Is It Safe to Keep Crypto on an Exchange? Risks, Insurance and Safer Options

Keeping crypto on an exchange means the exchange holds your private keys, so your coins are only as safe as that company’s solvency and security. The record shows the risk: FTX lost over $8 billion of customer deposits when it collapsed in November 2022, Celsius froze withdrawals in June 2022 before filing for bankruptcy, and Bybit lost about $1.5 billion in a February 2025 hack. The practical answer is to keep only what you actively trade on an exchange and move the rest to self-custody.

Is it safe to keep crypto on an exchange?

An exchange is convenient but not risk-free for storage. When coins sit on an exchange you hold an account balance, not the private keys, so you depend on that company staying solvent and secure. FTX lost over $8 billion in customer deposits in November 2022, and Bybit lost about $1.5 billion to a hack in February 2025. For funds you trade with regularly this is often acceptable; for long-term savings it is not.

On a crypto exchange you deposit funds, the platform credits your account, and behind the scenes it holds the private keys that control the underlying coins. That is custodial storage, and it is the root of the phrase not your keys, not your coins: if the exchange fails, freezes withdrawals or is hacked, your claim is against the company, not against coins you control. The alternative is self-custody in a wallet, where you hold the keys yourself.

Exchanges are not banks, and none of the safety nets that protect bank deposits apply to crypto held on them. Measure every exchange balance against one question: could you afford to lose access to this amount, or wait years for it, if the exchange failed tomorrow?

What has gone wrong at crypto exchanges?

Exchange failures and hacks have cost customers billions of dollars. FTX collapsed in November 2022 with over $8 billion of customer deposits missing, Celsius froze withdrawals on 12 June 2022 and filed for bankruptcy on 13 July 2022, and Mt. Gox lost about 850,000 bitcoin before shutting down in February 2014. Bybit was hacked for about $1.5 billion on 21 February 2025. The timeline below lists the main events with their sources.

FTX is the defining example. The CFTC says FTX customer assets were routinely held and commingled with funds at Alameda Research, its sister trading firm, and that the conduct caused the loss of over $8 billion in customer deposits. The SEC separately charged FTX’s founder with fraud, alleging customer funds were diverted to venture investments, real estate and political donations. Customers could not withdraw and became creditors in a bankruptcy process.

Celsius was different in structure but similar in outcome. It marketed itself as a safer alternative to a bank while lending out customer deposits; the CFTC says customers deposited roughly $20 billion, and that when Celsius froze withdrawals on 12 June 2022 and filed for bankruptcy on 13 July 2022, its liabilities exceeded its assets by more than $1 billion. Customers became unsecured creditors, not depositors with a guarantee.

Mt. Gox is the cautionary tale for time. The exchange lost about 850,000 bitcoin and shut down in February 2014, yet repayments to creditors only began in July 2024, and the trustee has extended the deadline to 31 October 2027. A decade after the collapse, many creditors are still waiting.

Bybit shows that even a functioning, solvent exchange can be breached. On 21 February 2025 an attacker took control of one of Bybit’s Ethereum cold wallets and moved about $1.5 billion in ETH and related tokens; the FBI attributed the theft to North Korean actors it tracks as TraderTraitor. Bybit said client assets remained backed one-to-one, but the money still had to be recovered or replaced. Read more in our Bybit hack explainer.

Are crypto exchanges insured like banks?

No. Crypto is not covered by bank-style deposit insurance in the United States, and the same principle holds in most of the world. The FDIC lists crypto assets among the products its insurance does not cover, and SIPC says it does not protect digital asset securities. Some exchanges carry private crime insurance, but that is a commercial policy, not a government guarantee, and it does not turn an exchange into an insured bank.

The FDIC insures deposit accounts such as checking and savings at insured banks up to $250,000 per depositor, but it explicitly excludes crypto assets from that cover. SIPC protects cash and securities at member brokerages, yet states it does not protect digital asset securities that are investment contracts not registered with the SEC, even if held at a member firm. Kraken’s support article puts it plainly: exchanges are not eligible for deposit insurance programmes because they are not savings institutions.

Some exchanges buy commercial crime insurance, which may cover theft from the exchange’s own systems. This is a private policy with its own limits and exclusions, not a state backstop. In the European Union, regulation has moved in a different direction: MiCA now requires authorised crypto-asset service providers to safeguard client assets. See our guide to MiCA-regulated exchanges in Europe.

