Is It Safe to Keep Crypto on an Exchange? Risks Explained

Keeping crypto on an exchange is reasonably safe if it’s a large, regulated one and you only hold small amounts for short periods, but it’s never as safe as most people assume. Your coins aren’t insured like a bank deposit, and if the exchange fails, freezes withdrawals or loses funds to hackers, you depend on the company to make you whole. For money you plan to hold for a long time, or that you’d be upset to lose, moving it to a wallet you control is the safer choice.

That doesn’t mean exchanges are a bad place to start. This article explains what actually happens to crypto on an exchange, the five risks you take on, the protections that do and don’t exist, and how to keep whatever you leave there as safe as possible.

Where your coins really are

When you buy bitcoin on an exchange, it doesn’t go into a wallet with your name on it. The exchange holds customers’ coins together in its own wallets, mostly offline in “cold storage”, and keeps an internal record of how much belongs to each customer. Your balance on screen is that record.

In other words, you own a claim against the exchange, not the coins themselves. As long as the exchange is honest, solvent and secure, that difference doesn’t matter. When it isn’t, it matters a great deal. This is what people mean by the crypto saying “not your keys, not your coins”. The basics of who holds what are covered in crypto wallets explained.

The five risks of leaving crypto on an exchange

1. The exchange fails or turns out to be fraudulent

This is the biggest risk, even if it’s the least likely on a given day. When FTX collapsed in November 2022, customers discovered their deposits had been misused and withdrawals stopped overnight. Customers of Mt. Gox, which collapsed in 2014, waited about a decade for partial repayment. In a bankruptcy, customers may be treated as creditors, which can mean long delays and getting back less than they had, or a dollar amount based on prices at the time of the collapse.

2. The exchange gets hacked

Exchanges hold huge amounts of crypto, which makes them prime targets. In February 2025, attackers stole about $1.5 billion in ether from the exchange Bybit, and the FBI attributed the attack to North Korean hackers. Bybit covered the loss from its own funds and borrowing, so customer balances stayed whole. That outcome depended entirely on the exchange’s ability to absorb the hit. A smaller exchange might not have been able to.

3. Your own account is taken over

For reputable exchanges, this is the risk most likely to affect you personally. Attackers steal passwords through phishing, take over phone numbers to intercept SMS codes, or call customers pretending to be the exchange’s security team and persuade them to move funds to a “safe” wallet. In May 2025, Coinbase disclosed that criminals had bribed overseas support staff to obtain customer data, then used it to impersonate Coinbase and trick customers. Passwords, private keys and customer funds held by Coinbase weren’t exposed, and Coinbase said it would reimburse customers who lost money to those scams. The episode shows that your own security habits matter as much as the exchange’s.

4. Your withdrawals are frozen

Exchanges can pause withdrawals during technical problems, heavy market activity or compliance reviews, and they can lock individual accounts while verifying identity or investigating unusual activity. Usually it’s temporary, but you can’t reach your coins until it’s resolved. If it happens to you, exchange withdrawal on hold explains the usual reasons and what to do.

5. Rules and access change

Exchanges sometimes leave a country, stop supporting a coin or change their terms because of new regulation. Customers are normally given time to withdraw, but it can force you to move funds on someone else’s schedule.

What protects you, and what doesn’t

This is where many people get caught out. The protections you’re used to with banks and brokers generally don’t cover crypto:

• Deposit insurance doesn’t cover crypto. In the US, FDIC insurance protects cash deposits at insured banks, not crypto held by an exchange. In the UK, the FSCS doesn’t cover cryptoassets either.
• Brokerage protection doesn’t cover it. SIPC, which protects US brokerage customers when a firm fails, doesn’t protect crypto assets that don’t qualify as securities, even when they’re held at a SIPC-member firm.
• Exchange “insurance” is limited. Some exchanges insure part of the crypto they hold against theft from their own systems. That usually doesn’t cover losses from your account being hacked, and it doesn’t cover the exchange going bankrupt.

What does help:

• Regulation and licensing. In the US, exchanges need state money transmitter licenses and federal registration. In the UK, they must be registered with the FCA. In the EU, they now need authorization under MiCA. Regulated exchanges face rules on customer funds, audits and reporting, which lowers (but doesn’t remove) the risk of fraud.
• Proof of reserves. Some exchanges publish reports showing they hold enough crypto to cover customer balances, often checked by an outside firm. They’re useful, but they’re a snapshot of one moment and don’t always show the exchange’s debts.
• Being a public company. Exchanges listed on a stock market publish audited financial statements, which gives you much more visibility into their health.

How to check an exchange before you trust it

1. Is it regulated where you live? Check the regulator’s public register, not just the exchange’s own claims.
2. How long has it operated, and how did it handle past market crashes?
3. Does it publish proof of reserves or audited financial statements?
4. What do its terms say about customer assets? Look for language saying customer crypto is held separately and isn’t used for the exchange’s own business.
5. Does it offer strong security features, such as authenticator apps, passkeys and withdrawal allowlists?
6. Is it offering yields that look too good? High rates on deposits usually mean your coins are being lent out, which adds risk.

Our comparison of Coinbase vs Kraken applies these checks to two large exchanges, and how to buy crypto safely covers choosing one from scratch.

How to protect what you keep on an exchange

The most important step is replacing SMS codes with an authenticator app or a passkey, because phone numbers can be hijacked. Next is a withdrawal allowlist, which means coins can only be sent to addresses you’ve approved in advance, often with a waiting period for new ones. Even if someone gets into your account, they can’t easily send your coins to themselves.

And remember the rule that defeats most account-takeover scams: an exchange will never call or message you to ask you to move your funds, share a code or install software. If anyone does, hang up and contact the exchange through its official app. More patterns are in 10 common crypto scams.

How much should you keep on an exchange?

A practical rule is to keep on an exchange only what you’d keep in your wallet as cash: money you’re about to trade or spend, or an amount you could lose without serious harm. Everything else, especially anything you plan to hold for years, belongs in a wallet you control.

• Keeping it on the exchange makes sense if you’re still learning, trading regularly, holding a small amount or not yet confident managing a recovery phrase.
• Moving it to your own wallet makes sense once the amount would hurt to lose, or you’re holding for the long term. A hardware wallet is the standard choice: see Ledger vs Trezor and the step-by-step guide to moving crypto from Coinbase to a hardware wallet.

Self-custody has its own risk: if you lose your recovery phrase, nobody can help you. Before moving larger amounts, read how to store a seed phrase safely. For some people, a reputable exchange with strong account security is genuinely safer than a self-custody setup they’re not ready to manage.

Quick answers

Is Coinbase or another big exchange safe?

Large, regulated, publicly listed exchanges are among the safer places to hold crypto that isn’t in your own wallet, and their long-term health is easier to check. But no exchange is risk-free, and your coins aren’t insured like bank deposits.

What happens to my crypto if an exchange goes bankrupt?

It depends on the exchange’s terms and the law where it operates. In the best case, customer assets are held separately and returned. In the worst case, customers become creditors and wait years for partial repayment. That uncertainty is the main reason to limit what you leave on any exchange.

Is a stablecoin on an exchange as safe as cash in a bank?

No. It carries both the exchange’s risk and the stablecoin issuer’s risk, with no deposit insurance. See what a stablecoin is.

Should I spread my crypto across several exchanges?

It reduces the damage if one fails, but it also means more accounts to secure. For long-term holdings, moving funds to your own wallet usually reduces risk more than spreading them between exchanges.

This article is for educational purposes only and isn’t financial or legal advice.