Rating report

Crypto.com

Name: Crypto.com Review
Rating: 3.3

Grade B-, 3.3 out of 5

Crypto.com discloses more than $870m of insurance cover, had its SEC investigation closed with no action in March 2025 and holds a Malta MiCA authorisation; its proof-of-reserves position is contested between our sources, and it reimbursed all users after a January 2022 incident that drained about $34–35m from 483 accounts.

By Safety Desk. Facts checked against official sources on October 20, 2026.

Findings, check by check

Every KripZen grade comes from the same five weighted checks. Here is how Crypto.com scores on each.

Proof of reserves 30%
Our two sources conflict: one records a published proof-of-reserves portal, the other found no exchange-wide programme. No methodology, auditor or reserve figure was confirmed either way.
What “Proof of reserves” means
Partial or unaudited
Custody 25%
Cold-storage assets sit with custodial partner Ledger Vault, but the cold/hot storage split is not disclosed and we could not confirm it from a primary source.
What “Custody” means
Partial or unaudited
Regulation 20%
Malta MFSA MiCA CASP authorisation granted 27 January 2025 covering 6 of the 10 service categories, plus an EU Limited Financial Institution licence from 27 February 2026 for stablecoin services, and licences listed across Singapore, Canada, the UK, Australia, Hong Kong, Brazil and the U.S. without registration numbers we could check against public registers. The SEC closed its investigation with no enforcement action on 27 March 2025.
What “Regulation” means
Partial or unaudited
Insurance 15%
More than $870m of disclosed cover: $750m on cold-storage assets through custodial partner Ledger Vault, expanded September 2021, plus $120m of institutional custody insurance arranged through Aon and announced 25 June 2025. U.S. fiat balances are held at FDIC-insured Community Federal Savings Bank.
Disclosed
Incident history 10%
About $34–35m taken from 483 accounts in January 2022 through a 2FA compromise; Crypto.com disclosed the breach publicly and fully reimbursed all affected users.
Partial or unaudited

The weights are the same for every exchange. Read the full methodology

Licences and registrations

The 7 entries we could confirm for Crypto.com on a regulator’s register or the exchange’s own legal pages. A licence in one country does not mean the service is open to you.

Regulator	Licence or registration	Register number
Malta Financial Services Authority (MFSA)Malta	MiCA CASP authorisation (announced 2025-01-27) Foris DAX MT Limited	Not published
FINTRACCanada	money services business registration	Not published
United Kingdom	crypto-asset business registration (per Crypto.com licences page)	Not published
Singapore	major payment institution licence	Not published
Australia	digital currency exchange provider registration and financial services licence	Not published
SFCHong Kong	virtual asset trading platform licence (deemed licence status)	Not published
United Arab Emirates	ADGM Category 3A; Dubai VASP licence	Not published

Fees, products and reach

Spot fees (base tier): 0.25% maker, 0.5% takerExchange Level 1 (<$10,000 30d spot volume), without CRO balance; 3% off with CRO
Proof of reserves: PublishedLatest report seen: 2022-12-07
Products: Spot, Futures, Staking, Card purchases
Founded: 2016
Not offered under its own terms in: Afghanistan, Algeria, Andorra, Bangladesh, Belarus, Benin, Bolivia, Botswana, Burkina Faso, Myanmar (Burma), Burundi, Central African Republic, Chad, China, Comoros, Congo - Kinshasa, Congo - Brazzaville, Cook Islands, Cuba, Djibouti, Dominica, Equatorial Guinea, Eritrea, Ethiopia, Gabon, Gambia, Guinea, Guinea-Bissau, Guyana, Haiti, Indonesia, Iran, Iraq, Kiribati, North Korea, Kyrgyzstan, Lebanon, Lesotho, Libya, Macao, Malawi, Mali, Marshall Islands, Mayotte, Micronesia, Montserrat, Mozambique, Namibia, Nauru, Nepal, Palau, Palestine, Russia, St. Helena, Samoa, Sierra Leone, Somalia, Sudan, Suriname, Eswatini, Syria, Tajikistan, Tanzania, Togo, Tonga, Tuvalu, Venezuela, Wallis & Futuna, Western Sahara, Yemen, Zimbabwe

Base-tier fees from the exchange’s own fee page. Your real cost depends on order type, volume tier and spread; try your numbers in the Exchange Fee Calculator

Our Crypto.com review

Crypto.com discloses more insurance cover than any other venue in this corpus and cannot tell us, clearly, whether it publishes proof of reserves. A B- is the arithmetic of a strong insurance factor against four unresolved ones.

What checks out

Insurance is the standout. More than $870m of cover is disclosed: $750m on cold-storage assets through custodial partner Ledger Vault, expanded in September 2021, plus $120m of institutional custody insurance arranged through Aon and announced on 25 June 2025. U.S. fiat balances sit at FDIC-insured Community Federal Savings Bank. On the regulatory side, the Malta MFSA granted a MiCA CASP authorisation on 27 January 2025 covering 6 of the 10 service categories, followed by an EU Limited Financial Institution licence from 27 February 2026 for stablecoin services, and the SEC closed its investigation with no enforcement action on 27 March 2025.

Where the evidence stops

Our two sources contradict each other on proof of reserves — one records a published portal, the other found no exchange-wide programme, and no methodology, auditor or reserve figure was confirmed either way. That is the heaviest factor on the rubric and we cannot resolve it, so we do not score it as passed. Cold-storage assets sit with Ledger Vault, but the cold/hot split itself is undisclosed. The licences listed across Singapore, Canada, the UK, Australia, Hong Kong, Brazil and the U.S. come without registration numbers we could check against public registers. In January 2022 roughly $34–35m was taken from 483 accounts through a 2FA compromise; Crypto.com disclosed the breach publicly and fully reimbursed everyone affected.

How to read the grade

This is a venue that has shown it will pay a loss and has not shown what it holds. The insurance is real and specific; the reserves are the part you would want to check first, and it is the part you cannot.

Incidents on record

2022
Crypto.com
Hack, January 2022. ~$34M withdrawn from 483 accounts (publicly reported estimate)
On 20 January 2022 roughly $34 million in bitcoin, ether and other assets was withdrawn from 483 Crypto.com customer accounts. The withdrawals were approved without two-factor authentication being properly enforced. The company paused withdrawals, rebuilt the authentication flow, and reimbursed every affected user.
The lesson: Two-factor authentication only protects you where the platform actually enforces it. The control existed here; the gap in enforcing it on the withdrawal path is what cost money.

Dates and figures are widely reported public estimates from coverage at the time, not KripZen's own audited data.

Sources

Every fact on this page comes from one of these official pages, checked on October 20, 2026.

Where to go next

Other exchanges we've graded

How to read these grades: each is derived from published, checkable disclosures — proof-of-reserves attestations, public regulatory registers, disclosed insurance funds and the documented incident record — using the weighted rubric below. Where an exchange does not disclose something, we mark it unverified rather than assume it. These are not audits and not investment advice; they reflect what was published as of our last review. Cryptocurrency investments carry risk, including loss of principal. Nothing on KripZen is financial advice — always do your own research before buying, trading or moving funds.