Security is the foundation a crypto platform should be built on. At ChangeNOW, the security approach shapes the rules and habits we hold ourselves to internally, as a team.
Today we talk with Nikolas B., Technical Lead at ChangeNOW, to discuss where our approach comes from and what we've learned along the way.
Key Takeaways
- Security runs on three fronts at once: people, systems, and processes.
- Every sensitive operation needs sign-off from 2-3 different people.
- Mistakes are treated as fuel for tightening security.
- The smallest-looking rules are often what stop a real incident.
- The strategy going forward is to stay ahead of threats.
Core Security Philosophy
Security at ChangeNOW is a mindset that runs across the company on several fronts at once.
"The first is, of course, people," says Nikolas. "No matter how well-protected a system is, a person can become an attacker's way in."
At ChangeNOW, the team runs regular workshops and training on security awareness and digital hygiene. Access across the company follows the principle of least privilege.
The second front is the systems themselves. Two-factor authentication, hardened API gateways, and encryption of data in transit, at rest, and in memory are treated as baseline requirements. Automated monitoring watches continuously for intrusion attempts and attempts to exploit vulnerabilities, and the results are checked regularly through periodic security audits.
The third front is the process. Specifically, how people are allowed to interact with critical systems. Every sensitive operation at ChangeNOW runs through what the team calls a "two-key" system: no single employee can execute it alone, since it requires approval and action from two or more people.
Work on critical infrastructure itself is confined to restricted, time-limited sessions, carried out under the direct oversight of a designated person responsible for that session.
Security At ChangeNOW: Evolving since 2017
Security philosophy is built up over time, often under pressure. ChangeNOW's approach today looks very different from where it started.
"For any startup entering the market, moving fast is essential," Nikolas explains. "That usually means compromises, including on security."
In ChangeNOW's early days, that meant relying less on formal access-control systems and more on a small circle of trusted people who held access to critical infrastructure. Back then, people were personally accountable for keeping the company stable and secure.
That trust-based model was never meant to be permanent, though.
"It's important to understand that this is a temporary compromise," the Technical Lead notes. "Once a business hypothesis is proven, building out real security systems and processes has to become an inseparable part of how the product develops".
Part of that shift has come from experience.
"Incidents don't happen to products that don't exist," Nikolas says.
Mistakes, in this view, are simply part of how a product matures, and each one is a chance to do better.
ChangeNOW's own history includes process-related security missteps along the way. None escalated into real risk to the product or its users. That wasn't luck, though. It's the layered controls already in place catching them before they could. Each incident was still significant enough to add new safeguards on top.
Hard-Won Lessons
Some of the rules ChangeNOW enforces today didn't look important at first.
-
A login policy that seemed like a minor inconvenience.
-
A requirement that a second person sign off before a large transfer goes out.
-
A rule about who's allowed to touch a given piece of infrastructure, and when.
In practice, they're often the difference between a routine day and a real incident.
The underlying lesson is: no control is ever "too basic" to matter, and no attempted intrusion is too minor to be taken seriously. Every attempt, whether it succeeds, fails, or gets caught halfway through, feeds directly back into how the next layer of defense gets built.
AI and Cybersecurity
We cannot stand still while attackers are evolving.
"Every day, attackers use more sophisticated ways to breach products and the people who use them," Nikolas says.
AI has widened that playing field considerably. According to Bugcrowd's 2026 Inside the Mind of a Hacker report, 82% of hackers now use AI in their workflow, up from just 64% in 2023.
Good news – the same tools cut both ways. AI-assisted research also surfaced real, critical vulnerabilities in widely used software this year. It includes a memory-corruption flaw in a database engine running across countless production systems, caught by Google's own AI-driven vulnerability scanner before attackers could get to it first.
For ChangeNOW, the answer is to stay ahead.
"It's important to respond to every challenge in information security quickly and on time and try to stay several steps ahead," Nikolas adds.
Using every available tool to find and fix vulnerabilities before they ever reach the people who'd exploit them is ChangeNOW’s approach.
Conclusion
No single method of control on this list does the job alone. Enough small locks layered right turn a mistake into a non-event instead of a disaster.
In the next articles, we'll go deeper into how ChangeNOW secures liquidity movement, the tools behind our infrastructure, and the incident-response playbook we've built through hard experience. Stay tuned!
