Security
How accounts, withdrawals and API access are protected — and the handful of things we will never ask you for.
Account security
Your Telegram account is your login. Lovely Legends never sees your Telegram password or login code — only a signed confirmation from Telegram of who you are. Web sessions are short-lived and can be revoked.
Withdrawal review
Withdrawals pass a review step before they are broadcast, and are signed server-side from a wallet whose movements are visible on a public block explorer. The destination and network cost are shown before you confirm.
API key protection
API keys are bound to the IP addresses you nominate and the secret is shown once at creation. A key used from an address it is not pinned to is rejected, so a leaked secret is not by itself a usable credential.
System monitoring
The matching engine, settlement and deposit reconciliation are monitored, and credited deposits are reconciled against the chain before they land in a balance. You can run live reachability checks yourself on the status page.
Risk warning
Cryptocurrency trading involves risk. Prices may be volatile and trading digital assets can result in the loss of your entire balance. Nothing on this site is investment advice. Trade responsibly and only with funds you can afford to lose.
Anti-phishing notice
Every one of these is a rule with no exceptions. If something claiming to be Lovely Legends breaks one, it is not us.
- We will never ask for your seed phrase, private keys, or Telegram login code.
- We will never ask you to move funds to a “safe” or “verification” address.
- We will never DM you first asking for payment to unlock a withdrawal.
- Our only support address is support@lflabs.fund, our only support handle on Telegram is @john_lflabs, and our only bot is @LovelyLegends_bot.
- Check the domain before you sign in: the web exchange is llx.lflabs.fund and nothing else.