Skip to content
KripZen

Every exchange should have to earn its grade.

One page, five checks: how every exchange we grade scores, the failures that made those checks non-negotiable, and the rubric behind every grade.

Compare all 15 exchangesHow we earn
A-

What we actually check

Every grade on this site comes down to these five factors, weighted as shown. No hidden criteria.

  1. Proof of reserves 30%

    Can the exchange show — not just claim — that it holds what it owes customers, ideally with independent attestation?

  2. Custody 25%

    Is the majority of customer funds held offline in cold storage, with the split disclosed publicly?

  3. Regulation 20%

    Is it licensed by a recognized regulator in the markets it serves, or only registered as a money-services business?

  4. Insurance 15%

    Is there a disclosed insurance fund or third-party coverage against theft and hacks?

  5. Incident history 10%

    Has it avoided major security incidents — or handled one transparently and made customers whole?

Not one exchange we grade clears all five checks. The most common gap is custody: almost none disclose how much of customer funds sits in cold storage.

How we grade

The rubric behind every Safety Grade on this site, and why a paid partnership can't buy a better one.

Every exchange we ever cover — sponsor or not — is scored against the same five factors, weighted the same way. A paid partnership can get an exchange listed faster. It cannot buy a better grade.

  1. Proof of reserves, 30%
  2. Custody, 25%
  3. Regulation, 20%
  4. Insurance, 15%
  5. Incident history, 10%

The grade covers safety only. Fees, licences and products are listed separately in each exchange’s report and never move the grade. Read our full editorial policy

The A–F scale

  • A

    Meets every factor at a high bar: independently verified reserves, disclosed cold-storage custody, real licensing, insurance, and a clean record.

  • B

    Strong on most factors, with at least one gap — usually self-attested reserves or registration instead of full licensing.

  • C

    Average. Some disclosure, but several factors are thin, self-reported, or unverifiable.

  • D

    Multiple real gaps — undisclosed custody, no regulation, no insurance — even without a known incident.

  • F

    Either a confirmed history of major incidents, or enough structural red flags that we can't responsibly recommend it.

What we read, and how fresh it is

Only primary sources: the exchange’s own reserve, legal, fee and terms pages, and the public registers of the regulators that licensed it. Reviews, forums and other rating sites are never a source. Every report lists the pages it was built from.

Facts go stale, so every report carries the date it was last checked, and a fact older than 120 days is re-checked before it is used again. Where an exchange publishes nothing on a check, the report says so; we never fill a gap with an estimate.

How we earn

KripZen is free to read. Some links to exchanges can be partner links: if you open an account through one, the exchange may pay us a commission. Partner links are labelled where they appear, are never shown where promotion is not allowed, and never change a grade or the order of a list. Advertising is marked as advertising.

Partner links are only shown where promoting crypto services is allowed. In the United Kingdom, for example, exchange promotions are switched off entirely. A partner relationship is never a criterion: the five checks and their weights are the same for an exchange that pays us and one that does not.

Where every exchange stands today

The same rules applied to every exchange we grade, best grade first. Each seal opens its full report.

Compare all 15 exchanges

Lessons from crypto's worst exchange failures

Hacks, frauds and insolvencies at exchanges and lenders. Each check in the grade exists because one of these showed what its absence costs.

All 21 incidents

  1. 2025

    Bybit

    Hack, February 2025. ~$1.46B in ETH and staked ETH (publicly reported estimate)

    On 21 February 2025 attackers moved roughly $1.46 billion of ether and staked ether out of a Bybit cold wallet by manipulating what signers saw in a Safe multisig interface, so legitimate keyholders approved a transfer that was not what it appeared to be. The FBI attributed the attack to North Korea's Lazarus Group.

