Rating report
HTX
Grade B, 3.7 out of 5
HTX publishes monthly Merkle-tree proof of reserves that excludes corporate holdings, discloses only a Pakistani no-objection certificate among its authorisations, blocked the entire EU rather than seek MiCA licensing, and faces UK FCA High Court proceedings.
By Safety Desk. Facts checked against official sources on .
Findings, check by check
Every KripZen grade comes from the same five weighted checks. Here is how HTX scores on each.
Proof of reserves 30%
Monthly Merkle-tree proof of reserves, a run of 36 consecutive months as of October 2025 and most recently published July 2026; corporate holdings are excluded from the proof.
What “Proof of reserves” meansDisclosed
Custody 25%
Cold storage is described by third-party reviewers as air-gapped with hardware security modules and multi-signature controls, but no cold/hot split is disclosed and we could not confirm one from a primary source.
What “Custody” meansPartial or unaudited
Regulation 20%
Only a Pakistan PVARA no-objection certificate was confirmed among its listed authorisations; it holds no MiCA or UK authorisation and blocked the entire European Union from 1 July 2026 rather than seek one. The UK FCA began High Court proceedings against Huobi Global S.A. on 21 October 2025 over illegal financial promotions.
What “Regulation” meansPartial or unaudited
Insurance 15%
No insurance or safety-fund figure is publicly confirmed. That is a disclosure gap rather than confirmation that none exists.
Partial or unaudited
Incident history 10%
About $7.9–8m (5,000 ETH) stolen in September 2023; roughly 95% was recovered by negotiation with the attacker, with a 5% white-hat bounty paid and no user losses reported.
Partial or unaudited
The weights are the same for every exchange. Read the full methodology
Fees, products and reach
- Spot fees (base tier)
- Not published openly
- Proof of reserves
- PublishedLatest report seen: 2025-12-09
- Products
- Spot, Futures, P2P, Card purchases
- Founded
- 2013
- Not offered under its own terms in
- China, United States, Cuba, Iran, North Korea, Sudan, Syria, Venezuela, Hong Kong, United Kingdom, Singapore, Myanmar (Burma), Russia, Austria, Belgium, Bulgaria, Croatia, Cyprus, Czechia, Denmark, Estonia, Finland, France, Germany, Greece, Hungary, Ireland, Italy, Latvia, Lithuania, Luxembourg, Malta, Netherlands, Poland, Portugal, Romania, Slovakia, Slovenia, Spain, Sweden
Base-tier fees from the exchange’s own fee page. Your real cost depends on order type, volume tier and spread; try your numbers in the Exchange Fee Calculator
Our HTX review
HTX publishes one of the longest unbroken reserve-proof records in this corpus and holds almost no authorisation we could confirm. The B rests almost entirely on the first of those.
What checks out
Merkle-tree proof of reserves is published monthly, a run of 36 consecutive months as of October 2025 and most recently published in July 2026. Consistency over that span is itself evidence — a programme that survives three years of market conditions is harder to stage than a single snapshot. Note one limit stated in the proof itself: corporate holdings are excluded, so what is being proved is customer-side coverage, not the company's whole balance sheet.
Where the evidence stops
Among all the authorisations HTX lists, only a Pakistan PVARA no-objection certificate was confirmed. It holds no MiCA and no UK authorisation, and rather than seek one it blocked the entire European Union from 1 July 2026 — a decision that removes the question rather than answering it. The UK FCA began High Court proceedings against Huobi Global S.A. on 21 October 2025 over illegal financial promotions. No insurance or safety-fund figure is publicly confirmed, which is a disclosure gap rather than a finding that none exists. Third-party reviewers describe cold storage as air-gapped with hardware security modules and multi-signature controls, but no cold/hot split is disclosed and we could not confirm one at source. About $7.9–8m, or 5,000 ETH, was stolen in September 2023; roughly 95% was recovered by negotiating with the attacker, a 5% white-hat bounty was paid, and no user losses were reported.
How to read the grade
You can check what HTX says it holds. You cannot, in most of the world, check who is allowed to hold it. If your jurisdiction matters to you, that gap is the whole review.
Incidents on record
2023
HTX (formerly Huobi)
Hack, September 2023. ~5,000 ETH (~$8M) taken from a hot wallet (publicly reported estimate)
On 24 September 2023 roughly 5,000 ETH — about $8 million — was taken from a single HTX hot wallet. The exchange identified the attacker, negotiated the return of 95% of the funds and paid the remaining 5% as a white-hat bounty. Customer balances were covered in full.
The lesson: Negotiating money back worked because the amount was small and the trail was public. That is an outcome, not a security control — no exchange can promise you the next attacker will take the deal.
Dates and figures are widely reported public estimates from coverage at the time, not KripZen's own audited data.
Sources
Every fact on this page comes from one of these official pages, checked on October 20, 2026.
Where to go next
Other exchanges we've graded
How to read these grades: each is derived from published, checkable disclosures — proof-of-reserves attestations, public regulatory registers, disclosed insurance funds and the documented incident record — using the weighted rubric below. Where an exchange does not disclose something, we mark it unverified rather than assume it. These are not audits and not investment advice; they reflect what was published as of our last review. Cryptocurrency investments carry risk, including loss of principal. Nothing on KripZen is financial advice — always do your own research before buying, trading or moving funds.