Crypto Exchange Security in 2026: What SOC 2 Type 2 Covers and What to Ask Beyond It

Exchange security is now a vendor selection question. Within days of each other, Binance reported a theft of about $6.3 billion that Binance’s own report ties to a tampered software install and a fake recruitment process, and Mercado Bitcoin, Brazil’s largest exchange, paused deposits and withdrawals after an incident in one of its systems.

A SOC 2 Type 2 report is common independent evidence of how a vendor runs its controls over a period of time, but it is an auditor’s opinion, not a certificate and not a guarantee.

Buyers should read the report’s scope and exceptions, then ask each vendor who can authorize transactions, how developer machines and tools are controlled, and how it responds to an incident.

What did the latest exchange security incidents show?

Two exchange incidents were reported in the first week of November 2026, and only one has a public account of how it happened. Binance has published a detailed account of its own. Mercado Bitcoin has not yet disclosed how the attacker got in.

Binance’s report says attackers used the access they gained to initiate transactions outside the normal withdrawal flow. The weak points it describes are a developer’s machine, the tools on it, and the path that signs transactions. Those are controls over people, devices and change, which are worth asking vendors about.

What does a SOC 2 Type 2 report cover?

A SOC 2 report is an attestation: an independent CPA firm examines a company’s controls against the AICPA’s Trust Services Criteria and gives an opinion. The five criteria are Security, Availability, Processing Integrity, Confidentiality and Privacy. Security is required in every SOC 2 audit, and the other four are chosen by the company based on the service it provides.

The Type 2 report describes the system in scope, management’s assertion, the auditor’s opinion, the controls tested and the results of each test. Reports are usually shared under NDA.

What does a SOC 2 report not cover?

A SOC 2 report is not a certificate, and it does not reduce to a pass or fail. It cannot promise that a company will not be breached. Four limits matter most to a buyer:

• Scope: it covers only the systems, services and locations described in the report. A product or process outside that boundary is not tested.
• Criteria: it covers only the Trust Services Criteria the company chose. A report that covers Security alone says nothing about Availability or Confidentiality.
• Period: it covers the observation window. Changes after the window are not tested.
• Specific designs: it tests that controls operate against criteria. It does not prescribe how a company designs custody, key management or transaction signing, so those designs are worth asking about directly.

An exception in a report does not automatically make the opinion negative. What matters is how material the exception is and how management responded.

How should a buyer read a SOC 2 Type 2 report?

Read the report in this order, because the opinion alone says little:

1. The opinion: whether the auditor’s opinion is unqualified.
2. The system description: which services, systems and locations are in scope, and whether the product you will use is among them.
3. The criteria: which of the five Trust Services Criteria were tested.
4. The period: the observation window, and how recent it is.
5. The exceptions: what failed, how material it was, and management’s response.
6. Complementary user entity controls: the controls the vendor expects you, the customer, to run yourself.
7. Subservice organizations: which third parties, such as a cloud host or custody provider, the vendor depends on, and whether they are covered.

What should buyers ask a vendor beyond SOC 2?

Binance’s account runs through developer machines, software tools and the transaction-signing path. A SOC 2 report can show that access, change and monitoring controls were tested, but it does not describe how a vendor designs those paths. Ask each vendor directly:

• Signing and authorization: who or what can authorize a transaction, how many approvals are required, and how quickly a delegated permission can be revoked.
• Developer machines and tools: how engineer devices are managed, how software installs and package sources are controlled, and how internal AI tools are given access.
• Hiring and contractors: how candidate and contractor interactions are verified before anyone gets access.
• Custody: where keys are held, which third-party custody provider is used, and what happens if one component is compromised.
• Detection and response: how an unusual transaction is detected, who is notified and how fast, and what customers are told during an incident.
• Independent testing: how often penetration tests are run, by whom, and how findings are tracked to closure.
• The report itself: whether you can read the full report under NDA, and which systems and criteria it covers.

What has Shift Markets completed?

Shift Markets has completed a SOC 2 Type 2 audit with zero exceptions, conducted by BPM. The audit involved 333 evidence requests; see Shift’s SOC 2 Type 2 announcement.

Shift Markets, founded in 2009 in New York City, has powered more than 250 exchanges and brokerages, with over $2 trillion in total volume traded and 10 million registered end users on its platform. Its Integrations Hub lists custody, KYC and transaction monitoring partners, so operators can choose their own providers.

Other vendors in this category also state that they hold SOC 2 Type 2 reports. Ask every vendor what its audit covers, and use the questions above to compare them.

Bottom Line

A SOC 2 Type 2 report is a useful independent check on how a vendor runs its controls. The recent exchange incidents show why buyers should also ask how signing, developer devices and incident response are handled, and compare every vendor on the same questions.

To see how the Shift Platform fits your stack, reach out to our team to request a demo.