Cryptocurrency trading involves risk. Prices may be volatile. Trade responsibly. Read our security notes
Trust and transparency

Trust & Transparency

Lovely Legends is building exchange-level transparency step by step. As the platform grows, we plan to introduce stronger reserve visibility, clearer wallet reporting, improved risk controls, and more public transparency for users.

Your assets are held custodially

Lovely Legends is a custodial exchange. LF Labs controls the keys to the wallets that hold user funds, and your balance is a claim against LF Labs rather than coins you hold yourself. That is true of every custodial exchange, and it is the reason the rest of this page exists.

What custodial means for you
LF Labs is not a bank. Balances are not deposits, are not insured, and are not covered by any deposit guarantee or investor compensation scheme. If you want custody of your assets, withdraw them to a wallet whose keys you control — that option is always open and is the honest answer to “how safe is my money here”.

What protects your balance today

Each of these is a mechanism that runs on this deployment now, not a principle we intend to adopt.

Withdrawals are reviewed before they are signed

Every withdrawal passes a review step before it is broadcast to a network. It is the step that catches a compromised account before the funds leave, which is why it exists even though it costs time.

Per-account deposit addresses

Your account has its own deposit addresses — one derived EVM address covering Ethereum, Polygon and Base, and a separate Solana address. Deposits are attributed by address, not by a memo you have to remember to include.

Deposits are reconciled against the chain

A credit is not created from a notification alone. Deposits are checked against the chain before they land in a balance, and a reconciliation job runs against the ledger independently of the path that credited them.

API keys are bound to IP addresses

A key only works from addresses you nominate, and the secret is shown once at creation. A leaked secret is not by itself a usable credential.

Short-lived, revocable sessions

Web sessions expire and can be revoked. Signing in through Telegram never exposes your Telegram password or login code to us — we receive only a signed confirmation of who you are.

Live reachability you can check yourself

The status page runs real checks against the API, the market feed and the exchange core from your own browser, rather than showing a badge we set by hand.

How the withdrawal review works

  1. You submit

    You choose the coin, the network and the destination address. The platform fee and the amount that will actually arrive are shown before you confirm, so there is no arithmetic to do afterwards.

  2. The balance is deducted immediately

    The amount leaves your available balance at the moment you request the withdrawal, not when it is broadcast. A pending withdrawal cannot be spent twice.

  3. Review

    The request is reviewed before it is signed. This is where an account takeover is caught, and it is why withdrawals may take up to 48 hours rather than leaving instantly.

  4. Signed and broadcast

    The transaction is signed server-side and broadcast. From that point it is on a public chain, its hash is in your history, and neither you nor we can reverse it.

Transparency roadmap

These are not live. Each is labelled, and the labels are the point — a roadmap read as a feature list is worse than no roadmap at all.

Published on-chain reconciliation

Roadmap

Deposits are already reconciled against the chain internally. The roadmap item is publishing that reconciliation — a regular, checkable statement that what the ledger says arrived is what the chain says arrived.

Public reserve visibility

Roadmap

Publishing the addresses holding platform assets, so anyone can read the balances on a block explorer without taking our word for a number. Wallet reporting has to be right before it is public, which is why this follows reconciliation.

Proof of Reserves

Roadmap

Proof of Reserves is part of our transparency roadmap. Lovely Legends plans to introduce stronger reserve visibility and user-friendly verification methods as the platform grows.

Two-factor authentication

Coming soon

2FA does not exist on Lovely Legends today. Account security currently rests on your Telegram account, and on the email address and password you can add in settings.

Proof of Reserves is not live
Lovely Legends does not operate Proof of Reserves today and does not publish reserve attestations. It is a planned step, described above as a plan. If you see Proof of Reserves attributed to Lovely Legends anywhere, it did not come from us.

Security architecture

Two doors, one guard

Signing in with Telegram and signing in with an email and password reach the same account through the same authentication check. There is no second, weaker path around it — including for the routes that place orders and move funds.

Server-side signing, public settlement

Withdrawals are signed server-side from wallets whose movements are visible on a public block explorer. What leaves the platform is observable by anyone, whether or not we publish it.

Separate credentials for separate powers

The secret that signs web sessions is deliberately not the one that protects administrative access or API key material, so revoking one does not force revoking the other — and a compromise of one is not a compromise of everything.

Monitoring on the money path

The matching engine, settlement and deposit reconciliation are monitored. The status page runs the same reachability checks from your browser that we watch ourselves.

What we commit to

  • We publish no licence, audit, insurance or partnership badge anywhere on this site. If you are shown one attributed to Lovely Legends, it did not come from us.
  • We state that balances are custodial in plain words, on this page and on the security page, rather than letting the word “secure” imply self-custody.
  • Features that are not built carry a visible “Coming soon”, “Planned” or “Roadmap” label wherever they are described — including on this page.
  • We publish no user count, no trading volume and no reserve figure, because none of them has a source a reader could check.
  • Fee rates published on this site are checked against the live schedule, and the in-app figure is authoritative for your account and pair.
  • When something breaks, the status page reports what is actually reachable rather than a colour we chose.

Support safety reminder

Nobody from Lovely Legends will ever ask you for these
Not your seed phrase, not your private keys, not your password, not your Telegram login code. We will never ask you to move funds to a “safe” or “verification” address, and we will never message you first asking for a payment to release a withdrawal.
  • Our only support email is support@lflabs.fund and our only support handle on Telegram is @john_lflabs.
  • Our only bot is @LovelyLegends_bot. Telegram makes lookalike handles trivial to create — read the handle, not the profile picture.
  • The web exchange is llx.lflabs.fund and nowhere else. Check the domain before you sign in.
  • If someone claiming to be support breaks any rule on this page, it is not us. Report it to support@lflabs.fund.

Before you deposit

Transparency about how the platform works does not remove the risk of trading on it. Cryptocurrency trading can result in the loss of your entire balance, custodial balances carry counterparty risk, and no reward programme here is guaranteed.

Read the risks in full

The risk disclosure states plainly what can go wrong, including the parts that would be our fault.

Risk disclosureSecuritySystem status