The exchange holds your assets for you: counterparty risk. Rated on proof of reserves, licences, years in operation, user protection fund and loss history. Sorted by tier, A first.
Profile of each exchange
Binance
Last reviewed 24/09/2026
A· Lower risk · meets 5/5 criteria
The world's largest exchange, licensed in Dubai (VARA) and Abu Dhabi (ADGM), with a SAFU fund of ~USD 1 billion. From 1/7/2026 it stopped Earn and new deposits for EU customers as it lacks MiCA authorisation; the US DOJ is investigating (per Bloomberg, no charges yet).
✓Publishes a monthly proof of reserves (Merkle) that users can verify themselves
✓Licensed by a major regulator: Dubai (VARA), Abu Dhabi (ADGM FSRA)
✓Operating since 2017 (9 years)
✓User protection fund: SAFU (~$1B)
✓Users were fully compensated for every known incident
iBloomberg reported that the US DOJ is investigating Binance over possible Iran sanctions violations; no charges yet.
iEU: no MiCA licence; stopped accepting new customers, deposits and Earn for EU customers (withdrawals remain open).
iAustralia: AUSTRAC required Binance Australia to appoint an independent anti-money laundering auditor.
iCoinDesk Data Exchange Benchmark (2026-05): grade AA, score 87.25, ranked 4. For reference only, not part of the risk tier.
Facts and sources
Operating since
2017
Proof of reserves
Monthly · latest 2026-09 · self-publishedMerkle + zk-SNARK, users can verify themselves; self-published by Binance with no third-party attestation. Ratios 9/2026: BTC 100.16%, USDT 102.91%.[binance.com]
Licences / registrations
Dubai (VARA) · Full VASP licence (Binance FZE) (licence)[vara.ae]
Abu Dhabi (ADGM FSRA) · Global exchange licence under the ADGM framework (licence)[adgm.com]
Japan (FSA) · Crypto-asset exchange registration (Binance Japan) (registration)[fintechnews.hk]
Australia (AUSTRAC) · DCE registration (Binance Australia) (registration)[binance.com]
User protection fund
SAFU · ~$1.0B (2026-02)Converted into 15,000 BTC, so its USD value moves with the BTC price; Binance pledges to top it up if it falls below USD 800 million.[coindesk.com]
Incidents
2025-10 · USDe/BNSOL/WBETH depegged on Binance during the 10/10 crash · ~$283M · users fully compensatedBinance paid USD 283 million in compensation to eligible users.[theblock.co]
2019-05 · Hot wallet hack, 7,000 BTC lost · ~$41M · users fully compensatedCovered by the SAFU fund.[financemagnates.com]
Regional notes
2026-09-22 · Bloomberg reported that the US DOJ is investigating Binance over possible Iran sanctions violations; no charges yet.[coindesk.com]
2026-07-01 · EU: no MiCA licence; stopped accepting new customers, deposits and Earn for EU customers (withdrawals remain open).[euronews.com]
Australia: AUSTRAC required Binance Australia to appoint an independent anti-money laundering auditor.[austrac.gov.au]
Regulatory history
2023-11 · DOJ / FinCEN / OFAC / CFTC (US): Pleaded guilty to anti-money-laundering and sanctions violations, paid ~USD 4.3 billion; CZ stepped down; subject to an independent monitor.[justice.gov]
2025-05 · SEC (US): The 2023 civil lawsuit was dismissed with prejudice.[cnbc.com]
Bitget
Last reviewed 24/09/2026
B· Medium risk · meets 4/5 criteria
Monthly proof of reserves (135% ratio), protection fund of ~USD 382 million held in BTC. Only an AUSTRAC registration, no major licence; no MiCA, so it does not accept new EU customers, and it is withdrawing from Japan.
✓Publishes a monthly proof of reserves (Merkle) that users can verify themselves
!Registration only (not a licence) in: Australia (AUSTRAC)
✓Operating since 2018 (8 years)
✓User protection fund: Bitget Protection Fund (~$382M)
✓Users were fully compensated for every known incident
iEU: no MiCA licence yet (application pending with Austria's FMA); not accepting new EU/EEA customers.
iJapan: stopped accepting new customers, closing positions only from 1/11, all positions closed on 31/12/2026 (withdrawals remain open).
iSingapore: no MAS licence; on the investor alert list.
iCoinDesk Data Exchange Benchmark (2026-05): grade BB, score 74.92, ranked 13. For reference only, not part of the risk tier.
Facts and sources
Operating since
2018
Proof of reserves
Monthly · latest 2026-09 · self-publishedMerkle, self-reported since 12/2022; no third party confirms the crypto reserves.[bitget.com]
Licences / registrations
Australia (AUSTRAC) · DCE registration (registration)[bitget.com]
User protection fund
Bitget Protection Fund · ~$382M (2026-08)Consists of 5,500 BTC, so its USD value moves with BTC; pledged to keep it above USD 300 million.[chainwire.org]
Incidents
2025-04 · Abnormal VOXELUSDT trading: trades cancelled, accounts frozen · users fully compensatedBitget compensated affected users; some traders objected to the cancelled trades.[theblock.co]
Regional notes
2026-07-01 · EU: no MiCA licence yet (application pending with Austria's FMA); not accepting new EU/EEA customers.[casptracker.eu]
2026-08-03 · Japan: stopped accepting new customers, closing positions only from 1/11, all positions closed on 31/12/2026 (withdrawals remain open).[coindesk.com]
Holds MiCA (Austria) and SCA (UAE) licences. Hacked for USD 1.46 billion in 2025 (the largest in history) but fully covered within ~72 hours, with no interruption to withdrawals. No dedicated user protection fund.
