Leaving crypto on an exchange swaps one set of risks for another: no recovery phrase to lose, but a balance that depends on the company staying honest, secure and solvent, and the 2022 failures showed how long a frozen account can stay frozen. How safe that is turns on the custody terms, the company's books and the law that applies if it fails, all on top of ordinary price risk. The crypto hub covers the basics.
How do crypto exchanges hold customers' coins?
Exchanges usually pool customer coins in a few large omnibus wallets they control and record each customer's share only in their internal ledger.
The CFTC's investor guide spells out what that means: when you trade on such a platform, you trade against the platform, your holdings sit on its centralized system rather than the blockchain, and they may be mixed with other customers' assets or used for its operations. Trades between customers usually never touch the blockchain; only deposits and withdrawals move coins on-chain.
Within the pool, coins are split by how quickly they may be needed. NIST describes the usual pattern: hot wallets connected to the internet for coins in transit, offline cold storage for coins at rest, and sometimes a warm tier between them that releases funds under time delays, limits or extra signatures. Which of the two a custodian relies on is one of the questions the SEC's custody bulletin suggests putting to it, and hot vs cold wallets applies the same split to personal storage.
What the pool is worth to you in a failure depends on how it is set up. New York's Department of Financial Services, in guidance updated on September 30, 2025, expects the custodians it oversees to segregate customer coins from their own, on-chain and in their books, either in wallets under each customer's name or in omnibus wallets holding only customer coins as agent or trustee. They should be able to reconcile ledger and chain on request, should never use customer coins to secure their own debts, and should set up a custodial relationship rather than a debtor-creditor one.
Worked example: Sharing a shortfall in an omnibus wallet
Suppose an exchange's ledger shows customers own 10,000 BTC, held on-chain as 9,400 BTC in cold storage and 600 BTC in hot wallets. All figures are illustrative.
- Fully backed: 9,400 + 600 = 10,000 BTC held against 10,000 BTC owed, a 100% ratio
- If the company had quietly lent out 2,000 BTC that never came back: 8,000 BTC held against 10,000 owed, an 80% ratio
- Shared pro rata, a customer owed 0.5 BTC would receive 0.5 × 80% = 0.4 BTC
That pro rata split is what UCC Article 8 provides when an account agreement treats the coins as financial assets held for the customer: the intermediary's general creditors cannot reach them, and every holder shares any shortfall in proportion. If the terms instead make the coins company property, customers stand in line with other unsecured creditors and may be repaid later, in dollars.
What does proof of reserves show, and what does it miss?
Proof of reserves shows an exchange controlled certain coins at one moment, not what it owed, whether it kept those coins or whether its controls work.
A report usually has an asset side and, in fuller versions, a liability side. For assets, the exchange shows it controls certain wallet addresses, often by signing a message with their keys, and a third party adds up the balances on-chain. For liabilities, customer balances are totaled, often in a structure called a Merkle tree that lets each customer confirm their own balance was included without seeing anyone else's.
In March 2023, the PCAOB's Office of the Investor Advocate warned that these engagements are not audits and give investors no meaningful assurance. Its main points:
- The procedures likely do not address the exchange's liabilities or the rights of the people whose coins it holds.
- A report cannot reveal whether the coins were borrowed to look solvent on the day.
- A snapshot says nothing about whether coins were used, lent or lost after it was taken.
- Reports give no assurance about internal controls or governance.
- Standards vary, some providers are not accountants, and management decides what gets published.
Treat any report as one data point. A report that covers liabilities as well as assets, leaves the exchange's own token out of the asset count, is repeated often and sits alongside audited financial statements says more than a one-off count of coins.
What happens to your crypto if an exchange goes bankrupt?
You usually become a creditor, and the platform's terms decide whether your coins count as your property or the company's, which shapes how much you recover and how fast.
SEC staff flagged the uncertainty months before the 2022 failures. Staff Accounting Bulletin 121, published in March 2022, cited significant legal questions about how custody arrangements would be treated in court after fraud, loss, theft or bankruptcy, and told public companies to consider disclosing whether customers' coins could be used to pay general creditors. Three bankruptcies since then show the range of answers.
Celsius: terms that moved Earn deposits to the company
Celsius's interest-paying Earn program ran under Terms of Use that transferred ownership of deposited coins to Celsius. Ruling on January 4, 2023, the New York bankruptcy court held that those coins, about $4.2 billion across roughly 600,000 accounts, were property of the estate, which left Earn customers as unsecured creditors. Coins kept solely in its separate custody program were treated differently and could be withdrawn. Eligible creditors, including Earn customers, have recovered about 72.1% of the petition-date value of eligible claims, including Earn claims, after the fourth distribution in February 2026. Crypto lending risks covers the 2022 lender failures in more depth.
FTX: claims fixed in dollars
FTX's founder was convicted of fraud for taking customer deposits, so there was no intact pool of customer coins to hand back. The plan, effective January 3, 2025, valued each customer claim in dollars at prices on the November 11, 2022 filing date rather than returning coins. Customers have received 105% of allowed customer claims, or 120% for convenience claims of $50,000 or less, as of the fifth distribution on July 31, 2026, more than 100% of those 2022 dollar amounts but less than many of the same coins later traded for; custodial vs non-custodial wallets works through the numbers for one bitcoin.
Voyager: dollars at a bank versus coins on the platform
Voyager froze trading and withdrawals on July 1, 2022 and filed for bankruptcy on July 5. Cash sat in for-the-benefit-of-customers accounts at an FDIC-member bank, and on August 5, 2022 the court ruled that cash was not estate property, because Voyager had only the right to direct its movements, so customers could withdraw it. Crypto sat in omnibus wallets that Voyager could hold in its own name and lend, stake or rehypothecate "with all attendant rights of ownership." The terms warned that customers could end up as unsecured creditors, and Voyager argued they were. The judge noted that no creditor had opposed the cash ruling, so other courts might decide similar questions differently.
