出典確認済みリサーチ: Binance / Kraken / Coinbase

Verified source facts

1. Binance says required confirmations vary by cryptocurrency and warns that unsupported assets, networks, addresses or memos can prevent crediting. 2. Kraken distinguishes confirming, credited and successful deposit states, including a state where trading is available before withdrawal. 3. Kraken publishes asset-specific confirmation and approximate processing-time information but says network execution time can vary. 4. Coinbase tells users to use the transaction hash and correct network explorer, then distinguish on-chain confirmation from account crediting.

Comparison at a glance

1. Control test: Asset identity

An API-security disclosure is meaningful only when converted into a testable control. For asset identity, inspect the exact coin or token received. Create a key in a non-production or least-privileged context where available, then match ticker, contract and supported asset. Capture the permission screen without recording the secret, and verify that a forbidden operation is actually rejected.

Model the failure path, not just the setup path. Ask how a leaked credential could be used, what network restriction would stop it, which log would reveal the attempt, and how quickly the key could be revoked. Platform documentation describes supported settings; it cannot prove that a user or vendor configured them correctly. In this dimension, support for an unlisted representation is therefore an explicit audit gap.

Score disclosures separately from security outcomes. Clear documentation, restrictive defaults, IP binding, asymmetric signing, expiration, and audit visibility are positive signals. They do not certify the exchange, the third-party bot, or the operator's endpoint. The useful output is a remediation list tied to permissions and owners.

2. Control test: Network identity

For network identity, inspect the chain selected at both ends. Create a key in a non-production or least-privileged context where available, then compare network names and contract addresses.

In this dimension, recovery after a mismatch is therefore an explicit audit gap.

3. Control test: Memo or tag

For memo or tag, inspect secondary destination identifiers. Create a key in a non-production or least-privileged context where available, then copy and verify every required memo.

In this dimension, manual recovery eligibility is therefore an explicit audit gap.

4. Control test: Transaction hash

For transaction hash, inspect the on-chain receipt and explorer record. Create a key in a non-production or least-privileged context where available, then save the hash before contacting support.

In this dimension, off-chain internal transfers is therefore an explicit audit gap.

5. Control test: Confirmation threshold

For confirmation threshold, inspect the venue's current required state. Create a key in a non-production or least-privileged context where available, then read the live asset-specific requirement.

In this dimension, future threshold changes is therefore an explicit audit gap.

6. Control test: Credited state

For credited state, inspect whether the balance can be traded. Create a key in a non-production or least-privileged context where available, then separate displayed balance from final availability.

In this dimension, temporary account holds is therefore an explicit audit gap.

7. Control test: Withdrawal availability

For withdrawal availability, inspect whether deposited funds can leave. Create a key in a non-production or least-privileged context where available, then wait for the platform's completed state.

In this dimension, risk-control delays is therefore an explicit audit gap.

8. Control test: Maintenance

For maintenance, inspect wallet or node service interruptions. Create a key in a non-production or least-privileged context where available, then check the official status surface.

In this dimension, unannounced incident duration is therefore an explicit audit gap.

9. Control test: Support evidence

For support evidence, inspect asset, network, amount, hash and redacted history. Create a key in a non-production or least-privileged context where available, then prepare a minimal evidence packet.

In this dimension, discretionary recovery outcome is therefore an explicit audit gap.

10. Control test: Disclosure quality

For disclosure quality, inspect freshness, specificity and exception handling. Create a key in a non-production or least-privileged context where available, then date the comparison and preserve unknowns.

In this dimension, account-specific implementation is therefore an explicit audit gap.

Decision scenarios

Scenario 1: when asset identity becomes decisive

Consider a reader whose main constraint is the exact coin or token received. The correct response is not to infer a universal platform or product winner. It is to match ticker, contract and supported asset, retain the evidence, and define a stop condition before funds or permissions are committed. If the evidence changes, the decision must be reopened. This produces a repeatable operating rule rather than a one-time opinion.

Scenario 2: when network identity becomes decisive

Consider a reader whose main constraint is the chain selected at both ends. It is to compare network names and contract addresses, retain the evidence, and define a stop condition before funds or permissions are committed.

Scenario 3: when memo or tag becomes decisive

Consider a reader whose main constraint is secondary destination identifiers. It is to copy and verify every required memo, retain the evidence, and define a stop condition before funds or permissions are committed.

Scenario 4: when transaction hash becomes decisive

Consider a reader whose main constraint is the on-chain receipt and explorer record. It is to save the hash before contacting support, retain the evidence, and define a stop condition before funds or permissions are committed.

Scenario 5: when confirmation threshold becomes decisive

Consider a reader whose main constraint is the venue's current required state. It is to read the live asset-specific requirement, retain the evidence, and define a stop condition before funds or permissions are committed.

Scenario 6: when credited state becomes decisive

Consider a reader whose main constraint is whether the balance can be traded. It is to separate displayed balance from final availability, retain the evidence, and define a stop condition before funds or permissions are committed.