Private key use cases in ethereum blockchain while transferring the amount between two crypto exchanges

Question

I was studying about the application of public & private key in cryptography. I've worked on MetaMask (Ropsten test network) and I know that how to transfer the amount from one account to another using the account address. But one thing which I noticed here is that while using the web3 function for transferring the ether, we only require the public key of both sender and receiver.

web3.eth.sendTransaction({to: 'key1', from: 'key2', value:web3.toWei("0.0001", "ether")},

I know that despite having the public keys, we still need to confirm the transaction from the metamask end for account1 (from address) and after confirming, the transaction will process successfully. The confirmation process happens because of the signature process, while we're confirming the transaction using metamask (digital sign the transaction from the private key) does my assumption about the digital signature is correct?

As per the above case, I've noticed the similar issue when we transfer the amounts between the two exchanges using the address given by them. Suppose I've two accounts on different crypto exchanges i.e Binance & CoinDelta. If I've 50 Ether in my Binance account and I want to send those ethers to my another exchange account then I'll use the address of another exchange account (CoinDelta wallet address). So this way we can transfer the ethers from one exchange to another. But my concerns about this case are following -

• Why don't we need any confirmation like we're seeing in the metamask for transferring the amount?

• Where the user private key stored in the crypto exchange?

• If crypto exchanges storing the private key of the user then there is no security because the owner can perform the malicious activity behalf of the user account?

• How transaction (amount transfer between exchanges) actually works between exchanges without having the private keys?

Answer 1

Answering each of your key points:

• Your assumption about the digital signature is indeed correct. The private key is used to digitally sign the transaction meta-data (The from, to etc. fields) before being broadcast to the blockchain network.
• We do not need any confirmation because we have already given confirmation to all actions that will be done on the account by logging in with the correct username/e-mail and password.
• The private keys are stored in (presumably) encrypted form and decrypted either through the TLS network connection or client-side to prevent any malicious attackers from accessing your private key if the server is compromised.
• You are supposed to entrust the exchanges you trade in with your private keys. That is how they are able to retrieve your funds if you forget your password etc. While it is possible to create an asymmetric encryption scheme where your private key is decrypted during each session locally, no known exchange employs such a method.
• Each account on every blockchain network corresponds to a private key. As such, all exchanges in one form or another do indeed use a private key when commencing transactions.