✓Publishes a monthly proof of reserves (Merkle) that users can verify themselves
✓Licensed by a major regulator: EU (Austria, FMA), UAE (SCA)
✓Operating since 2018 (8 years)
!No user protection fund disclosed
✓Users were fully compensated for every known incident
iSingapore: MAS put Bybit Fintech on its investor alert list (no licence).
iJapan: withdrawing services from Japan residents after an FSA warning.
iCoinDesk Data Exchange Benchmark (2026-05): grade A, score 80.79, ranked 10. For reference only, not part of the risk tier.
Facts and sources
Operating since
2018
Proof of reserves
Monthly · latest 2026-07 · HackenMerkle, 50 tokens. Reports for 8 and 9/2026 not found; needs rechecking.[bybit.com]
Licences / registrations
EU (Austria, FMA) · MiCA CASP (Bybit EU) (licence)[coindesk.com]
India (FIU-IND) · VDASP registration (registration)[prnewswire.com]
User protection fund
Not disclosed
Incidents
2025-02 · Lazarus Group hacked an ETH cold wallet, ~USD 1.46 billion lost · ~$1.5B · users fully compensatedLosses came from the exchange's reserves, not user accounts; fully covered within ~72 hours.[cnbc.com]
Regional notes
2026-06-17 · Singapore: MAS put Bybit Fintech on its investor alert list (no licence).[bloomberg.com]
2026 · Japan: withdrawing services from Japan residents after an FSA warning.[finance.yahoo.com]
Regulatory history
2025-01 · FIU-IND (India): Fined ~USD 1 million for operating unregistered; registered in 2/2025.[prnewswire.com]
KuCoin
Last reviewed 24/09/2026
B· Medium risk · meets 4/5 criteria
Monthly proof of reserves (verified by Hacken), fully covered the 2020 hack. Its MiCA (Austria) and Thailand licences are both under an operating ban / suspension, so in practice only the AUSTRAC registration remains; Dubai issued a cease order (3/2026). Pleaded guilty in the US in 2025.
✓Publishes a monthly proof of reserves (Merkle) that users can verify themselves
!Registration only (not a licence) in: Australia (AUSTRAC)
✓Operating since 2017 (9 years)
✓User protection fund: KuCoin Insurance Fund (size not disclosed)
✓Users were fully compensated for every known incident
iDubai: VARA ordered KuCoin entities to cease unlicensed operations.
iEU: the KuCoin EU entity halted trading and deposits; Austria's FMA still prohibits it from commencing operations.
iCanada: FINTRAC fined it CAD 19.55 million over anti-money-laundering failures; KuCoin is appealing.
iCoinDesk Data Exchange Benchmark (2026-05): grade BB, score 73.95, ranked 15. For reference only, not part of the risk tier.
EU (Austria, FMA) · MiCA CASP (KuCoin EU Exchange GmbH) (licence, currently suspended / operations prohibited, not counted)FMA still prohibits commencing operations (decision of 18/2/2026); trading and deposits have been halted since 4/2/2026.[fma.gv.at]
Thailand (SEC) · Digital asset exchange licence (KuCoin Thailand / ERX) (licence, currently suspended / operations prohibited, not counted)Suspended in 1/2026 due to insufficient capital; local entity.[nationthailand.com]
Australia (AUSTRAC) · DCE registration (registration)[coindesk.com]
User protection fund
KuCoin Insurance FundKuCoin does not disclose the fund's size; the fund paid out ~USD 45.55 million (16%) for the 2020 hack. The "USD 2 billion Trust Project" is a multi-year spending plan, not a separate fund.[kucoin.com]
Incidents
2020-09 · Hot wallet hack (suspected Lazarus), ~USD 281 million · ~$281M · users fully compensated~84% recovered through partners and token contract upgrades; the insurance fund covered the rest.[coindesk.com]
Regional notes
2026-03-05 · Dubai: VARA ordered KuCoin entities to cease unlicensed operations.[coindesk.com]
2026-02 · EU: the KuCoin EU entity halted trading and deposits; Austria's FMA still prohibits it from commencing operations.[fma.gv.at]
2025-09 · Canada: FINTRAC fined it CAD 19.55 million over anti-money-laundering failures; KuCoin is appealing.[fintrac-canafe.canada.ca]
Regulatory history
2025-01 · DOJ (US): Pleaded guilty to operating an unlicensed money transmitting business, paid ~USD 297 million, exited the US market; the two founders left management.[justice.gov]
2026-03 · CFTC (US): Consent order, USD 500,000 fine, permanent ban on serving US users.[coindesk.com]
2023-12 · New York Attorney General: Settled for over USD 22 million, with refunds to New York investors.[ag.ny.gov]
2024-05 · SFC (Hong Kong): Withdrew from Hong Kong for lack of a VATP licence.[ambcrypto.com]
Luno
Last reviewed 27/09/2026
B· Medium risk · meets 4/5 criteria
A DCG-owned exchange focused on Africa and Southeast Asia: licensed by the FSCA (South Africa), SC (Malaysia), OJK (Indonesia), and BMA (Bermuda); monthly proof of reserves verified by Moore. It has closed accounts in some regions since 1/9/2026.