Worked example: What a $20,000 Voyager crypto claim returned
Take a customer whose coins were worth $20,000 at July 2022 prices, using the percentages Voyager's plan administrator has published.
- First distribution, largely in kind through the reopened app in mid-2023: 35.72% × $20,000 = $7,144
- Second distribution, by check in 2024: 34.28% × $20,000 = $6,856
- Total: $7,144 + $6,856 = $14,000, or 70% of the claim
A dollar balance held in the bank accounts, by contrast, became withdrawable in full from August 2022.
Does FDIC insurance or SIPC cover crypto on an exchange?
No: FDIC insurance pays depositors when an insured bank fails, and SIPC restores missing cash and securities at failed member brokerages, which leaves crypto on an exchange outside both.
The FDIC's crypto fact sheet says deposit insurance does not protect against the failure of non-bank companies such as crypto exchanges, custodians, brokers and wallet providers, and does not cover crypto assets at all. On July 28, 2022, the FDIC and the Federal Reserve demanded that Voyager stop implying customers were FDIC-insured: its customers' dollars sat at an insured bank, but that insurance would have paid out only if the bank failed, not Voyager. FDIC rules bar companies from misrepresenting uninsured products as insured.
SIPC protects customers of failed member brokerages up to $500,000 per customer, including up to $250,000 in cash, but it states that it does not protect any digital asset that fails to qualify as a security, including unregistered investment contracts, and a joint SEC and CFTC statement lists bitcoin and ether among its examples of digital commodities. Neither program covers falling prices. FDIC vs SIPC compares the two programs in full.
Who regulates crypto custody in the US?
No single regulator does: custodians answer to state money transmitter and trust laws, New York's custody rules, federal bank supervisors or SEC staff guidance, depending on what they are.
| Rule or action | Date | What it does | What it leaves unchanged |
|---|---|---|---|
| SEC Staff Accounting Bulletin 121 | March 2022 | Told public companies holding crypto for customers to book a liability and a matching asset at fair value | Customers' legal rights in a bankruptcy |
| SEC Staff Accounting Bulletin 122 | January 23, 2025 | Rescinded SAB 121; companies now decide whether to book a loss liability under the usual contingency rules | The legal uncertainty SAB 121 described |
| OCC Interpretive Letter 1183 | March 7, 2025 | Dropped the 2021 requirement that national banks get supervisory non-objection before offering crypto custody | Crypto in custody is still not an insured deposit |
| Fed, FDIC and OCC joint statement | July 14, 2025 | Described risk-management practices for banks safeguarding crypto, such as control of cryptographic keys | Created no new supervisory expectations |
| NYDFS custody guidance | September 30, 2025 | Expects segregation, no use of customer coins and clear custody terms at New York licensees and trust companies | Firms outside New York's oversight |
| SEC staff no-action letter | September 30, 2025 | Lets registered advisers and funds use qualifying state trust companies as crypto custodians | Retail exchange accounts |
| OCC conditional charters | December 12, 2025 | Conditionally approved five national trust bank charters for crypto firms, three converting from state trust companies | Deposit insurance for crypto balances |
A state trust company is supervised and examined by a state banking authority and can act as a fiduciary. The SEC staff letter's conditions show what careful due diligence looks like: an annual check that the trust company is authorized to hold crypto, audited financial statements, an independent report on its internal controls, and a written agreement that keeps client assets segregated and bars lending, pledging or rehypothecating them without written consent. Retail customers can put the same questions to an exchange.
Federal market-structure law is still pending: the CLARITY Act, which would set rules for crypto trading platforms, passed the House 294 to 134 in July 2025, but a Senate motion to take it up failed 49 to 50 on September 15, 2026. Crypto regulation in the US tracks where it stands.
What red flags suggest an exchange is at risk?
Warning signs include yields that look too generous, sudden withdrawal limits or delays, vague answers about lending and segregation, and any claim that crypto balances are FDIC-insured.
Exchange red flags to watch
- Interest on deposited coins with no clear account of who borrows them and on what terms, the model behind Celsius's Earn program
- Terms that pass ownership of deposits to the platform, or let it lend, pledge or rehypothecate them
- Withdrawal limits cut or processing times stretched without a clear reason
- No money services business registration in FinCEN's registrant search and no state licenses in the NMLS database, both checks the CFTC suggests
- Finances tied up with an affiliated trading firm or the platform's own token, as at FTX
- Proof-of-reserves reports that count assets but not liabilities, or that stop appearing
- Any suggestion that crypto balances carry FDIC insurance
- An offshore affiliate serving US customers it is not licensed to serve
These flags concern platform failure. Exchanges also face hacks of their own wallets, and individual accounts get taken over through stolen passwords and SIM swaps, which how to store crypto safely covers. Price risk sits on top of all of it: crypto is volatile and can lose most or all of its value on an exchange or off it.
How can you limit exposure to a single exchange?
The common approach is to keep only coins being actively traded on a platform, move the rest to storage you control, and avoid concentrating large balances with one company.
Read the custody section of the terms before depositing rather than after a freeze: whether coins are held for you, whether the platform may lend them and which legal entity you contract with. If a third party is going to hold coins, an account held for your benefit at a regulated custodian leaves you better placed than one whose terms transfer ownership. Keep records of deposits, withdrawals and balances, since a bankruptcy claim depends on proving what you held on the filing date.
Moving coins out brings its own risks, from address mistakes to sending on the wrong network. The crypto profit calculator shows what a position is worth before you move or sell it.