How to evaluate whether a crypto exchange is safe
A due-diligence framework: proof of reserves, licensing, insurance funds, hack history, withdrawal reliability and the red flags that preceded FTX, Mt. Gox and DMM Bitcoin.
Choosing an exchange is a security decision before it is a fee decision. This is the framework behind the notes on our exchange ranking. Use it on any platform, including ones we do not cover.
1. Custody transparency
- Proof of reserves (PoR). Does the exchange publish wallet addresses and a Merkle-tree proof you can verify your own balance against? Is it attested by a third party? How often? Monthly with an open-source verifier (Binance, OKX, Kraken, Bitget, Gate) beats a one-off blog post.
- Reserve ratio. Look for at least 100% for every major asset. Ratios far above 100% in stablecoins and far below in altcoins suggest lending or rehypothecation.
- Cold storage policy. Most funds should be in cold, multisig storage. Ask how hot-wallet exposure is capped.
2. Regulation and legal structure
- Where is the entity that holds your funds registered? A Seychelles entity gives you little recourse; a US trust company, EU MiCA licence, Singapore MPI or Japan FSA registration gives regulators teeth.
- Segregation of customer assets. MiCA, Japan and NY BitLicense rules require it. FTX did not have it.
- Public company or audited financials? Coinbase files with the SEC; almost no one else does.
3. Security track record
- Hack history. Every major exchange has faced attacks. What matters is impact and response. Compare Binance 2019 (users reimbursed within days) with Mt. Gox (creditors waited ten years). Our incident timeline covers the biggest cases.
- Insurance or protection fund. Binance’s SAFU, Bitget’s Protection Fund and Bybit’s insurance fund are self-funded pools published on-chain. Check size relative to assets under custody.
- Bug bounty and audits. A public program on HackerOne or Immunefi signals a mature security team.
- Account security features. Passkeys or hardware 2FA, anti-phishing code, withdrawal whitelist, API IP restriction. If an exchange only offers SMS 2FA, walk away. See exchange account security.
4. Operational reliability
- Withdrawal speed and history. Search “[exchange] withdrawals paused” for the last two years.
- Uptime during volatility. Outages during crashes are a liquidity and engineering signal.
- Banking partners. Loss of a fiat partner often precedes trouble.
5. Business model and people
- Revenue. Trading fees are healthy. Heavy reliance on its own token, high-yield “earn” products or proprietary trading is a warning.
- Leadership. Public, identifiable executives with a track record. Anonymous or frequently changing leadership is a red flag.
- Token dependence. If the exchange’s balance sheet is mostly its own token (FTT at FTX), a price fall becomes a solvency crisis.
Red flags that preceded past collapses
| Signal | Seen at |
|---|---|
| Withdrawal delays blamed on “banking issues” | FTX, QuadrigaCX, Mt. Gox |
| Yield far above market (8%+ on stablecoins) | Celsius, Voyager |
| Balance sheet dominated by own token | FTX |
| Founder controls everything, no board | FTX, QuadrigaCX |
| Refuses or delays proof of reserves | FTX, Crypto.com briefly in 2022 (later published) |
| Regulator warnings or enforcement | Binance 2023, KuCoin 2025, Huobi 2023 |
Practical rules
- Prefer exchanges that tick every box in sections 1 and 2.
- Diversify across two exchanges if you trade actively.
- Keep only trading capital on any exchange; store the rest in a hardware wallet.
- Re-check quarterly: PoR still published? Any regulatory news? Withdrawals normal?
Our exchange ranking applies this framework to the largest platforms and shows the CoinGecko trust score alongside.
Questions
Does proof of reserves prove an exchange is solvent?
No. It proves the exchange controls at least the assets shown at a point in time. It does not show liabilities, borrowed coins or off-chain obligations. It is a necessary, not sufficient, signal. FTX had no proof of reserves; exchanges that publish it with third-party attestation and a public Merkle verifier are more transparent than those that do not.
Is a licensed exchange automatically safe?
Licensing means a regulator can inspect, fine and shut down the exchange and usually requires segregated customer assets and capital minimums. It reduces fraud risk but not hack risk. DMM Bitcoin was fully licensed in Japan and still lost $305M to a hot-wallet breach.
What is the single biggest red flag?
Withdrawal problems. Delays, new limits, 'maintenance' on specific assets or excuses about banking partners have preceded almost every collapse. If withdrawals slow down, leave first and ask questions later.