✓Publishes a monthly proof of reserves (Merkle) that users can verify themselves
✓Licensed by a major regulator: Nam Phi (FSCA), Malaysia (SC), Indonesia (OJK), Bermuda (BMA)
✓Operating since 2013 (13 years)
!No user protection fund disclosed
✓No recorded incident causing user losses on the exchange
iLuno stopped serving certain regions (without publishing a list) to focus on Africa and Southeast Asia; accounts in those regions have been closed, and Luno may charge a monthly fee on remaining retained balances.
iUnited Kingdom: Luno states that it is not regulated in the United Kingdom.
iCut approximately 20% of its global workforce, shifting towards institutional and B2B customers.
Facts and sources
Operating since
2013
Proof of reserves
Monthly · latest 2026-07 · Moore (Moore Johannesburg)Agreed-upon procedures (AUP), with Merkle-based user self-verification on the web; reports are released at the end of the following month. Previously Mazars (9/2021–11/2022).[guide.luno.com]
Licences / registrations
Nam Phi (FSCA) · Financial Services Provider (FAIS) (licence)[iol.co.za]
Malaysia (SC) · Recognized Market Operator, digital asset exchange (Luno Malaysia Sdn Bhd) (licence)[sc.com.my]
Indonesia (OJK) · Pedagang Aset Keuangan Digital (PT Luno Indonesia Ltd) (licence)Effective from 25/5/2026.[armadaberita.com]
Bermuda (BMA) · Class F Digital Asset Business (Luno International Ltd) (licence)8/2026, for the institutional / B2B segment.[luno.com]
2026-09-01 · Luno stopped serving certain regions (without publishing a list) to focus on Africa and Southeast Asia; accounts in those regions have been closed, and Luno may charge a monthly fee on remaining retained balances.[guide.luno.com]
United Kingdom: Luno states that it is not regulated in the United Kingdom.[guide.luno.com]
2026-07 · Cut approximately 20% of its global workforce, shifting towards institutional and B2B customers.[coindesk.com]
Regulatory history
2023-10 · FCA (Anh): Suspended new purchases by UK customers before crypto promotion rules took effect (customers could still sell and withdraw).[financemagnates.com]
OKX
Last reviewed 24/09/2026
B· Medium risk · meets 4/5 criteria
Holds MiCA (Malta), VARA (Dubai), MAS (Singapore) and multiple US state licences; monthly proof of reserves checked by Hacken. Does not disclose a user protection fund.
✓Publishes a monthly proof of reserves (Merkle) that users can verify themselves
✓Licensed by a major regulator: EU (Malta, MFSA), Dubai (VARA), Singapore (MAS), US (states)
✓Operating since 2017 (9 years)
!No user protection fund disclosed
✓Users were fully compensated for every known incident
iCoinDesk Data Exchange Benchmark (2026-05): grade A, score 82.85, ranked 8. For reference only, not part of the risk tier.
Facts and sources
Operating since
2017
Proof of reserves
Monthly · latest 2026-09 · HackenMerkle + zk-STARK. 47th report: BTC 109%. Assets held with third-party custodians are not independently verified.[okx.com]
Licences / registrations
EU (Malta, MFSA) · MiCA CASP (OKX Europe) (licence)[casptracker.eu]
Singapore (MAS) · Major Payment Institution (OKX SG) (licence)[coindesk.com]
US (states) · Money transmitter licences in multiple states (excluding NY, TX) (licence)[okx.com]
Australia (AUSTRAC) · DCE registration (OKX Australia) (registration)[okx.com]
User protection fund
Not disclosed
Incidents
2023-12 · OKX DEX proxy contract exploit (admin key leaked) · ~$3M · users fully compensated · only an isolated market / product was affectedAffected the DEX product, not exchange accounts; OKX pledged full compensation.[theblock.co]
2020-10 · All withdrawals frozen for ~5 weeks because a key holder was detained · users fully compensatedNo funds lost; withdrawals resumed from 26/11/2020 with a compensation programme.[coindesk.com]
Regulatory history
2025-02 · DOJ (US): Pleaded guilty to operating an unlicensed money transmitting business, paid ~USD 504 million; must retain a compliance consultant until 2/2027.[justice.gov]
2025-04 · FIAU (Malta): Fined ~EUR 1.1 million over anti-money-laundering failures.[dailyhodl.com]
2025-09 · DNB (Netherlands): Fined EUR 2.25 million for serving Dutch customers while unregistered.[coindesk.com]
Gate
Last reviewed 24/09/2026
B· Medium risk · meets 3/5 criteria
Operating since 2013 (formerly Bter), holds MiCA (Malta), VARA (Dubai), registrations in Japan and Australia, and licences in multiple US states. Proof of reserves was irregular in the first half of 2026; compensation for the 2015 and 2018 hacks could not be verified.
