CoinGecko's Cybersecurity Trust Score Now Runs on CORE3

As of today, the cybersecurity category inside CoinGecko's Trust Score for centralised exchanges has evolved from running on CER.live to CORE3.

As a result of migration, Trust Scores for 162 exchanges listed on CoinGecko changed by ±2%. Instead, the methodology for the cybersecurity component was significantly enhanced.

Not the number you're used to. Cybersecurity component of CoinGecko's CEX trust score is based on CER.live's full CEX security score, an exchange-by-exchange risk index we've maintained for seven years. 

The CORE3 team rebuilt the checks underneath that score during the migration, and the result holds within ±2% of the old figure for almost every exchange. If you're checking your listing today, you shouldn't see a surprise.

Where CER.live spotted immediate gaps, CORE3 takes a forward-looking approach. Under the Probability of Loss methodology, the risk is assessed to determine how likely the exchange is to suffer an incident in the future and which surface will be the primary driver of it. 

Your cybersecurity score was never the whole picture, and now you can see the rest of it.

CORE3 scores every exchange across three categories: Security, Solvency, and Transparency. 

Those combine into Probability of Loss (PoL), a single forward-looking estimate of how likely an exchange is to suffer a loss event, whether that's a hack, an insolvency, or an operational failure.

One thing doesn't change: operational risk, key management, signer infrastructure, and the factors behind most losses in the digital asset market were already reflected in the cybersecurity Trust Score through CCSS, the cryptocurrency cybersecurity standard of level 1, 2, or 3, as well as an ISO 27001 certificate. 

For exchanges that present a near-excellent risk posture, nothing changes on a larger scale. They can still check their full risk breakdown in Solvency and Transparency to flag discrepancies and improve their Probability of Loss risk index on the CORE3 platform.

For those with lower Trust Scores, the methodology remains clear on the best ways to improve it (Trust Score influence descending):

• Submit Reserves Verification (Proof of Reserves)
• Present penetration test evidence
• Present active Bug Bounty evidence

You can do this via the Cooperation form from either the footer or the header on the CORE3 website.

During migration, we scored a set of 193 exchanges to analyze broader risk posture for digital asset exchanges. This resulted in following findings:

Across the 193 exchanges CORE3 analysed during migration, only 12.4% have verified reserves, 27.5% have presented a penetration test, and 51.3% run a live bug bounty. 48.7% show none of the three. If you're in that 48.7%, the fastest path to a better score is closing that gap, starting with reserves.

As data disclosure is an ongoing process, and CORE3 is actively working with a number of exchanges currently submitting reserve, pentest, or bug bounty documentation. The share of exchanges with no verified components is expected to decrease as these submissions are processed.

Submit Reserves Verification (Proof of Reserves), the single biggest lever, only 13.0% of exchanges have done this, and it's what unlocks CORE3's Solvency seal

1. Stand out through disclosure. Projects that publish and disclose risk controls can prove they are safer than the market otherwise assumes.
2. Security posture is a living record: showing continuous improvement in risk posture helps entities to maintain an ongoing health signal.
3. Transparency gives decision-makers the counterparty risk data they need before an engagement, which raises your odds of landing partnerships and deals.
4. It’s a competitive leverage for teams that build, rather than spend runway on marketing.

And of course, Probability of Loss is now part of the Trust Score, which millions of users compare exchanges against daily.

Show your risk, earn trust.