When it comes to the custody and security of your funds on an exchange it is largely immaterial whether the exchange is centralized or fully decentralized and has more to do with whether it is custodial or non-custodial. For example, Shapeshift is not decentralized but it is non-custodial. Custodial means your funds are kept with the exchange and they have access to your private keys, with non-custodial you are in control of your private keys.
The early decentralized exchanges (DEXs) were fully on-chain, using smart contracts to hold order books or token reserves for trading. Given this, they are very constrained by the latency and scalability of the underlying blockchain - to the point of being almost redundant for traders who need instant finality of execution. Early DEXs also lack many of the basic features of centralized exchanges such as stop loss on trades and charting tools.
On-chain exchanges sync every trade to the blockchain which ensures safety and integrity but latency and scalability suffers because of it. Source: Leverj
Like dapps on all blockchains, for decentralized exchanges to reach mainstream adoption scalability needs to be resolved and UX/UI needs to catch up to that of their centralized competitors. There are three main components to scalability: network scalability (transaction throughput), storage scalability (the amount of disc space it takes for a node to store the blockchain ledger), and compute scalability (the power of computers running the nodes). However, without resolving the network bottleneck first, even with sufficient storage and computing power, the blockchain will struggle to scale as it's limited by bandwidth.
Scaling revisited: Plasma
There are two ways to scale a network - option one is on the first layer by amending some core protocol of the blockchain. Option two is by a 'second layer' solution, which involves building solutions that sit atop the blockchain.
Layer 1 solutions include sharding the ledger into smaller pieces so every node doesn't have to run the full record only the part relevant for its transactions; introducing ZK STARKS (faster and more scalable than ZK SNARKS) to the protocol to bunch transactions and verify them with one proof; or decoupling the tasks of transaction processing from achieving consensus so nodes don't have to do both. Directed Acyclical Graphs (DAGs) also avoid the scaling constraints of classic blockchains as network actors can both send and receive transactions simultaneously and nodes can be dual-functioning as consensus validators and validators of transactions.
Scaling on the second layer includes sidechains (Raiden and Plasma for Ethereum and Lightning Network for Bitcoin), state and payment channels. While Raiden is Ethereum's version of the Lightning Network, Plasma is a novel solution that reduces the amount of interaction apps have with the main chain for storing data and transactions.
Plasma exchanges use smart contracts to enforce integrity without syncing trades to the main chain, combining centralized performance and decentralized safety. Source Leverj
OmiseGo is one major cryptocurrency built on Plasma and it describes its OMG network as "infinitely scalable".
Gluon Plasma
Gluon Plasma is another flavour of the classic Plasma sidechain designed specifically for exchanges and concerned mainly with creating non-custodial, low latency, low fee exchanges. Leverj is the first hybrid DEX built on Gluon and though eventually the sidechain will host several DEXs which share liquidity and order data between them.
Leverj aims to serve both institutional and individual customers with up to 100x leverage on Eth and ERC20 tokens, derivatives and advanced charting tools found on the traditional exchanges.
The classic Plasma sidechain proposed by Vitalik Buterin and Joseph Poon uses an UTXO model (the unspent transaction outputs cache that cryptos like Bitcoin and Litecoin use) whereas Gluon has opted for an account model sidechain - used in the Ethereum mainchain - as it considers the UTXO model to scale poorly for exchanges.
Just like blockchain's 'trilemma' of scalability, security and decentralization, Gluon posits there are four prongs to creating trustless finance which are rarely aligned:
1. Segregation: Coins are created or sent directly into the owner's custody.
2. Agency: Coin ownership can only change with the provable intention of the owner.
3. Solvency: Only legitimately created and previously unspent coins can be spent.
4. Integrity: Coin movement should comply with all network consensus rules.
Further, centralized exchanges have no security properties because none of the four criteria are met. Decentralized exchanges on the other hand can achieve all four of these if done correctly, to create true trustless finance.
Gluon is only concerned with custody and its proof of safety "rests on the proof that the exchange can enforce Segregation, Agency, Solvency and Integrity in all of its operations."
Why is a non-custodial exchange important?
Apart from the attack vectors that coins themselves are susceptible to, such as Ethereum Classic's recent 51% attack which took money not from exchanges per se but double spent coins arbitrarily, traders and investors are potentially doubling up on risk by trading on certain centralized exchanges that also have many attack vectors, exemplified by Cryptopia.
Gluon Plasma uses fraud-proofs as a means of ensuring a transaction or chain of transactions is valid and securing exchanges but using these proofs in a centralized exchange is infeasible because there are no constraints among sending and depositing addresses. This also means that there is no way for an exchange to prove that it isn't operating on fractional reserve and investing deposited money elsewhere.
Custodial characteristics of payment networks. Source: Leverj.io
The security that centralized exchanges implement with 2FA and phone or email authentication provides a variety of potential attacks. Intertwined identity and agency using crypto addresses and signatures are stronger than any mobile 2FA side channel association and authentication. Using fraud proofs, in Gluon only one validator in the entire network needs to be honest and present to prevent a compromised operator from stealing funds.
Conclusion
While centralized exchanges have done a good job onboarding the first generation of crypto investors there is no end in sight to the hacking of funds in their custody. The future is going to be decentralized and non-custodial exchanges and as blockchains currently only execute ten transactions per second and on-ramp costs range from 2% to 4%, sidechains are going to be utilized in the medium term.
When choosing an exchange, traders/investors have had to sacrifice at least one of three elements - functionality, decentralization or security - to find the right fit for them. But utilizing Plasma, the most advanced of Ethereum's scaling solutions, may be approaching the right hybrid model bridging all three.