!Proof of reserves exists but is not published every month
✓Licensed by a major regulator: EU (Malta, MFSA), Dubai (VARA), US (states)
✓Operating since 2013 (13 years)
✓User protection fund: Gate SAFU / user protection fund (~$200M)
!Users have suffered losses before: Bter (Gate's predecessor) had 7,170 BTC hacked from a cold wallet (2015-02); Supply-chain attack via StatCounter targeting BTC withdrawals (2018-11)
iCoinDesk Data Exchange Benchmark (2026-05): grade A, score 81.42, ranked 9. For reference only, not part of the risk tier.
Facts and sources
Operating since
2013
Proof of reserves
Irregular · latest 2026-08 · Hacken (assessment of the Merkle + zk-SNARK mechanism)Reports for 1, 3, 6, 7, 8/2026 (115–127% ratio); no reports seen for 2, 4, 5/2026. Monthly again since 6/2026.[gate.com]
Licences / registrations
EU (Malta, MFSA) · MiCA CASP (Gate Technology) (licence)[casptracker.eu]
Australia (AUSTRAC) · DCE registration (registration)[gate.com]
User protection fund
Gate SAFU / user protection fund · ~$200M (2026-04)The "USD 200 million+" figure comes from third-party sources; Gate has not officially disclosed the current size.[coinbureau.com]
Incidents
2019-01 · Ethereum Classic 51% attack affecting deposits · ~$270,000 · users fully compensatedGate absorbed the loss itself.[datawallet.com]
2018-11 · Supply-chain attack via StatCounter targeting BTC withdrawals · users bore losses / compensation not verifiedNumber of people and amount affected unknown; Gate did not disclose any compensation.[welivesecurity.com]
2015-02 · Bter (Gate's predecessor) had 7,170 BTC hacked from a cold wallet · ~$2M · users bore losses / compensation not verifiedSources disagree on whether users were compensated; could not be verified.[cryptoslate.com]
Regulatory history
2022-02 · CNMV (Spain): Investor warning: the operating entity at the time was not licensed.[fintelegram.com]
2024-07 · Japan: Withdrew its global service from Japan, returned via Gate Japan (registered).[financemagnates.com]
Kraken
Last reviewed 27/09/2026
B· Medium risk · meets 3/5 criteria
A long-established exchange (since 2013), with MiCA (Ireland), a Wyoming SPDI bank, and multiple other licences; quarterly proof of reserves by an independent accounting firm. It has never lost customer funds; Dubai is only a preliminary approval.
!Proof of reserves exists but is not published every month
✓Licensed by a major regulator: EU (Ireland, CBI), United States (Wyoming)
✓Operating since 2013 (13 years)
!No user protection fund disclosed
✓Users were fully compensated for every known incident
iSupport staff improperly accessed data from ~2,000 accounts (2 incidents, since 2/2025), accompanied by extortion threats; Kraken said its systems were not breached and no funds were lost.
Facts and sources
Operating since
2013
Proof of reserves
Irregular · latest 2026-06 · self-publishedQuarterly, Merkle-based, with user self-verification. Kraken states only “independent accounting firm” and does not name the firm (previously Armanino, The Network Firm). Snapshot dated 30/6/2026: BTC 102.9%, ETH 100.5%, and USDT and USDC above 105%.[kraken.com]
Licences / registrations
EU (Ireland, CBI) · MiCA CASP (Payward Europe Solutions Limited) (licence)[blog.kraken.com]
United States (Wyoming) · Special-purpose custodian bank SPDI (Kraken Financial) (licence)Has a master account at the Kansas City Fed since 3/2026 (a 1-year pilot).[blog.kraken.com]
Anh (FCA) · Cryptoasset registration (Payward Limited, FRN 928768) (registration)[support.kraken.com]
Australia (AUSTRAC) · DCE registration (Bit Trade Pty Ltd) (registration)[support.kraken.com]
Dubai (VARA) · Preliminary VASP approval (Payward FZCO, brokerage / investment management) (in-principle approval)21/5/2026; cannot operate until it receives a formal licence.[blog.kraken.com]
User protection fund
Not disclosed
Incidents
2024-06 · Deposit flaw exploited by CertiK, ~USD 3 million · ~$3M · users fully compensatedFunds from the exchange’s own fund, not customer assets; CertiK returned nearly all of it.[coindesk.com]
Regional notes
2026-04 · Support staff improperly accessed data from ~2,000 accounts (2 incidents, since 2/2025), accompanied by extortion threats; Kraken said its systems were not breached and no funds were lost.[coindesk.com]
Regulatory history
2023-02 · SEC (US): USD 30 million settlement; discontinued staking services for US customers.[sec.gov]
2025-03 · SEC (US): The 11/2023 lawsuit (unregistered securities exchange, commingling customer funds) was withdrawn, with no penalty.[insurancejournal.com]
2024-12 · ASIC (Australia): A Federal Court fined Bit Trade AUD 8 million for providing a “margin extension” product to more than 1,100 customers without a TMD.[asic.gov.au]
2022-11 · OFAC (United States): USD 362.158 settlement because users apparently were in Iran.[ofac.treasury.gov]
2021-09 · CFTC (US): USD 1.25 million fine for offering margin trading to retail customers without registering as an FCM.[cftc.gov]
Nexo
Last reviewed 24/09/2026
B· Medium risk · meets 3/5 criteria
Centralised crypto lending platform: Nexo lends out deposited assets, so depositors take on additional credit risk. Published rates are for the Platinum tier (≥10% of the portfolio in NEXO), and the portfolio must exceed USD 5,000 to earn interest. Only an auditor's reserve attestation, no Merkle.
