Loading
An exchange holds what you deposit — that is what lets it match your order in microseconds. The question worth asking is what stops the exchange, or anyone who breaks into it, from spending your coins. Every answer below is structural, and every one of them is checkable.
Tokens sit in a vault contract on Base. It pays a withdrawal only when two signatures agree — the venue's, and your own wallet's, over that exact token, amount and destination. A server key on its own pays nobody. Bitcoin, where a venue holds it, goes further: no key that can spend it is ever on the servers.
The vault pays small withdrawals from an allowance that refills at a fixed rate; anything larger waits in a public queue for an hour, where a guardian can stop it. Raising a limit itself waits an hour. No single key, and no single mistake, can empty the vault at once.
A deposit counts only after the chain has confirmed it to the depth the venue requires, and every credit links its transaction. For bitcoin, independent chain indexers must also agree on the coin and its value.
Every withdrawal is signed by the wallet the account signs in with, over the exact destination and amount, once. A stolen session moves nothing, because a session is not a key.
API trading runs under a mandate the account's own wallet signs — its markets, largest order, 24-hour order value and expiry — enforced on every order and revocable at once. No mandate, and no API key, can withdraw.
Every balance change is written to a hash-chained journal, with its reason, in the same transaction as the change. An edit made outside the venue's code is flagged, and removing a record breaks the chain.
Live pricing across major venues.
Three planes. Authority narrows as it descends, and the keys that can spend deposited coins are in none of them: they are offline, on hardware.
Where a person or an agent reaches the venue. Holds no authority of its own.
Where an instruction is checked before anything moves: who is asking, what they are allowed to do, and whether the venue's limits allow it.
Where value moves — and only on a signature the account holder produced, checked by an offline signer before it signs.
Deposits and withdrawals are the only two moments value crosses the boundary, and both leave a transaction on a public chain. Everything in between is a ledger entry you can reconcile against those records.
Agents and people need opposite things from an exchange, so OpeniBank runs two. Both hold real assets. Each has its own ledger and its own keys: a balance on one does not exist on the other.
The exchange for AI agents. Grant a mandate, not your keys.
openibank.org
Bitcoin and crypto, traded simply — with the help a person needs.
openibank.com
| openibank.org | openibank.com | |
|---|---|---|
| Built for | AI agents, and the people and firms who run them | People — from a first bitcoin to active trading |
| Signing in | A wallet signature. No account, no email, no KYC | A wallet signature today; passkeys and verification tiers planned |
| Giving an agent access | Mandates: scoped, budgeted, expiring keys that can never withdraw | API keys, as a power-user feature |
| Getting help | API docs, machine-readable venue status | Learning Lab, help centre, support tickets |
| If a key is lost | Nothing can be recovered — the key is the account | Support-assisted recovery for verified accounts (planned) |
Every contract address, the live chain state and the full custody model are published. Verify them before committing anything.
Matching happens in our ledger, which is why it is instant. Value crosses the boundary exactly twice — when you deposit, and when you withdraw — and each crossing is a transaction on a public chain you can look up on any explorer. Deposits are held in a vault contract that pays a withdrawal only when two signatures agree — ours and your own wallet's, for that exact amount — so a compromise of this exchange alone cannot move them.
Settlement is not yet live. Trading opens when it is.