How do I enable two-factor authentication?
On the Account page, open the Two-Factor Authentication panel and click Enable 2FA. Scan the QR code with Google Authenticator, Authy, or any TOTP-compatible app, then enter the 6-digit code to confirm. Once enabled, 2FA is required at login, on every withdrawal, and on every API-key rotation. We strongly recommend enabling 2FA before depositing significant funds.
What are the backup codes shown when I enable 2FA?
When you enable 2FA we generate 10 single-use backup codes and display them once. Save them in a password manager or print them — they are your only way back into the account if you lose your device. We never show the codes a second time; you can regenerate a fresh set from the 2FA panel (which invalidates any unused codes).
I lost my 2FA device — what do I do?
Use any unused backup code in place of the 6-digit code at the login screen, on the withdrawal form, or on the API-rotation panel. The code is consumed once and removed from your account. If you have also lost your backup codes, open a Support ticket — recovery requires re-verification of your identity.
Why do I need to verify my email?
Email verification proves you control the address you signed up with. Until you verify, withdrawals and API-key rotation are blocked on your account. The verification link is sent on signup and can be re-sent from the amber banner on the Account page (rate-limited to once per minute).
How do I create an API key?
A per-account API key + secret pair is provisioned automatically when you sign up — find them on the Account page in the API Credentials panel. The secret is hidden by default; click Show to reveal it, then Copy to grab it. You can rotate the pair at any time (which immediately invalidates the old key); rotation requires a 2FA code if 2FA is enabled. All API requests are HMAC-SHA384 signed.
How is my 2FA secret stored?
The TOTP shared secret is encrypted at rest with AES-256-GCM under a per-deployment encryption key (TOTP_ENCRYPTION_KEY) before being written to the database — plaintext never goes to disk. Backup codes are stored as bcrypt hashes; we cannot recover the plaintext codes if you lose them.
How are my funds stored?
The majority of customer funds are held in cold storage (offline, multi-signature). Hot wallets carry only what is needed for active withdrawals. An insurance fund is maintained as an additional backstop against liquidation cascades during stress events; balance proof publishes once funded and audited.
What is the insurance fund?
A pool of stablecoin maintained by LMEX Markets that absorbs the shortfall between a position’s calculated liquidation price and its actual close price during fast moves. Without it, profitable traders on the opposite side might be auto-deleveraged. With it, winners keep their gains. Balance proof publishes once the fund is funded and audited.