!Proof of reserves exists but is not published every month
✓Licensed by a major regulator: US (California DFPI)
✓Operating since 2018 (8 years)
!No user protection fund disclosed
✓No recorded incident causing user losses on the exchange
iNexo re-lends customer assets (claims loans are over-collateralised): depositors bear credit and counterparty risk in addition to custody risk.
iThe ~USD 775 million insurance belongs to the custodians (Ledger Vault, BitGo…), covers only assets in their cold storage, and does not protect against Nexo insolvency or borrower default. The figure is outdated.
iRates depend on membership tier (share of NEXO in the portfolio); taking interest in NEXO adds ~2%. APY Board shows only the published rate (top tier, paid in the deposited coin).
iEU: no MiCA licence of its own yet; serves EEA customers through licensed partners.
Facts and sources
Operating since
2018
Proof of reserves
Irregular · Moore (TrustReserve); previously Armanino until 1/2023Only an attestation that total assets exceed liabilities; users cannot verify it themselves; the latest report could not be verified.[nexo.com]
Licences / registrations
US (California DFPI) · Lending licence under the California Financing Law (licence)[businesswire.com]
Nexo re-lends customer assets (claims loans are over-collateralised): depositors bear credit and counterparty risk in addition to custody risk.[nexo.com]
The ~USD 775 million insurance belongs to the custodians (Ledger Vault, BitGo…), covers only assets in their cold storage, and does not protect against Nexo insolvency or borrower default. The figure is outdated.[nexo.how]
Rates depend on membership tier (share of NEXO in the portfolio); taking interest in NEXO adds ~2%. APY Board shows only the published rate (top tier, paid in the deposited coin).[nexo.com]
2026-07 · EU: no MiCA licence of its own yet; serves EEA customers through licensed partners.[nexo.com]
Regulatory history
2023-01 · SEC + NASAA (US): Earn product was an unregistered security; paid USD 45 million in total, stopped Earn in the US (returned in 2/2026 via a partner).[sec.gov]
2023-12 · Bulgarian Prosecutor's Office: The criminal investigation following the 1/2023 raid was closed for lack of evidence.[cointelegraph.com]
2026-01 · California DFPI: Fined USD 500,000 for lending in California (2018–2022) without the appropriate licence.[dfpi.ca.gov]
2023-04 · BCSC (Canada): Withdrew services from Canada.[nexo.com]
Tokocrypto
Last reviewed 27/09/2026
B· Medium risk · meets 3/5 criteria
Indonesian exchange owned by Binance, licensed by OJK. Merkle + zk-SNARK proof of reserves is disclosed irregularly (most recently 1/1/2026), with no third-party confirmation. No publicly disclosed user protection fund.
!Proof of reserves exists but is not published every month
✓Licensed by a major regulator: Indonesia (OJK)
✓Operating since 2018 (8 years)
!No user protection fund disclosed
✓No recorded incident causing user losses on the exchange
iOwned by Binance (acquisition completed 12/2022, with ~58% of staff cut), and therefore subject to additional risks related to the Binance group.
Facts and sources
Operating since
2018
Proof of reserves
Irregular · latest 2026-01 · self-publishedMerkle + zk-SNARK, self-verifiable by users; disclosures since 2023. Snapshot on 1/1/2026: user assets ~USD 345 million. No newer snapshot was found.[liputan6.com]
Licences / registrations
Indonesia (OJK) · Pedagang Aset Keuangan Digital (PT Aset Digital Berkat) (licence)Included on the OJK whitelist published on 19/12/2025.[cnbcindonesia.com]
User protection fund
Not disclosed
Incidents
None recorded
Regional notes
2022-12 · Owned by Binance (acquisition completed 12/2022, with ~58% of staff cut), and therefore subject to additional risks related to the Binance group.[coindesk.com]
Regulatory history
2024-09 · Bappebti (Indonesia): Granted a full PFAK licence, the 3rd exchange in Indonesia; supervision transferred to OJK from 1/2025.[cointelegraph.com]
MEXC
Last reviewed 24/09/2026
C· Higher risk
No licence from any major regulator; the Seychelles regulator (where the operating entity is based) took enforcement action for unlicensed activity and said it cannot help recover funds. Has monthly proof of reserves and a USD 100 million Guardian fund.
✕Ongoing issue: Seychelles FSA took enforcement action against MX Global Ltd (operator of mexc.com) for providing virtual asset services without a licence; the FSA does not handle complaints or help recover funds.
