Free resource · 12 checks
The crypto exchange safety checklist
Film · 22 seconds
The five checks that matter most
Proof of reserves, cold storage, a real licence, real two-factor and no open enforcement: checks 01, 03, 05, 07 and 06 below, with the red flag for each. The full list of twelve follows.
- 01
Proof-of-reserves published
The exchange publishes recent, cryptographically-verifiable proof-of-reserves (ideally with a Merkle tree you can check your own balance against), not just a marketing claim.
Red flag: No PoR, or a one-off PDF that's over a year old.
- 02
Audited or public financials
Reserves are matched by liabilities — a reserves-only snapshot hides whether customer funds are actually 1:1 backed. Public-company filings or a reputable liability audit are stronger.
Red flag: “Proof of reserves” with no liabilities shown at all.
- 03
Cold storage majority
The bulk of customer assets sit in offline cold storage; only hot-wallet float is online. Look for a stated cold/hot split.
Red flag: No mention of cold storage, or funds pooled in one hot wallet.
- 04
Clean or fully-reimbursed incident history
Every big exchange gets probed. What matters: was any past loss of customer funds fully reimbursed? An exchange that made users whole beats one that didn't.
Red flag: An unresolved hack where users were never repaid.
- 05
Tier-1 licensing where you live
Registration or licensing with a serious regulator (US state MTLs/MSB, EU MiCA, UK FCA, MAS, etc.) covering your jurisdiction — not just an offshore shell.
Red flag: Only an offshore registration, or a guilty plea for operating unlicensed.
- 06
No active enforcement action
No open enforcement or ongoing case alleging fraud or commingling of funds. Past, resolved matters are normal; active ones are a flag.
Red flag: Active regulator lawsuit alleging misuse of customer assets.
- 07
Real 2FA & withdrawal controls
App-based 2FA (not just SMS), address allow-listing, and a withdrawal lock window after security changes.
Red flag: SMS-only 2FA and instant withdrawals after a password change.
- 08
Transparent, published fees
A clear public fee schedule for spot, withdrawals and fiat on-ramp. Hidden spreads are a cost you can't compare.
Red flag: No public fee page; fees only shown at the moment of trade.
- 09
Available in your country — legitimately
The exchange actually serves your jurisdiction. Using a VPN to bypass a geo-block can freeze your funds under their own terms.
Red flag: You'd need a VPN or false KYC to sign up.
- 10
Insurance / SAFU-style fund
A dedicated fund earmarked to cover users in a breach is a genuine buffer — but read what it actually covers.
Red flag: Vague “insurance” claims with no fund size or terms.
- 11
You're not storing long-term on the exchange
An exchange is for trading, not for a long-term stash. For anything you're not actively trading, a hardware wallet you control removes counterparty risk entirely.
Red flag: Your life savings sitting on any exchange, indefinitely.
- 12
It survives your own gut-check
Suspiciously high “guaranteed” yields, aggressive referral pressure, or an anonymous team are all reasons to walk away — no fee saving is worth losing the principal.
Red flag: “Guaranteed” returns or an unfindable team.
Be first to know when our monthly fee update launches
You already have the checklist above. Leave your email only if you want to hear when our monthly fee update launches. We'll only email you about that; unsubscribe anytime.
We store only your email to tell you when our monthly fee update launches. See our privacy policy.
Beyond the exchange
Your own setup is the other half
Most losses we read about aren't exchange failures. They're phishing pages, SIM swaps and malware on the owner's own phone or laptop. Our guide covers the personal side: hardware wallets, 2FA that can't be SIM-swapped, public Wi-Fi, and what a VPN does and doesn't protect.
See the checklist applied
We run every exchange through these checks and score them publicly.
FAQ
Is a crypto exchange ever 100% safe?
No. Any exchange carries counterparty risk — you're trusting them to custody your assets. This checklist reduces the risk; it doesn't eliminate it. For long-term holdings, self-custody with a hardware wallet is the only way to remove counterparty risk. Not financial advice.
What's the single most important check?
Whether past losses of customer funds were fully reimbursed, combined with proof-of-reserves. Together they tell you both the track record and the current backing. We weight security and regulation highest in our own scoring for exactly this reason.
How do you use this checklist in your reviews?
These checks map directly to our Security and Regulation pillars, which together are 50% of every exchange's score. See our public methodology for the exact weights.