  2. 2024

    DMM Bitcoin

    Hack, May 2024. 4,502.9 BTC (~$300m at the time, company-reported)

    On 31 May 2024 DMM Bitcoin, a Japanese exchange registered with the Financial Services Agency, reported an unauthorised outflow of 4,502.9 BTC — worth roughly $300m at the time and one of the largest thefts in the country's history. The company said it would procure the equivalent bitcoin with support from the wider DMM group so that customer holdings were fully covered, and Japan's FSA issued a business improvement order. In December 2024 US and Japanese agencies publicly attributed the theft to North Korea-linked actors, and DMM announced it would cease its crypto business and transfer customer accounts to SBI VC Trade.

  3. 2023

    HTX (formerly Huobi)

    Hack, September 2023. ~5,000 ETH (~$8M) taken from a hot wallet (publicly reported estimate)

    On 24 September 2023 roughly 5,000 ETH — about $8 million — was taken from a single HTX hot wallet. The exchange identified the attacker, negotiated the return of 95% of the funds and paid the remaining 5% as a white-hat bounty. Customer balances were covered in full.

  4. 2022

    Celsius Network

    Insolvency, June 2022. Withdrawals frozen for roughly $4.7B in customer assets (publicly reported estimate)

    The crypto lending platform froze all customer withdrawals during a market downturn and filed for bankruptcy weeks later. Its founder was subsequently charged with, and later pleaded guilty to, fraud for misrepresenting the platform's risk to depositors.

Dates and figures are widely reported public estimates from coverage at the time, not KripZen's own audited data.

Coin guides

Plain-English risk levels for the assets people ask about most — not investment advice, just what to know before you buy.