✓Publishes a monthly proof of reserves (Merkle) that users can verify themselves
!No licence from a major regulator (EU MiCA, Dubai VARA, Japan, Singapore…)
✓Operating since 2018 (8 years)
✓User protection fund: MEXC Guardian Fund (~$100M)
✓Users were fully compensated for every known incident
iEU: no MiCA, not allowed to serve EEA customers; on the warning lists of the FCA (UK), BaFin (Germany) and AFM (Netherlands).
iCoinDesk Data Exchange Benchmark (2026-05): grade C, score 58.57, ranked 34. For reference only, not part of the risk tier.
MEXC Guardian Fund · ~$100M (2025-06)Self-reported; plans to raise it to USD 500 million within 2 years.[prnewswire.com]
Incidents
2025-07 · Froze a trader's account of ~USD 3 million; many complaints of withdrawals being locked · ~$3M · users fully compensatedFunds were returned after ~4 months with a public apology.[blockhead.co]
Ongoing issue
2026-05-26 · Seychelles FSA took enforcement action against MX Global Ltd (operator of mexc.com) for providing virtual asset services without a licence; the FSA does not handle complaints or help recover funds.[fsaseychelles.sc]
Regional notes
2026-07-01 · EU: no MiCA, not allowed to serve EEA customers; on the warning lists of the FCA (UK), BaFin (Germany) and AFM (Netherlands).[casptracker.eu]
Regulatory history
2024-11 · FSA (Japan): Warning over unregistered operation; in 2/2025 requested removal of the app from the App Store/Google Play in Japan.[theblock.co]
2025-08 · SEC Philippines: Named on the list of unregistered exchanges; access blocked.[coindesk.com]
Coinbase
Last reviewed 27/09/2026
C· Higher risk · meets 3/5 criteria
A US-listed exchange, with BitLicense (New York), MiCA (Luxembourg), and MAS (Singapore). It does not publish proof of reserves, only audited financial statements. It reimbursed scammed customers following the 5/2025 data breach.
✕No proof of reserves published
✓Licensed by a major regulator: EU (Luxembourg, CSSF), US (New York, NYDFS), Singapore (MAS)
✓Operating since 2012 (14 years)
!No user protection fund disclosed
✓Users were fully compensated for every known incident
iUS: the Oregon Attorney General sued Coinbase for selling unregistered securities; the lawsuit is currently stayed, with no outcome yet.
Facts and sources
Operating since
2012
Proof of reserves
Not published · self-publishedThere is no Merkle tree or reserve attestation for the entire exchange; Coinbase relies on the financial statements (10-Q/10-K) of the listed company. Proof of reserves applies only to wrapped tokens (cbBTC, using Chainlink from 5/2025) and does not cover customer balances on the exchange.[sec.gov]
Licences / registrations
EU (Luxembourg, CSSF) · MiCA CASP (Coinbase Luxembourg S.A.) (licence)[amf-france.org]
US (New York, NYDFS) · BitLicense and money-transmitter licences (licence)[infobytes.orrick.com]
Singapore (MAS) · Major Payment Institution (Coinbase Singapore) (licence)[theblock.co]
Anh (FCA) · VASP registration (registration)[coindesk.com]
User protection fund
Not disclosed
Incidents
2025-05 · Outsourced support staff were bribed, exposing the data of 69,461 customers; fraudsters impersonated Coinbase to trick customers into transferring money. · users fully compensatedCoinbase voluntarily reimbursed scammed customers; its Q2/2025 10-Q records USD 253.4 million in cash paid for the incident ("affected customers have been reimbursed").[sec.gov]
Regional notes
2025-04 · US: the Oregon Attorney General sued Coinbase for selling unregistered securities; the lawsuit is currently stayed, with no outcome yet.[doj.state.or.us]
Regulatory history
2025-11 · Central Bank of Ireland: Coinbase Europe was fined EUR 21.5 million because more than 30 million transactions (over EUR 176 billion) were not properly monitored for anti-money-laundering purposes.[rte.ie]
2025-02 · SEC (US): The 6/2023 lawsuit (unregistered exchange and securities broker) was permanently dismissed, with no fine.[sec.gov]
2024-07 · FCA (Anh): CB Payments was fined GBP 3.5 million for accepting 13,416 high-risk customers despite undertaking not to do so.[portfolio-adviser.com]
2023-01 · NYDFS (New York): Fined USD 50 million and required to spend an additional USD 50 million on compliance due to anti-money-laundering deficiencies.[dfs.ny.gov]
2021-03 · CFTC (US): Fined USD 6.5 million for inaccurate transaction reporting and wash trading by an employee.[cftc.gov]
Crypto.com
Last reviewed 27/09/2026
C· Higher risk · meets 3/5 criteria
Has MiCA (Malta), VARA (Dubai), and MAS (Singapore). There is no current proof of reserves: the only report was Mazars' 12/2022 report. It fully compensated the USD 34 million hack in 2022.
✕No proof of reserves published
✓Licensed by a major regulator: EU (Malta, MFSA), Dubai (VARA), Singapore (MAS)
✓Operating since 2016 (10 years)
!No user protection fund disclosed
✓Users were fully compensated for every known incident
iBloomberg reported that an employee-account breach (before 3/2023) exposed the data of a small number of users, which Crypto.com did not disclose; no funds were lost.
