not recognize.
  • A personal anti-phishing code. Once configured, it appears in the footer of every legitimate Nexo email. If an email claiming to be from Nexo does not carry your code, it is not from Nexo. To set it, open the Nexo app, tap your profile, select Security & Settings, tap Anti-phishing code and enter a code of your choice.
• Your transfers. The Anti-scam Engine screens every withdrawal in real time, and the Channel Validator checks who is writing to you.
• Platform and data. TLS and AES-256 encryption, firewalls, and audits against ISO and SOC standards, renewed annually.
• Custody. Institutional-grade partners by region, with assets spread across hot and cold storage.

We also adhere to the highest industry standards, holding certifications such as ISO/IEC 27001, 27017, and 27018, along with SOC 2 and SOC 3 attestations and Cryptocurrency Security Standard Level 3 compliance.

These safeguards reinforce our commitment to maintaining a secure and resilient platform for our clients. To explore in more detail, you can review our certifications here and learn more details here.

Understanding the most common security threats, and the steps that reduce your exposure to them, is an important part of protecting your account, and our guide explains these safeguards in more detail.

Multiple layers stand between your assets and a bad actor, each protecting a different point:

• Your account. Two-factor authentication, biometric login, address whitelisting, an anti-phishing code and real-time alerts.
• Your transfers. The Anti-scam Engine screens every withdrawal in real time, and the Channel Validator checks who is writing to you.
• Platform and data. TLS and AES-256 encryption, firewalls, and audits against ISO and SOC standards, renewed annually.
• Custody. Institutional-grade partners by region, with assets spread across hot and cold storage.

Inside the transfers layer: how the Anti-scam Engine works

Every withdrawal passes through the same automated screening, and what you see depends on the risk it finds.

1. You start a withdrawal. The Anti-scam Engine screens it as part of withdrawal screening, with nothing for you to switch on.
2. It analyzes the transfer in real time. Behavioral signals are combined with intelligence from leading blockchain security providers, which is continuously updated as new scam patterns emerge.
3. It makes a risk-based decision. When no specific risk signals are present, which is the case for most transactions, the transfer goes through without interruption.
4. Elevated risk triggers a prompt. You see a short, plain-language explanation of why the transfer was flagged, with simple options. Most prompts let you double-check the details and proceed.
5. Rare high-risk cases are paused. The transfer may be briefly held for review before funds leave the platform.

Incidents elsewhere in the industry do not change how Nexo’s safeguards work: your account remains protected by two-factor authentication, biometric login, address whitelisting, an anti-phishing code and real-time alerts, every withdrawal is screened by the Anti-scam Engine, and assets are held with institutional-grade custody partners. Our security teams continuously monitor developments across the industry. At present, all Nexo products and services operate normally and as designed, and you can check Nexo’s live system status here.

No. Nexo will never ask for your password or 2FA code, ask you to authorize a transaction through chat, email or text, or send you a login link by SMS. If anyone claiming to be from Nexo does any of these things, it is not Nexo. You can report suspicious messages to Client Care at support.nexo.com/contact.

As an additional layer of protection, if you are unsure whether an email address, social handle or URL belongs to Nexo, you can verify it with the Channel Validator.

When you are unsure whether an email address, social handle or URL belongs to Nexo, verify it with the Channel Validator at nexo.com/channel-validator. If you have set up a personal anti-phishing code, it appears in the footer of every legitimate Nexo email. Nexo also publishes education on fraud and social engineering. Learn more about the Anti-Scam Engine.

Custody partners are selected region by region, in line with local regulatory frameworks. Diversifying custodians also helps us mitigate counterparty risk.

Nexo's controls are independently assessed against internationally recognized standards, are reviewed and updated as cybersecurity threats evolve, and its certifications are renewed annually. The public SOC 3 report is available on the Nexo Security page.

• ISO/IEC 27001:2022 — How Nexo manages information security: documented risk assessment, defined controls and regular internal audits
• ISO/IEC 27017:2015 — How cloud infrastructure is configured and secured
• ISO/IEC 27018:2019 — Protection of personal data processed in the cloud
• SOC 2 Type 2 — Security controls evaluated over a period of time, not a single moment
• SOC 3 — The public version of the SOC 2 report, based on the AICPA Trust Services Criteria for security, availability and confidentiality
• CSA STAR Level 1 — Transparency of cloud security practices
• CCSS Level 3 — Safeguards for digital asset custody (Cryptocurrency Security Standard)

Read more in Nexo's ISO certification announcement and its guide to the security certificates.