AWS Unveils Cloud-Based Blueprint for Centralized Crypto Exchanges, Boosting Speed and Custody Security

Amazon Web Services has unveiled a system blueprint for building centralized cryptocurrency exchanges, or CEXs, on its cloud platform. The focus is on handling rising trading volumes while strengthening order-processing speed, system stability and customer asset security.

According to industry officials on November 2, AWS presented the reference architecture for CEXs in an official blog post published on October 26. The design draws on architectural approaches the company has repeatedly used while supporting multiple crypto exchange buildout projects. AWS cited large-scale transaction processing, data retention and auditing, operational efficiency, and digital-asset custody security as the main challenges in running an exchange.

AWS divided the core trading system by function. General services such as user accounts and order management would run on Amazon EKS, its Kubernetes-based platform. The matching engine, which executes trades, would run on dedicated Amazon EC2 servers to minimize added latency during order processing.

AWS said balancing order-processing speed with outage response capabilities is especially important when building an exchange. For ultra-low-latency order systems, it proposed concentrating workloads in a single availability zone while maintaining replica servers. Key trading records would also be continuously stored in other availability zones, allowing the system to switch to backup infrastructure if a failure occurs.

For trade-data management, AWS proposed using Amazon Aurora, ElastiCache and Amazon MSK. User accounts, trade records and settlement details would be stored in databases. Order and transaction logs would be retained separately over the long term for audits and disaster recovery.

AWS proposed tighter security for the custody layer, where customer digital assets are stored. Exchanges can combine Nitro Enclaves, which isolate cryptographic operations from external systems, with AWS Key Management Service, or AWS KMS. For wallets using multi-party computation, or MPC, the architecture can also integrate with solutions such as Fireblocks.

AWS also stressed that exchange systems should not be built with the same configuration across all functions. Instead, infrastructure should be deployed based on the speed and stability requirements of each function. The company said the key decision is choosing a design that matches each exchange's goals for matching-engine speed and outage response.