Which exchanges can prove they hold your money?
We grade crypto exchanges A to F on what they can prove: published reserve reports, custody disclosures, licences on public registers, loss cover and their incident record.
15 exchanges graded. Facts last checked against official sources on October 20, 2026.
Highest grade we publish
Kraken
Grade A-
Every exchange gets a seal like this. Each ring is one check, as wide as its weight in the grade. A solid ring is disclosed and checkable, a hatched ring is partial or self-reported, an empty groove is missing.
- Proof of reserves, 30%Disclosed
- Custody, 25%Partial or unaudited
- Regulation, 20%Disclosed
- Insurance, 15%Partial or unaudited
- Incident history, 10%Disclosed
Every exchange we grade
Grouped by grade. Open any exchange for its full report: the findings behind each ring, its licences, fees and sources.
B
- Binance, Grade B-Binance publishes a self-attested proof-of-reserves page and a $1bn SAFU user-protection fund, which covered the May 2019 hot-wallet theft of about 7,000 BTC in full; it settled U.S. Bank Secrecy Act and sanctions charges for $4.3bn in November 2023 and remains under a five-year DOJ compliance monitorship.
- Bitget, Grade B+Bitget publishes a monthly open-source Merkle-tree proof of reserves showing BTC at 138% and ETH at 181%, and cites a protection fund its own sources size differently; ASIC issued an investor alert in July 2025 over unlicensed high-leverage derivatives.
- Bybit, Grade B-Bybit publishes monthly Merkle-tree proof of reserves audited by Hacken OU and holds a partial EU MiCA licence in Austria; it stayed solvent after the February 2025 theft of roughly $1.46–1.5bn — the largest exchange hack on record — replenishing reserves in full within 72 hours.
- Coinbase, Grade BCoinbase is a publicly traded, SEC-reporting U.S. company licensed in 45 states and holding a New York BitLicense, and the SEC's 2023 case against it was dismissed with prejudice in February 2025; it runs no crypto-specific proof-of-reserves programme and its last disclosed crime-insurance figure dates from 2019.
- Crypto.com, Grade B-Crypto.com discloses more than $870m of insurance cover, had its SEC investigation closed with no action in March 2025 and holds a Malta MiCA authorisation; its proof-of-reserves position is contested between our sources, and it reimbursed all users after a January 2022 incident that drained about $34–35m from 483 accounts.
- HTX, Grade BHTX publishes monthly Merkle-tree proof of reserves that excludes corporate holdings, discloses only a Pakistani no-objection certificate among its authorisations, blocked the entire EU rather than seek MiCA licensing, and faces UK FCA High Court proceedings.
- MEXC, Grade B-MEXC publishes a proof-of-reserves page stating a reserve-rate methodology and cites a $100m Guardian Fund through a single source; Estonia's financial intelligence unit revoked its VASP licence in November 2023.
- OKX, Grade BOKX publishes monthly zk-STARK proof of reserves with an open-source verification tool and holds Dubai VARA and Malta MiCA authorisations, but its Seychelles operating entity pleaded guilty in the U.S. in February 2025 and paid over $504m.
C
- Bitstamp, Grade C-Bitstamp was the first crypto-asset service provider licensed under MiCA in Luxembourg and has been owned by Robinhood since June 2025; it custodies with BitGo but publishes neither proof of reserves nor an insurance figure, and lost about 19,000 BTC in a 2015 hot-wallet hack.
- dYdX, Grade CdYdX is a non-custodial perpetuals protocol where balances stay in user-controlled wallets and an on-chain insurance fund is financed by a 1% liquidation fee; it holds no exchange licence in any jurisdiction, and a March 2024 attack cost roughly $9m, about 40% of the v3 insurance fund at the time.
- Gate.io, Grade CGate.io holds a Malta MiCA authorisation and an EU payment-services licence, and has published Merkle-tree plus zk-SNARK proof of reserves with Armanino LLP involved since October 2022, though only its U.S. entity's figures come from a primary source.
- Gemini, Grade CGemini is a New York-chartered trust company available in all 50 states with $100m of disclosed custody insurance, but publishes no exchange-wide proof of reserves and paid a $37m NYDFS penalty in 2024 over its collapsed Earn programme.
- KuCoin, Grade C+KuCoin holds an Austrian FMA MiCAR licence passportable across 29 EEA countries but pleaded guilty in the U.S. in March 2024, paying $297m and accepting a ban since made permanent; its proof-of-reserves position is contested between our sources, and it lost roughly $280m in its September 2020 hack, with users made whole.
How to read these grades: each is derived from published, checkable disclosures — proof-of-reserves attestations, public regulatory registers, disclosed insurance funds and the documented incident record — using the weighted rubric below. Where an exchange does not disclose something, we mark it unverified rather than assume it. These are not audits and not investment advice; they reflect what was published as of our last review.
Exchanges by what you need
Each list applies one stated rule to the checked facts. No exchange pays to be on one, and exchanges graded below C- are never listed.