Aave AAVEVolatileA decentralised lending protocol where deposits sit in shared pools and borrowers take overcollateralised loans against assets they lock, with interest rates set by how much of a pool is in use.Algorand ALGOVolatileA smart-contract network whose consensus draws a fresh random committee for every block and finalises it on the spot, so the chain never reorganises and confirmations are not a waiting game.Aptos APTVolatileA proof-of-stake layer-1 launched in October 2022 by engineers from Meta's abandoned Diem project, built around the Move programming language and an execution engine that processes independent transactions in parallel rather than one after another.Arbitrum ARBVolatileAn optimistic rollup that executes transactions off the Ethereum main chain and posts the results back to it, so users pay Ethereum-level security costs only once per batch.Avalanche AVAXVolatileA proof-of-stake smart-contract platform designed around fast transaction finality and the ability for projects to run their own separate, application-specific chains.Bitcoin BTCEstablishedThe original cryptocurrency and still the largest by market value, with over fifteen years of continuous operation and no successful attack on its core network.Bitcoin Cash BCHVolatileA network created by a 2017 hard fork of Bitcoin, taking the opposite side of a long argument about whether to scale by enlarging blocks or by moving activity to other layers.BNB BNBVolatileThe token issued by Binance: it discounts trading fees on the exchange and pays transaction costs on BNB Chain, so its usefulness is tied to one company.Cardano ADAVolatileA proof-of-stake smart-contract platform whose development is driven by peer-reviewed academic research, which makes it deliberate and slow-moving by design rather than by accident.Celestia TIAVolatileA network launched in October 2023 that does one job on purpose: it accepts data from other chains, orders it and guarantees it was actually published, leaving execution and settlement to whoever builds on top.Chainlink LINKVolatileA network of independent operators that delivers outside information — most often prices — into smart contracts, which cannot fetch data on their own.Cosmos ATOMVolatileA framework and messaging standard for building independent blockchains that can pass tokens and messages to one another, rather than a single chain that hosts every application.Curve DAO CRVVolatileA decentralised exchange launched in 2020 and specialised in swapping assets that are supposed to trade at the same value — stablecoins, staked and unstaked versions of the same coin — plus a governance token whose influence is bought with time rather than size alone.Dogecoin DOGESpeculativeStarted in 2013 as a joke based on an internet meme, with no roadmap or scarcity mechanism comparable to Bitcoin's — its price is driven almost entirely by sentiment.Ethereum ETHEstablishedThe leading platform for smart contracts and decentralized apps — most of DeFi, NFTs and stablecoin activity runs on it or a network derived from it.Ethereum Classic ETCVolatileThe continuation of the original Ethereum ledger by participants who rejected the 2016 hard fork that reversed The DAO theft, on the principle that a ledger should not be rewritten.Filecoin FILVolatileA network that turns file storage into an open market: clients pay providers to hold data, and providers must keep proving to the chain that the data is still there.Hedera HBARVolatileA public ledger that records transactions in a gossip-based graph rather than a chain of blocks, and whose consensus nodes are run by a defined council of named organisations.Lido DAO LDOVolatileA protocol that pools deposited ether, stakes it through a curated set of node operators, and issues a transferable token that represents the staked position.Litecoin LTCVolatileOne of the oldest surviving cryptocurrencies, launched in 2011 from Bitcoin's codebase with faster blocks and a larger maximum supply.Monero XMRVolatileA network that conceals sender, receiver and amount by default, unlike Bitcoin, where every transaction is permanently public and traceable.NEAR Protocol NEARVolatileA proof-of-stake smart-contract platform that splits its workload across shards and uses readable account names instead of raw hexadecimal addresses.Optimism OPVolatileAn optimistic rollup that executes transactions off Ethereum and settles them there, built on an openly published stack that other networks also run.Polkadot DOTVolatileA network where separate specialised chains connect to a central relay chain and borrow its security instead of each having to recruit validators alone.Polygon POLVolatileA scaling network that processes transactions cheaply alongside Ethereum, aimed at applications for which Ethereum's own fees are prohibitive.Shiba Inu SHIBSpeculativeA meme token launched on Ethereum in 2020 with an extremely large supply, whose price is driven by social attention rather than by any underlying revenue.Solana SOLVolatileA high-throughput blockchain built for speed and low transaction fees, popular for trading apps and consumer-facing crypto products.Stablecoins USDT/USDCIssuer riskTokens designed to track the value of a fiat currency, usually the US dollar — useful for moving value without crypto's usual price swings, but you're trusting the issuer's reserves.Stellar XLMVolatileA payment-focused ledger designed to move value between currencies, where assets other than its native token are issued by named organisations that promise redemption.Sui SUIVolatileA smart-contract network that models state as individually owned objects rather than one global account table, which lets transactions that touch nothing in common be processed at the same time.Tezos XTZVolatileA smart-contract network built so that changes to its own protocol are proposed, voted on and installed by the chain itself, rather than agreed off-chain and shipped as a fork.The Graph GRTVolatileA network that indexes blockchain data into queryable APIs called subgraphs, so applications can ask structured questions instead of scanning every block themselves.Toncoin TONVolatileA smart-contract network whose design splits work across many shards, with contracts communicating by asynchronous messages rather than direct calls within one global state.TRON TRXVolatileA smart-contract network known mainly for cheap, fast stablecoin transfers, secured by a small elected set of validators rather than an open one.Uniswap UNIVolatileThe governance token of one of the largest decentralised exchanges, where trades are executed by smart contracts rather than by a company's order book.VeChain VETVolatileA chain aimed at enterprise record-keeping — product provenance, logistics, certification — built on a two-token model that separates the asset held from the asset spent on fees.Wrapped Bitcoin WBTCIssuer riskAn Ethereum token meant to be backed one-for-one by bitcoin held in custody, so bitcoin can be used inside Ethereum applications.XRP XRPVolatileDesigned for fast, low-cost cross-border settlement, and closely tied to Ripple, the company most associated with promoting it.Zcash ZECVolatileA payments chain that offers two kinds of address — transparent, which behaves like Bitcoin, and shielded, where a zero-knowledge proof validates a transfer without revealing sender, receiver or amount.

Take it further

Run the checks yourself, or look up anything on this page that needs defining.

BriefHow to evaluate an exchange's safetyRun the same five checks yourself, on any exchange, before you deposit.ReferenceThe glossaryPlain-English definitions for the words this brief assumed you knew.