Let's imagine a web service that allows to create wallets, deposit money and cryptocurrencies, perform money and cryptocurrency exchange and withdraw money.

The critical information here is:

  1. "sign in" credentials that allows to sign in to account.
  2. Private keys that allows to interact with cryptocurrencies wallets.

The common security questions here are:

  1. Authorization and Authentication mechanism.
  2. Where to store private keys and how to access them from back-end application.
  3. Financial transaction confirmation.

We must be tolerant to the following situations:

  1. Villain stole the account's credentials (possible for Admin account).
  2. Villain obtained access to the host where back-end application is running.

In all cases money still must be save.

So, are there common approaches or examples of architectures for such systems. Maybe useful articles?

closed as too broad by Josef, Xiong Chiamiov, Steffen Ullrich, Benoit Esnard, Matthew Mar 16 '18 at 15:39

Please edit the question to limit it to a specific problem with enough detail to identify an adequate answer. Avoid asking multiple distinct questions at once. See the How to Ask page for help clarifying this question. If this question can be reworded to fit the rules in the help center, please edit the question.

Browse other questions tagged or ask your own question.