CORE3 Exchange Security Score and CoinGecko's Cybersecurity Score

An exchange's Cybersecurity Score on CoinGecko is based on its Exchange Security Score from our partner, CORE3. This article explains how the two scores relate, how to look up an exchange's CORE3 score, and what the security check marks mean.

1. How the CORE3 security score converts to the Cybersecurity Score

For the full Security Score methodology, please refer to CORE3 methodology.

2. How to check an exchange's CORE3 score

1. Go to https://core3.io/ratings/exchanges.

2. Search and select the exchange.

3. Find its Exchange Security Score and match it to the table above.

Example: An exchange with a CORE3 score of 97.6 falls in the 80 – 100 range, so it receives a Cybersecurity Score of 2/2 on CoinGecko.

3. How to get the Penetration Test, Proof of Reserves and Bug Bounty check marks

CORE3 assesses these check marks under its own methodology. In general, it looks at the following:

Penetration Test: Score above 75 out of 100.

• Web, API, iOS and Android are worth 25 points each.

• Only reports from the last 12 months count.

• Unresolved findings reduce the score.

Proof of Reserves: A valid third-party PoR audit that includes proof of ownership of the reserve wallets.

• Expired reports don't count.

• Full user scope, high-quality assets, regular attestations and Merkle tree verification raise the score further.

Bug Bounty: An active bug bounty program.

• Paused, expired or closed programs get no credit.

Need more details?

For the full criteria, scoring details or questions about a specific exchange's assessment, please reach out to CORE3 team directly.