# Are Crypto Exchanges Safe? Custody Risk and What Protects You

**By Hasan Şentürk** · Published September 21, 2026



Is the crypto sitting in your exchange account insured the way money in a bank account is? No. Nothing in US law treats it that way, and that single answer should shape how much of your portfolio stays on a platform at all.

Two exchanges can look identical on the homepage and treat customer coins in opposite ways once trouble starts. One keeps them in accounts a bankruptcy court would treat as customer property. The other folds them into the company's own balance sheet, where you wait in line as one more creditor.

Those differences are written down in user agreements, disclosure pages, and SEC staff guidance. Checking them takes about twenty minutes, which is less time than opening the account.

## The Promise and the Catch of Custody

When you buy crypto through an exchange, the platform holds the private keys and your account balance records what it owes you. That arrangement is third-party custody, and the SEC's own investor education office describes the failure mode without softening it: if the custodian is hacked, shuts down, or goes bankrupt, you may lose access to your crypto assets ([Crypto Asset Custody Basics](https://www.investor.gov/introduction-investing/general-resources/news-alerts/alerts-bulletins/investor-bulletins/crypto-asset-custody-basics-retail-investors-investor-bulletin-0)).

Securities held at a broker-dealer sit under a different regime. Exchange Act Rule 15c3-3(b), the Customer Protection Rule, requires the firm to keep customer securities separate from its own assets. SEC Division of Trading and Markets staff have said that paragraph applies only to securities, not to crypto assets that are not securities. The separation you would expect from a brokerage account does not automatically follow your coins onto a trading platform.

That distinction drives everything below. A crypto exchange is a company you are lending trust to, and the terms of that trust are contracts, not insurance policies.

## What US Law Does Not Guarantee

Start with the protection most people assume they have. The Securities Investor Protection Corporation, or SIPC, does not protect customer claims for non-security crypto assets. SEC staff answer that question with a flat "No" in their [crypto asset FAQ](https://www.sec.gov/rules-regulations/staff-guidance/trading-markets-frequently-asked-questions/frequently-asked-questions-relating-crypto-asset-activities-distributed-ledger-technology), last updated on February 19, 2026.

The same document goes further. Non-security crypto assets are not protected by the Securities Investor Protection Act and may not be protected by any other insolvency regime. In plain terms, the question of who owns your coins when a platform fails is answered by general bankruptcy law and by whatever the user agreement says.

Deposit insurance follows the same logic. Federal deposit insurance covers money placed with an insured bank or credit union. A token on a trading platform is not a deposit in an insured bank, so that program does not reach it. A platform can truthfully say that customer dollars sit at partner banks and still leave your bitcoin outside every safety net, because cash and tokens are different assets on different books.

History makes the point better than any clause. FTX, Celsius Network, and Voyager Digital all collapsed in 2022. Their customers did not collect an insured balance. They filed claims in bankruptcy proceedings, waited years for distributions, and watched the outcome depend on which assets the estate still held and how the court classified what customers were owed.

## Questions to Ask Before Your First Deposit

A platform that cannot answer these six questions in writing has told you something useful.

1. **Does the platform hold my coins in custody, or does it lend them out?** Lending customer assets to trading firms is a revenue line for some platforms. When that applies to your account, your balance carries a second company's credit risk on top of the platform's own.
2. **What does the user agreement say happens in bankruptcy?** Look for language on whether customer assets are held for customers and kept apart from company assets. Silence on this point is worth treating as a warning.
3. **Which legal entity holds my account, and where is it registered?** A global brand can front a different entity for US customers than the one you read about in coverage from another country.
4. **Is customer cash held at an insured bank, and is the crypto treated separately from it?** These are usually two different buckets with two different rules.
5. **What are the withdrawal limits, timelines, and fees?** Access matters most in a stressed market, and limits tend to tighten exactly when you want to move.
6. **Who performs the reserve attestation, and what does the scope cover?** A named accounting firm, a dated snapshot, and a defined list of wallets is a different answer than a dashboard with a total on it.

Print the answers or save the pages. Platforms revise terms, and the version you agreed to is the version that governs your account.

Dates matter more than labels here. A custody page can be accurate on the day you read it and stale the week the platform signs a new banking or lending partner. Write the date beside each answer and treat anything older than a year as unverified. If a company will not answer one of the six in writing, that refusal is itself information.

## Rehypothecation, Commingling, and Other Fine Print

Two clauses in a user agreement decide most custody outcomes.

Rehypothecation is the platform's right to lend, pledge, or otherwise reuse assets it holds for customers. With it, your coins can be working somewhere else while your dashboard still shows a balance.

Commingling is what happens when customer assets are pooled with the company's own funds or with other customers' assets instead of being tracked separately.

Here is the mechanism in one illustration, with round numbers chosen for clarity. You deposit one bitcoin. Under a lending clause, the platform lends that coin to a trading firm that posts collateral worth less than the coin's market value. The firm fails. The collateral lands in an insolvency estate, and your account becomes a general claim against the platform rather than a claim on a specific coin. The figures here are hypothetical; the structure is a standard feature of disclosure documents at platforms that lend customer assets.

