Keeping crypto on an exchange is convenient but carries real risks including exchange insolvency, hacks, frozen withdrawals, and regulatory seizures. The collapse of FTX in November 2022 erased roughly $8 billion in customer funds. Proof-of-reserves reports help but are not audits. This guide covers when exchange custody is acceptable, when it is not, and how to evaluate whether a specific exchange is trustworthy enough to hold your assets.
In This Article
- What Are the Actual Risks of Keeping Crypto on an Exchange?
- How Do You Evaluate Whether an Exchange Is Trustworthy?
- What Did the FTX Collapse Teach Us About Exchange Risk?
- When Does It Make Sense to Keep Crypto on an Exchange?
- What Is Proof of Reserves and Does It Actually Protect You?
- How Can You Reduce Risk If You Must Use an Exchange?
- Frequently Asked Questions
The crypto community’s mantra “not your keys, not your coins” exists for a reason. But self-custody also carries risk — losing a seed phrase is permanent. The right answer depends on your holdings, your technical confidence, and your time horizon. For a complete overview of protecting your crypto, see our wallet security best practices guide.
What Are the Actual Risks of Keeping Crypto on an Exchange?
The four primary risks are exchange insolvency, cybersecurity breaches, withdrawal freezes, and regulatory actions that lock accounts. Each has caused substantial losses for real users, and none of them give you any recovery path that is as reliable as holding your own private keys.
According to data compiled by Rekt News, centralized exchange hacks and collapses account for some of the largest single loss events in crypto history. Mt. Gox lost 850,000 BTC in 2014. FTX misappropriated customer deposits. QuadrigaCX’s founder allegedly died with the only keys to cold wallets holding $190 million in customer funds.
Regulatory risk is growing. When the SEC, CFTC, or international regulators take enforcement action against an exchange, they can freeze all customer assets during the investigation. This has happened to users of several exchanges operating without proper licenses.
How Do You Evaluate Whether an Exchange Is Trustworthy?
Check four things: regulatory status, proof-of-reserves history, insurance coverage, and the ratio of assets held in cold storage versus hot wallets. No single factor is sufficient. An exchange that passes all four is significantly safer than one that fails even one.
| Exchange | Regulated In | Proof of Reserves | Insurance Fund | Cold Storage Ratio |
|---|---|---|---|---|
| Coinbase | US (publicly traded, SEC reporting) | Quarterly financial reports | FDIC on USD (not crypto) | ~95% cold |
| Kraken | US, UK, EU | Semi-annual audits since 2022 | Self-insured reserve | ~95% cold |
| Binance | Multiple jurisdictions | Merkle tree proof of reserves | SAFU fund (~$1B) | Reported majority cold |
| Gemini | US (NYDFS regulated) | SOC 2 Type 2 audited | Captive insurance | ~95% cold |
Publicly traded exchanges like Coinbase have an additional layer of accountability because they file with the SEC. Their financial statements are audited by major accounting firms. This does not eliminate risk, but it makes fraud significantly harder to hide.
What Did the FTX Collapse Teach Us About Exchange Risk?
FTX proved that proof of reserves without an independent audit is meaningless, that venture capital endorsement is not due diligence, and that exchange terms of service do not protect customer assets in bankruptcy. The exchange reported healthy reserves while secretly lending customer deposits to its trading arm, Alameda Research.
According to the FTX bankruptcy filings managed by Kroll, customers were classified as unsecured creditors. This means they stand behind secured creditors in the repayment queue. Customers who held assets on FTX when it filed for bankruptcy received partial recoveries only after years of legal proceedings.
The lesson is concrete: exchange custody means you are a creditor of the exchange, not the owner of your crypto. The exchange’s terms of service spell this out, though most users never read them.
When Does It Make Sense to Keep Crypto on an Exchange?
Exchange custody is reasonable for active traders who need instant liquidity, for small amounts you can afford to lose, and for new users still learning self-custody. The convenience of exchange custody has genuine value. The question is whether that convenience justifies the risk for the amount you hold.
A practical threshold: keep only what you plan to trade within the next 30 days on an exchange. Move the rest to a hardware wallet. If the thought of losing everything on the exchange would meaningfully hurt your finances, it is too much to leave there.
For users who find self-custody intimidating, the risk of losing a seed phrase may be higher than the risk of a regulated US exchange failing. Read about recovering crypto from mistakes to understand what self-custody errors look like in practice.
What Is Proof of Reserves and Does It Actually Protect You?
Proof of reserves is a cryptographic verification showing that an exchange holds at least as many assets as its customer liabilities, but it is not a full audit and does not reveal undisclosed debts or lending activities. It proves assets exist at a single point in time. It does not prove the exchange is solvent.
The Merkle tree method used by Binance and others lets you verify that your specific account balance is included in the total. According to Binance’s proof-of-reserves page, their system is updated regularly. However, FTX could have passed a point-in-time proof of reserves at various points before its collapse because the issue was not missing assets but undisclosed liabilities.
My opinion: proof of reserves is better than nothing, but it has become more of a marketing tool than a genuine safety measure. A full SOC 2 Type 2 audit, like what Gemini undergoes, is substantially more meaningful because it examines internal controls over time, not just a balance snapshot.
Learn how we evaluate claims like these in our research methodology page.
How Can You Reduce Risk If You Must Use an Exchange?
Enable all available security features, use withdrawal address whitelisting, keep only trading amounts on-platform, and spread large holdings across multiple regulated exchanges. Diversifying exchange exposure limits the damage from any single failure.
Enable two-factor authentication using an authenticator app, not SMS. Set up withdrawal address whitelisting so funds can only be sent to pre-approved wallets. Enable login notifications. Use a unique, strong password managed by a dedicated password manager.
Frequently Asked Questions
- Is my crypto insured if an exchange gets hacked?
- Generally, no. FDIC insurance at US exchanges covers USD deposits, not cryptocurrency holdings. Some exchanges maintain insurance funds (Binance SAFU, for example) but these are voluntary and may not cover all losses.
- Can the government seize my crypto on an exchange?
- Yes. Law enforcement can serve exchanges with seizure orders, and exchanges must comply. Assets held in self-custody wallets cannot be seized without the private key, though courts can order you to surrender it.
- Should I move everything to a hardware wallet?
- Only if you are confident in managing your own seed phrase backup. Losing your seed phrase means permanent loss of funds. For most users, a combination of exchange custody for trading and hardware wallet for savings is the pragmatic approach.
Sources
- FTX Bankruptcy Proceedings — Kroll Restructuring — accessed when I last checked
- Rekt News — Exchange Exploit History — accessed when I last checked
- Binance Proof of Reserves — accessed when I last checked
- Coinbase Insurance Disclosure — accessed when I last checked
This article is for informational purposes only and does not constitute financial advice. Cryptocurrency investments carry significant risk. Consult a qualified financial advisor before making investment decisions.
