Quote from: lseo on June 05, 2017, 07:18:14 AM

Hello,

I and a friend are trying to develop an exchange, at last to learn how it works.
At moment, we are using bitcoinjs-lib.

1) An exchange creates a wallet per user ? Or does it have a single wallet which makes all transactions ?
2) If the exchange keeps a wallet per user, how can it protect the user's private key in case of unauthorised access in database ? Crypt and decrypt it with user's password is an option, but it implies in ask for password every transaction.

Regards,

From what I've seen as user, I think that (for BTC-like coins) they have one wallet they check for each and every user one address (per user) for inputs only.
As user you have one address to send your funds to. After your funds get one confirmation there's a big chance your funds are sent away (used as inputs for others' withdrawals). If you withdraw, your inputs will most likely not be from the one address where you sent the money to. Also this makes it easier to use cold storage as needed.

There's no such thing as user's private key in such online services. All private keys are the exchange's and they are used accordingly. And if a breach happens, we better pray that most of the funds are protected in cold storage.