## Reading a Proof of Reserves Claim

Reserve attestations answer a narrow question: on one specific date, did the platform control at least as much crypto as it said it owed customers? That is worth knowing, and it is not the same as being protected.

Three limits matter. First, an attestation is a point-in-time snapshot, taken before the next withdrawal run. Second, the liabilities side usually leans on the platform's own records, so the report is only as good as the numbers handed to the accountant. Third, and most important, an attestation is not a legal opinion. It does not establish that customer assets are legally segregated or beyond the reach of the company's creditors.

Treat a reserve report as one input. Ask who signed it, whether the scope covers all wallets or a sample, and whether the platform publishes the report on a schedule or only after a bad week.

## Graduating to Self-Custody

Moving coins to a wallet you control removes platform risk and replaces it with key management risk. Both are real. The useful question is which one you can manage.

A hardware wallet keeps private keys offline, away from a browser or a phone. The practical rules are short. Never share a seed phrase with anyone, including someone claiming to be support. Store the backup offline rather than in a photo, a note app, or a password manager you sync to the cloud. Send a small test transaction first, then verify the address on the device screen before you move the rest.

The trade is not free. Coins in your own wallet cannot be lent out by a company, and no user agreement stands between you and them. If you lose the keys, no court, platform, or regulator can restore access. Some people keep a working balance on an exchange for trading and hold the rest themselves; others move everything and accept the key risk. There is no single correct split.

## Red Flags That Point to Counterparty Risk

These signals are about how a platform treats customer assets, not about outright fraud, which is a separate problem covered in our guide to [fake crypto platforms and payout scams](/spot-crypto-scams/).

- Yields advertised as steady or guaranteed, with no dependence on market conditions.
- Withdrawals described as temporarily unavailable, or a queue that keeps growing while deposits stay open.
- A reserve claim with no date, no scope, and no named firm behind it.
- No identifiable legal entity for your country, or a licensing claim you cannot match in a public register.
- Support that answers only through private messages and never publishes an address.
- Terms that permit lending customer assets with no notice and no separate consent.

One item on that list can be explained. Three together usually cannot.

## The Pre-Deposit Vetting Routine

Work through this table before the first deposit, and repeat it once a year or after any change of ownership.

| Step | Where it lives | Answer worth trusting |
|---|---|---|
| Custody model | User agreement, custody page | Customer assets held for customers, outside the reach of company creditors |
| Lending and rehypothecation | User agreement, product terms | Off by default, or switched on only with your explicit consent |
| Withdrawal record | Platform status page, outage history | Published limits and timelines that held up during volatile weeks |
| Reserve attestation | The report itself | Named accountant, dated snapshot, scope covering customer liabilities |
| Registration | Regulator register, platform disclosures | An entity you can match to a public filing or register entry |
| Payment trail for cash | Bank or card statements | A clean line from your bank account to a named legal entity |

If two or three rows come back empty, the honest conclusion is that you are trusting a brand. That may still be a choice someone makes with a small balance, but it should be a choice rather than an assumption.

There is also a structurally different option for readers who want crypto exposure without platform custody: shares of a spot crypto ETP held in a brokerage account. Customer protection rules and SIPC coverage apply to the securities in that account, which changes which risks you carry. Our comparison of [brokerage accounts for beginners](/best-brokerage-accounts/) covers the account-level differences.

Whichever route you take, keep the platform balance at a level you could lose without changing your plans. The rest belongs somewhere you control.

For the mechanics of buying in the first place, our walkthrough on [buying crypto on an exchange](/how-to-buy-crypto/) covers order types and fees, and the guide to [buying Bitcoin safely](/how-to-buy-bitcoin-safely-in-2026/) covers transfer and storage steps in more detail.

## Official Documents Used Here

- [Investor Bulletin: Crypto Asset Custody Basics for Retail Investors](https://www.investor.gov/introduction-investing/general-resources/news-alerts/alerts-bulletins/investor-bulletins/crypto-asset-custody-basics-retail-investors-investor-bulletin-0), SEC Office of Investor Education and Advocacy (investor.gov)
- [Division of Trading and Markets FAQ on crypto asset activities and distributed ledger technology](https://www.sec.gov/rules-regulations/staff-guidance/trading-markets-frequently-asked-questions/frequently-asked-questions-relating-crypto-asset-activities-distributed-ledger-technology), SEC (updated February 19, 2026)
- [Crypto Assets](https://www.investor.gov/additional-resources/spotlight/crypto-assets), SEC Office of Investor Education and Advocacy (investor.gov)
- [Crypto Scams](https://www.investor.gov/introduction-investing/general-resources/news-alerts/alerts-bulletins/investor-alerts/crypto-scams), SEC Office of Investor Education and Advocacy (investor.gov)
- [Crypto Assets](https://www.sec.gov/securities-topics/crypto-assets), SEC investor education

---

Source: https://financetrekker.com/are-crypto-exchanges-safe/