Security

Last updated: October 2, 2026

AEXI is a non-custodial aggregator — it never holds your funds or keys. This page explains how swaps execute, which third-party providers are used, how the platform is hardened, and how to report a vulnerability.

1. Non-Custodial by Design

AEXI never holds your funds or your private keys at any point. Every swap, bridge and Stablecoin Exchange payment is signed from your own wallet, and the resulting transaction settles on-chain — not through an AEXI-controlled balance.

Because AEXI is non-custodial, you remain responsible for the security of your wallet, your seed phrase and the device you sign from. Never share your seed phrase or private keys with anyone, including anyone claiming to represent AEXI.

2. How a Swap Executes

When you confirm a swap, AEXI compares routes and returns the one it selected. You sign the transaction in your wallet, and settlement is handled by the relevant provider on the destination network.

Your client sends a request to the AEXI API, which runs server-side only.
AEXI queries the connected routing providers for quotes and compares them.
The selected route is returned to your wallet for you to sign.
Settlement happens on-chain; the transaction hash is available in your wallet and on the network explorer.

3. Routing & Liquidity Sources

AEXI aggregates liquidity and routing from established third-party providers. The providers AEXI publicly relies on include:

LI.FI — cross-chain routing and bridge aggregation.
NEAR Intents — intent-based cross-chain settlement.
1Click — intent-based swap and bridge execution.
amlbot.com — AML risk screening for the Stablecoin Exchange.

Provider availability can change at any time. AEXI does not control third-party infrastructure and cannot guarantee the behaviour of an individual provider.

4. AML Screening

The Stablecoin Exchange applies AML screening through amlbot.com before a deposit is processed. Each deposit is screened individually, and deposits that fail the risk check are refunded to the originating wallet, minus blockchain network fees.

Read the AML/KYC Policy

5. Application Security Controls

AEXI is built with security defaults on both the client and the server. The controls below describe how the platform is hardened; they deliberately omit operational thresholds and internal detail.

Content Security Policy (CSP) with per-request nonces to mitigate XSS and injection attacks.
Rate limiting on API endpoints to slow abuse and brute-force attempts.
Schema validation (zod) on all inputs — malformed payloads are rejected.
Parameterised database access; user input is never concatenated into queries.
Security headers: HSTS, X-Frame-Options, X-Content-Type-Options, Referrer-Policy and related policies.
Strict CORS and origin checks on state-changing requests (CSRF protection).
Secrets are held server-side only; no keys ship to the browser.

6. On-Chain Verification

Every swap, bridge and exchange produces a real on-chain transaction. You can verify it yourself from the transaction hash shown by your wallet and by the AEXI request tracker. We point to the chain rather than asking you to trust a dashboard.

Track a request

7. Audits & Reviews

AEXI has not published its own independent smart-contract audit. Routing and settlement are performed by third-party providers, each with their own security programmes and public disclosures.

We perform ongoing dependency and security reviews of the AEXI codebase. If we commission a public audit in future, the report will be linked from this page.

8. Responsible Disclosure

If you believe you have found a security vulnerability in AEXI, please report it to us privately. Do not open a public issue or disclose the details before we have had a chance to respond.

We aim to acknowledge reports promptly and will keep you updated as we investigate. Please include enough detail to reproduce the issue, and do not access or modify data that is not yours.

[email protected]

9. Incident History

No material security incidents to date (as of October 2026). If this changes, we will publish a factual summary on this page.

10. Risk Disclosures

Blockchain transactions are irreversible. Cross-chain routes involve third-party bridges and intent solvers, and can fail or be delayed for reasons outside AEXI control. Token prices, fees, gas and settlement times change continuously. Nothing on this page is financial advice.