- Lowest-fee crypto exchangesRule: published base-tier spot taker fee, lowest first; exchanges that hide fees behind login are left out.9 qualify. First: Binance
- Most regulated crypto exchangesRule: confirmed licences and registrations, most first; a licence in one country does not mean access in yours.9 qualify. First: Binance
- Exchanges that publish proof of reservesRule: a published reserves report exists; reserves alone do not show liabilities, so read the grade too.10 qualify. First: Kraken
- Crypto exchanges for beginnersRule: card purchases, a confirmed licence and grade B- or better; ordered by grade.5 qualify. First: Kraken
- Crypto exchanges with P2P tradingRule: a P2P market is listed on the exchange’s own site; P2P adds counterparty and payment-fraud risk, so use escrow and never pay outside it.8 qualify. First: Binance
- Crypto exchanges for US usersRule: a confirmed US licence or registration and no US exclusion in the exchange’s terms; availability still varies by state.4 qualify. First: Kraken
How we grade, and how we earn
The grade
Five checks with fixed weights: proof of reserves 30%, custody 25%, licensing 20%, loss cover 15%, incident record 10%. We read what an exchange publishes and what regulators list, and we record a gap as a gap instead of assuming the best. A grade is not an audit and not a recommendation to use an exchange.
The full methodThe money
KripZen is free to read. Some links to exchanges can be partner links: if you open an account through one, the exchange may pay us a commission. Partner links are labelled where they appear, are never shown where promotion is not allowed, and never change a grade or the order of a list. Advertising is marked as advertising.
Affiliate disclosureCryptocurrency investments carry risk, including loss of principal. Nothing on KripZen is financial advice — always do your own research before buying, trading or moving funds.
The latest failures on record
Hacks, frauds and insolvencies at exchanges and lenders. Each check in the grade exists because one of these showed what its absence costs.
2025
Bybit
Hack, February 2025. ~$1.46B in ETH and staked ETH (publicly reported estimate)
On 21 February 2025 attackers moved roughly $1.46 billion of ether and staked ether out of a Bybit cold wallet by manipulating what signers saw in a Safe multisig interface, so legitimate keyholders approved a transfer that was not what it appeared to be. The FBI attributed the attack to North Korea's Lazarus Group.
2024
DMM Bitcoin
Hack, May 2024. 4,502.9 BTC (~$300m at the time, company-reported)
On 31 May 2024 DMM Bitcoin, a Japanese exchange registered with the Financial Services Agency, reported an unauthorised outflow of 4,502.9 BTC — worth roughly $300m at the time and one of the largest thefts in the country's history. The company said it would procure the equivalent bitcoin with support from the wider DMM group so that customer holdings were fully covered, and Japan's FSA issued a business improvement order. In December 2024 US and Japanese agencies publicly attributed the theft to North Korea-linked actors, and DMM announced it would cease its crypto business and transfer customer accounts to SBI VC Trade.
2023
HTX (formerly Huobi)
Hack, September 2023. ~5,000 ETH (~$8M) taken from a hot wallet (publicly reported estimate)
On 24 September 2023 roughly 5,000 ETH — about $8 million — was taken from a single HTX hot wallet. The exchange identified the attacker, negotiated the return of 95% of the funds and paid the remaining 5% as a white-hat bounty. Customer balances were covered in full.
2022
Celsius Network
Insolvency, June 2022. Withdrawals frozen for roughly $4.7B in customer assets (publicly reported estimate)
The crypto lending platform froze all customer withdrawals during a market downturn and filed for bankruptcy weeks later. Its founder was subsequently charged with, and later pleaded guilty to, fraud for misrepresenting the platform's risk to depositors.
2022
Crypto.com
Hack, January 2022. ~$34M withdrawn from 483 accounts (publicly reported estimate)
On 20 January 2022 roughly $34 million in bitcoin, ether and other assets was withdrawn from 483 Crypto.com customer accounts. The withdrawals were approved without two-factor authentication being properly enforced. The company paused withdrawals, rebuilt the authentication flow, and reimbursed every affected user.
Dates and figures are widely reported public estimates from coverage at the time, not KripZen's own audited data.
Find the page for the question you actually have
The register answers one question well: which exchanges can show what they claim. These are the other questions, and where each one is answered.
- Which of these fifteen, side by sideOne sortable table: order it by grade, or down any single one of the five checks.Exchanges
- What the letter actually meansThe five weighted factors, what each is worth, and why we grade disclosure rather than reputation.Safety grades
- What a trade will really cost meThe comparison lists each exchange’s published base-tier spot fees. Your real cost depends on size, tier and spread, so run your own numbers.Exchange Fee Calculator
- Holding it myself insteadKeys, recovery phrases, and what a custodian controls that you do not — the decision every other one follows from.Guides
- What it looks like when this goes wrongTwenty documented collapses and thefts, each with what it cost and what it changed.Failures