What does proof of reserves actually prove?

Less than the name suggests. A proof of reserves shows that, at one moment, an exchange controlled a stated amount of crypto, but it does not show what the exchange owes or whether it is solvent. Kraken’s own page warns that the check is point-in-time, cannot prove exclusive control of the private keys, and cannot identify hidden liabilities or borrowed funds. Treat it as one signal, not a solvency guarantee.

Kraken’s proof of reserves page is a useful live example. As of the 30 June 2026 snapshot it reported ratios of 102.9% for BTC and 100.5% for ETH, meaning the exchange says it held slightly more of those assets than client balances at that moment. The same page is explicit about the limits: it cannot prove exclusive possession of private keys, it cannot detect hidden liabilities, and it cannot prove funds were not borrowed to pass the check.

That is why a proof of reserves is weaker than a bank’s audited balance sheet or a deposit-insurance scheme. It answers one narrow question, does the exchange hold these coins right now, and says nothing about who else has a claim on them or what happens next week. When you evaluate an exchange such as Kraken or Binance, weigh its proof of reserves alongside its licences, history and custody practices.

Should I keep my crypto in a wallet or on an exchange?

It depends on the amount and how often you trade. For crypto you trade regularly, an exchange is convenient and lets you recover the account if you lose your password. For savings you plan to hold for months or years, self-custody in a software or hardware wallet is safer because you, not a company, hold the keys. The table below compares the three options.

Software wallets such as Electrum keep keys on an internet-connected device, which is convenient but exposed to malware and phishing. Hardware wallets such as the Ledger Nano S keep keys on an offline device, which is more secure for long-term storage but adds a purchase cost and a physical device to protect. Whichever you choose, the backup phrase is the real key: anyone who has it can spend the funds, so store it offline and never share it.

If you decide to move coins off an exchange, follow our step-by-step guide on how to move crypto from an exchange to a wallet, and always test with a small amount first.

When is it reasonable to keep some crypto on an exchange?

Keeping a small working balance on a reputable exchange is reasonable when you trade actively or use exchange features such as recurring buys, limit orders or staking. Treat it like a wallet you carry rather than a safe: only what you expect to use soon. Long-term savings belong in self-custody, because an exchange can freeze withdrawals or fail with little warning, as Celsius showed in June 2022.

Active traders need funds on the exchange to place orders quickly, and exchanges remain the main way to convert between fiat currency and crypto. If you trade often, a balance on a well-established exchange such as Kraken is a practical trade-off. Just keep it proportional to your trading needs, and remember that availability varies by region: for example, Binance does not serve US residents, and Binance.US is a separate company. Check our exchange hub to compare licences, fees and availability.

The danger is drift. Many people leave more on an exchange than they intended simply because it is easy, and that balance becomes an uninsured claim on a company. A useful habit is to sweep anything you will not touch for a month into a wallet, and to revisit the split whenever your balance grows.

What should users do now?

Keep only what you actively trade on an exchange, and move the rest to a wallet you control. Enable two-factor authentication and a withdrawal allowlist on any exchange account, and store a hardware wallet’s seed phrase offline where no one else can find it. Check that the exchange is licensed where you live, for example under MiCA in the EU, and treat proof of reserves as one signal, not a guarantee.

1. Split your funds: keep a trading balance on the exchange and move savings into self-custody.
2. Choose a wallet to match the amount: a hardware wallet for large holdings, a software wallet for smaller everyday use.
3. Move funds in stages and test with a small amount first, using our guide on moving crypto off an exchange.
4. Secure the exchange account with two-factor authentication, ideally a hardware key or authenticator app, and turn on any withdrawal allowlist.
5. Write the seed phrase on paper, store it offline in a safe place, and never share it, photograph it or type it into a website.
6. Verify the exchange is registered where you live, for example on the ESMA MiCA register, and read our reviews of Kraken and Binance.
7. Watch for phishing: download wallets only from the official vendor site and check any message claiming to be from an exchange or wallet provider.

Crypto assets are volatile, and this article is not financial advice. The custody decision, however, is mostly a security question with a clear answer: the less crypto you leave in someone else’s hands, the less you can lose to their failure.