Facts and sources
Operating since
2016
Proof of reserves
Not published · self-publishedThe latest and only report is Mazars' report (snapshot dated 7/12/2022, ISRS 4400 agreed-upon procedures, with Merkle), now more than 24 months old; Mazars stopped working with crypto exchanges immediately afterward. No newer report was found.[crypto.com]
2025-09 · Bloomberg reported that an employee-account breach (before 3/2023) exposed the data of a small number of users, which Crypto.com did not disclose; no funds were lost.[theblock.co]
Regulatory history
2025-03 · SEC (US): Investigation closed (following a 2024 Wells notice), with no enforcement action.[crypto.com]
2024-03 · DNB (Netherlands): Fined EUR 2.85 million for operating for approximately 2 years in the Netherlands without registration; Crypto.com is appealing.[coindesk.com]
HTX
Last reviewed 24/09/2026
C· Higher risk
Sanctioned by the UK (5/2026) and banned from trading by the EU from 23/8/2026 under the Russia sanctions package. No licence from any major regulator; the press found proof of reserves that did not match on-chain balances.
✕Ongoing issue: Sanctioned by the UK (asset freeze, 26/5/2026) and the EU bans EU/EEA residents from transacting with HTX from 23/8/2026; major exchanges closely screen transfers linked to HTX.
✓Publishes a monthly proof of reserves (Merkle) that users can verify themselves
!No licence from a major regulator (EU MiCA, Dubai VARA, Japan, Singapore…)
✓Operating since 2013 (13 years)
!No user protection fund disclosed
✓No material uncovered losses on the exchange (incidents in isolated products or under $1M are listed separately)
iUK: the FCA sued HTX in the High Court over illegal promotions; settlement talks are ongoing.
iCoinDesk Data Exchange Benchmark (2026-05): grade C, score 58.28, ranked 37. For reference only, not part of the risk tier.
Facts and sources
Operating since
2013
Proof of reserves
Monthly · latest 2026-09 · self-publishedMerkle, self-reported monthly, no third party. Protos found the 9/2026 report listed balances that do not exist on-chain and ~USD 1.3 billion of reserves moved to an undisclosed "third party".[htx.com]
Licences / registrations
None from a major regulator
User protection fund
Not disclosed
Incidents
2023-11 · HTX hot wallet hack · ~$14M · users fully compensatedJustin Sun pledged full coverage; after the hack ~USD 258 million was withdrawn from the exchange.[cnbc.com]
2023-11 · Heco Chain bridge exploit (operator keys leaked) · ~$87M · users bore losses / compensation not verified · only an isolated market / product was affectedAffected Heco bridge users, not exchange accounts; no source confirms compensation.[certik.com]
2023-09 · Hot wallet key leaked, 5,000 ETH lost · ~$8M · users fully compensatedHTX covered the loss itself; the hacker returned the funds in 10/2023.[coindesk.com]
Ongoing issue
2026-08-23 · Sanctioned by the UK (asset freeze, 26/5/2026) and the EU bans EU/EEA residents from transacting with HTX from 23/8/2026; major exchanges closely screen transfers linked to HTX.[theblock.co]
Regional notes
2025-10 · UK: the FCA sued HTX in the High Court over illegal promotions; settlement talks are ongoing.[decrypt.co]
Regulatory history
2024-05 · SFC (Hong Kong): Withdrew its VATP licence application twice and had to close operations in Hong Kong.[cryptonews.com]
2026-04 · SEC Philippines: Warning that HTX is operating unregistered.[bworldonline.com]
Pintu
Last reviewed 27/09/2026
C· Higher risk · meets 3/5 criteria
Indonesian exchange licensed by OJK, with assets held in custody at ICC and Fireblocks. No currently valid proof of reserves (the only instance was in 2022), and no publicly disclosed user protection fund.
✕No proof of reserves published
✓Licensed by a major regulator: Indonesia (OJK)
✓Operating since 2020 (6 years)
!No user protection fund disclosed
✓No recorded incident causing user losses on the exchange
Facts and sources
Operating since
2020
Proof of reserves
Not published · self-publishedThe most recent report was the only disclosure in 2022; it has been more than 24 months, so it is not counted as proof of reserves still being available. Pintu states that assets are held in custody at PT Kustodian Koin Indonesia (ICC) and Fireblocks.[zaipad.com]
Licences / registrations
Indonesia (OJK) · Pedagang Aset Keuangan Digital (PT Pintu Kemana Saja) (licence)Included on the OJK whitelist published on 19/12/2025.[cnbcindonesia.com]
User protection fund
Not disclosed
Incidents
None recorded
Reku
Last reviewed 27/09/2026
C· Higher risk · meets 3/5 criteria
Indonesian exchange (formerly Rekeningku) licensed by OJK, with crypto assets held in custody at ICC. It does not disclose proof of reserves and has no publicly disclosed user protection fund.
