A crypto exchange with custody, designed around isolation
When a platform holds user funds, security has to be designed in from the start. This crypto exchange, built for a client under NDA, followed one principle: the part of the system that touches wallets stays separate from the part that talks to the internet.
We led the project as team lead of a three-person full-stack team over seven months, delivering an MVP with custody flows.
Key features
- Public exchange service: user accounts, orders and the trading interface.
- Isolated wallet and node service: wallet operations and blockchain node orchestration run in a separate, containerized service, isolated from public traffic.
- Idempotent wallet operations: a retried request isn't applied a second time, so timeouts and retries don't duplicate an operation.
- Ephemeral keys: short-lived keys for sensitive operations, which limits how long a leaked credential stays useful.
- Withdrawal review tools: back-office staff review withdrawals, keeping people in the loop on risky flows.
- CI-gated releases: PHPUnit tests and static analysis must pass before code merges.
Architecture and tech stack
Two services instead of one
The backend is built on Symfony with MariaDB and split into two services. The public exchange service handles accounts, orders and everything users interact with. The wallet and node orchestration service runs separately in Docker containers, isolated from public traffic.
The split limits how far an incident can spread. A problem in the public service can be investigated and fixed without exposing wallet infrastructure. The wallet service can also be locked down far more tightly than a public web application.
React and Redux Toolkit frontend
The exchange interface is built with React.js and Redux Toolkit, which keeps account, balance and order state predictable across a data-heavy trading UI.
Wallet operations that are safe to retry
In any system that moves money, retries are unavoidable: networks time out, workers restart and users click twice. Wallet operations were built to be idempotent, so repeating a request produces the same result instead of a second transaction. Together with ephemeral keys for sensitive operations, this lowers the chance that a routine failure turns into a financial one.
Engineering discipline and release safety
Every change went through CI before it could merge. PHPUnit test suites and static analysis were merge requirements, and code-quality tooling was enforced across the team. For a product that holds user funds, a failed pipeline costs far less than a failed release.
Back-office tooling adds a human check. Withdrawals go through review tools, so staff can examine a risky flow before it completes, not after.
Our role
As team lead, we drove the service split, the CI gating and the operational controls around wallets. We led a three-developer team from architecture to a working MVP with custody flows.
Related work
For the frontend side of crypto trading, see our Crypto Exchange Frontend with WalletConnect and the TRON DAO frontend. Our Real-Time Crypto Market Aggregator covers the market-data side. This kind of build is part of our web app development service.
