Security

Every deposit address that Matrimix issues for a swap is signed with our Ed25519 key. You can check the signature yourself with openssl before sending money.

In the wallet, each withdrawal needs a separate confirmation; daily limits and address checks protect against mistakes and account takeover. Most wallet funds are kept on addresses that are not used for daily operations.

Addresses in swaps and withdrawals are screened against the OFAC sanctions list. The site works without JavaScript and loads nothing from third parties.

How to verify a deposit address

Save the message from the order page as msg.txt, the base64-decoded signature as sig.bin and our public key as matrimix.pem, then run:

curl -sO https://matrimix.net/.well-known/matrimix-signing-key.pem
mv matrimix-signing-key.pem matrimix.pem
base64 -d sig.b64 > sig.bin
openssl pkeyutl -verify -pubin -inkey matrimix.pem -rawin -in msg.txt -sigfile sig.bin

matrimix-signing-key.pem · security.txt

Security reports

Found a vulnerability? Write to security@matrimix.net — see /.well-known/security.txt. We reply within 72 hours and credit researchers who agree to be named.