✕No proof of reserves published
✓Licensed by a major regulator: Indonesia (OJK)
✓Operating since 2018 (8 years)
!No user protection fund disclosed
✓No recorded incident causing user losses on the exchange
Facts and sources
Operating since
2018
Proof of reserves
Not published · self-publishedNo Reku PoR report was found. Crypto assets are held in custody at PT Kustodian Koin Indonesia (ICC), while US stocks and futures are held at PT Kliring Berjangka Indonesia (KBI).[zaipad.com]
Licences / registrations
Indonesia (OJK) · Pedagang Aset Keuangan Digital (PT Rekeningku Dotcom Indonesia) (licence)Included on the OJK whitelist published on 19/12/2025.[cnbcindonesia.com]
User protection fund
Not disclosed
Incidents
None recorded
Indodax
Last reviewed 27/09/2026
C· Higher risk · meets 2/5 criteria
Indonesia's largest exchange, licensed by OJK. Its hot wallet was hacked for ~USD 22 million (9/2024); the exchange said user balances were unaffected, but there has been no independent confirmation. The most recent proof of reserves is from 1/2023. Police and OJK are reviewing complaints of asset losses.
✕No proof of reserves published
✓Licensed by a major regulator: Indonesia (OJK)
✓Operating since 2014 (12 years)
!No user protection fund disclosed
✕Users suffered uncovered losses in the last 3 years: Hot-wallet hack (suspected Lazarus), ~USD 22 million (2024-09)
iIndonesia's National Police (Bareskrim) is investigating losses related to how Indodax's trading system operated following the 9/2024 incident, including complaints from BOTX holders; there is no conclusion yet.
iOJK summoned Indodax over reports of members losing money; Indodax said this was due to phishing/malware scams outside its system and that no customer assets were harmed. There is no outcome yet.
iDelisted BOTX and unilaterally converted BOTX balances into rupiah (~342 IDR/token) despite holders' objections; mediation at OJK failed, and OJK referred the matter to its inspection department.
Facts and sources
Operating since
2014
Proof of reserves
Not published · self-publishedThe latest report was a one-time agreed-upon procedures (AUP) report by Kreston Indonesia (KAP Hendrawinata Hanny Erwin & Sumargo) as of 31/1/2023, published on 18/4/2023: assets exceeded liabilities to members. It is more than 24 months old, is not Merkle-based, and users cannot verify it themselves; no newer report was found.[blog.indodax.com]
Licences / registrations
Indonesia (OJK) · Pedagang Aset Keuangan Digital (PT Indodax Nasional Indonesia) (licence)Included on the OJK whitelist published on 19/12/2025.[cnbcindonesia.com]
User protection fund
Not disclosed
Incidents
2024-09 · Hot-wallet hack (suspected Lazarus), ~USD 22 million · ~$22M · users bore losses / compensation not verifiedThe exchange halted operations on 11–14/9/2024; Indodax said customers’ rupiah and crypto balances were unaffected and pledged to compensate those who suffered losses, but there is no independent confirmation. BOTX holders said they lost assets after the incident.[digivestasi.com]
Regional notes
2026-07 · Indonesia's National Police (Bareskrim) is investigating losses related to how Indodax's trading system operated following the 9/2024 incident, including complaints from BOTX holders; there is no conclusion yet.[monitorindonesia.com]
2026-01-02 · OJK summoned Indodax over reports of members losing money; Indodax said this was due to phishing/malware scams outside its system and that no customer assets were harmed. There is no outcome yet.[cnnindonesia.com]
2025-11 · Delisted BOTX and unilaterally converted BOTX balances into rupiah (~342 IDR/token) despite holders' objections; mediation at OJK failed, and OJK referred the matter to its inspection department.[monitorindonesia.com]
Quidax
Last reviewed 27/09/2026
C· Higher risk · meets 2/5 criteria
A Nigerian exchange, approved in principle by Nigeria’s SEC (ARIP) since 8/2024, but not yet fully registered. It does not publish proof of reserves and has no publicly disclosed user protection fund.
✕No proof of reserves published
!No licence from a major regulator (EU MiCA, Dubai VARA, Japan, Singapore…)
✓Operating since 2018 (8 years)
!No user protection fund disclosed
✓No recorded incident causing user losses on the exchange
iNigeria: the SEC requires digital-asset exchanges to have minimum capital of NGN 2 billion, with a compliance deadline of 30/6/2027; failure to comply may result in suspension or deregistration.
iThe banking partnership still requires approval from the Central Bank of Nigeria (CBN).
Facts and sources
Operating since
2018
Proof of reserves
Not published · self-publishedNo Quidax proof of reserves report was found.
Licences / registrations
Nigeria (SEC) · Approval-in-Principle, digital asset exchange (Quidax Technologies Limited, ARIP) (in-principle approval)Approval in principle is a step before full registration; the SEC directory (8/2026) still lists it as an ARIP member.[thisdaylive.com]
User protection fund
Not disclosed
Incidents
None recorded
Regional notes
2026-01 · Nigeria: the SEC requires digital-asset exchanges to have minimum capital of NGN 2 billion, with a compliance deadline of 30/6/2027; failure to comply may result in suspension or deregistration.[licentium.io]
2024-08 · The banking partnership still requires approval from the Central Bank of Nigeria (CBN).[cointelegraph.com]