CEX vs on-chain mental model
Centralized options venues (Deribit, Bybit, OKX, Binance, Thalex, Coincall, and others) usually mean account creation, KYC where required, and API keys for automation. Custody sits with the exchange subject to its risk, controls, and terms. On-chain or wallet-first venues such as Derive and Paradex mean wallet identity, signatures, smart-contract or appchain risk, and personal key custody.
Both models still have geo and eligibility restrictions. Wallet-first does not mean unrestricted global access. You remain responsible for private keys, network fees, bridge risk where applicable, and reading what you sign. Liquidation and margin still apply; code and infrastructure risk add another layer that CEX terms of service abstract away.
OptionsMatch sits in the middle as research: compare venues, read enrichment and editorial notes, and inspect multi-venue chains under /t without depositing. Execution always happens on the venue you choose, via official channels only.
Risk surface unique to wallet-first desks
Signature phishing and malicious allowances replace some classic CEX password attacks. A single reckless approval can grant a spender rights over tokens you intended only as margin. Bridge and sequencing risk can appear when funding paths cross networks. UI complexity around portfolio margin, options legs, and USDC settlement rewards careful reading over speed.
Appchain or L2 operational events, sequencer downtime, and explorer confusion can all create false urgency that attackers exploit. Build procedures before stress: bookmarks, test withdraws, and clear hot vs cold address roles.
Never enter a seed into a venue website. Session login should not require seed export. If a flow asks for a recovery phrase, it is not a real onboarding path.
Recommended onboarding path
Confirm geo and product eligibility on the official venue site. Read the venue profile on OptionsMatch (/venue/derive, /venue/paradex) for fit scores, product notes, and enrichment context. Compare chain depth on /t/{asset}/book or related desks with multi-venue filters before you decide size.
Create or assign a dedicated hot wallet with limited funds. Prefer hardware backing for the funding path into that hot wallet. Connect only via a bookmarked official URL. Deposit a test amount, place a tiny order if appropriate, and withdraw the test before you size margin for real risk.
Only after that loop works should you scale collateral. Keep OptionsMatch open for cross-venue IV and mark checks; keep the venue UI for execution. Research-first reduces FOMO deposits into thin books.
Signature checklist
Login and session signatures should not move funds. Deposit and withdraw prompts should show asset, amount, network, and destination you control. Trade or operator approvals should map to the venue and contracts you expect.
Reject unlimited allowances you do not understand. Prefer limited allowances when available. For large moves, require hardware confirmation and a second visual check of the device screen against the browser summary.
If fields disagree — wrong chain, unexpected spender, scientific-notation amounts — reject and stop. Re-open the official site from your bookmark rather than refreshing a tab that arrived from a message.
Margin, liquidity, and multi-venue research
On-chain books can be thinner than flagship CEX options markets on many wings and tenors. Use OptionsMatch multi-venue views to see where size actually trades before you commit collateral that is hard to free quickly. Compare marks and IVs across Deribit, Derive, Paradex, and others where feeds are healthy.
Understand settlement asset (often USDC-style linear on newer venues) and how portfolio or isolated margin is explained in official docs. Liquidation rules still exist; wallet custody does not remove market risk.
After sessions, review allowances and open positions. Withdraw excess collateral you do not need for near-term options risk back to cold or hardware-backed storage.
Incident response and ongoing hygiene
If a signature feels wrong, follow the right-away security guide immediately: stop signing, revoke, move funds, burn exposed seeds. Report phishing domains to venue security contacts when available.
Schedule periodic allowance reviews and firmware updates for hardware devices. Keep a written personal runbook: official URLs, which address is hot, which is treasury, and where backups live offline.
OptionsMatch education under /education/wallets and the venue onboarding guides for Paradex and Derive are designed to stay security-first. Re-read them when you add a new chain, a new teammate, or a new funding path.