Every week someone asks whether a particular exchange or wallet is safe. The honest answer is never a straight yes, because "safe" depends on what you are protecting against. This is the framework we apply to every platform we review, so you can run it yourself on anything we have not covered.
Why "is it safe" is the wrong question on its own
It collapses two very different risks into one word. The first is whether the platform gets hacked or goes under. The second is whether you lose access through a mistake, a scam or a lost key. Most losses in crypto are the second kind, and no platform can fix that for you.
There is also a distinction people miss constantly. An exchange is a custodian: it holds your coins and you hold a claim. A self-custody wallet holds nothing; it manages the key that controls coins on a blockchain. So "is Kraken safe" and "is Exodus safe" are not the same question. One asks whether a company will still have your money next year. The other asks whether a piece of software will leak your key.
Ask the sharper version instead: safe for how much, for how long, and against which failure?
What are the eight checks?
These are what we work through for every platform, in roughly the order that matters.
| # | Check | What a good answer looks like |
|---|---|---|
| 1 | Custody model | Who holds the keys, stated plainly. What share sits in cold storage, and is it segregated from company funds |
| 2 | Security track record | Years operating, breaches suffered, and crucially whether customers were made whole |
| 3 | Proof of reserves | Published regularly, verifiable by you, ideally including liabilities rather than assets alone |
| 4 | Regulation and licensing | Registered where you live, with the licence number checkable on the regulator's own register |
| 5 | Insurance | What is actually covered. Crime insurance on hot wallets is normal; a guarantee against all loss is not |
| 6 | Transparency | Named leadership, a real address, clear terms. Anonymous teams running custodial platforms is a hard no |
| 7 | Account controls | Hardware key two-factor, withdrawal allowlists, anti-phishing codes, time locks on new addresses |
| 8 | Jurisdiction and exit | Where it is incorporated, whether you can actually withdraw to your own wallet, and how fast |
A platform failing one of these is not automatically disqualified. A platform that will not answer several of them has told you what you need to know.
How do you check a security track record?
Search the platform's name alongside "hack", "breach" and "outage" and read past the first page. What matters is not whether something went wrong, because at sufficient scale something always has. What matters is the response: did they disclose it quickly, did they explain the cause, and did users get their money back.
Kraken has operated since 2011 without a breach costing customers funds, which is the strongest record in the sector; we go through the detail in is Kraken safe. Coinbase is publicly listed and files audited accounts, which is a different but real form of accountability, covered in is Coinbase safe for beginners. Compare that with platforms that went down owing customers money and never explained why, and the pattern is not subtle.
Age alone is weak evidence. FTX was four years old, widely used and endorsed by serious investors when it collapsed. Track record means disclosed incidents handled well, not an absence of news.
What does proof of reserves actually prove?
Less than most people assume, and it is still worth demanding. A proof of reserves shows that an exchange controlled certain assets at a moment in time, usually by publishing a cryptographic tree you can check your own balance against.
What it does not show, unless liabilities are included, is whether those assets exceed what the exchange owes. An exchange can borrow coins, prove reserves, and return them the next day. A proof of reserves with attested liabilities is meaningfully stronger, and rarer.
Treat regular publication as a good signal, treat refusal as a serious one, and remember that a snapshot is a photograph rather than a guarantee. The same logic applies to stablecoin attestations, which we cover in what a stablecoin is.
How do you judge a wallet instead of an exchange?
Different questions entirely, because there is no company holding your money. Five things matter.
- Is the code open source? Open code can be audited by anyone. Closed code asks you to trust the vendor. Exodus is closed source and still reasonable for everyday amounts, which we explain in is Exodus wallet safe.
- Where does the key live? On your device, encrypted, never transmitted. A wallet that can recover your funds for you is not a self-custody wallet.
- Has it been audited, and were findings published? An audit nobody can read is marketing.
- Hot or cold? An internet-connected wallet is fine for spending money and wrong for savings. See cold versus hot wallets.
- For hardware, what is the chip and the firmware policy? Secure element, open firmware, verified boot. We compare the two main options in Trezor versus Ledger, and review the latest device in the Trezor Safe 7 review.
Browser extension wallets sit in their own category, since they combine key management with a permissions system most people never review. That is covered in is MetaMask safe and, for the attack it enables, token approval phishing.
How do you check a licence is real?
Go to the regulator, not the platform. Every serious regulator publishes a public register you can search by company name or licence number, such as the FCA register in the UK or the SEC's check tool in the US, and a legitimate firm will give you both without hesitation.
Three things to look for once you find the entry. Does the registered company name match the entity in the platform's terms of service, which is often different from the brand name? Does the permission actually cover what you are doing, since many crypto firms are registered only for anti-money-laundering purposes rather than authorised to hold client money? And is the registration current rather than lapsed or withdrawn?
A claimed licence that does not appear on the register is not an administrative oversight. It is the most common single lie told by fraudulent platforms, precisely because most people never check.
What about a newer platform with no track record?
Absence of history is not evidence of danger, but it does change what you can rely on. With an established platform you can judge behaviour under stress. With a new one you are judging design and incentives instead.
Weight the checks differently: transparency of the team matters much more, custody arrangements matter more, and the quality of the terms of service matters more, because that document tells you what happens to your assets if the company fails. Reduce position size accordingly and treat the first withdrawal as a test rather than a formality.
The same reasoning applies to new tokens and projects rather than platforms, where the research framework in how to DYOR is the right tool, and to newer networks generally, as in our Kaspa review and ICP review.
What are the red flags?
Any one of these is enough to walk away.
- Guaranteed or fixed returns on a volatile asset. There is no such thing.
- An anonymous team running a custodial product.
- Withdrawals that are slow, throttled, or require a fee or a deposit before they are released. This is the single most reliable sign of an insolvent or fraudulent platform.
- Pressure to deposit quickly, or a "manager" assigned to help you.
- A licence claimed but not findable on the regulator's own register.
- Referral rewards that scale with recruitment rather than with usage.
The withdrawal one deserves emphasis. Platforms almost never announce failure; they slow withdrawals first. If getting your own money out is difficult, the answer to "is it safe" is already no. Related patterns are in spotting crypto scams and fake support scams.
How much should you keep on a platform?
A working rule that has held through several exchange failures: keep on an exchange only what you are actively trading or about to spend, and hold the rest in self-custody. The question is not whether an exchange is trustworthy today but whether you would accept losing that balance if it were not.
In practice that means using an exchange as a bureau de change rather than a bank. Buy, withdraw, hold your own keys. If the amount is small enough that a hardware wallet feels like overkill, it is also small enough that the platform's failure would not hurt much, and either choice is defensible. Above that, self-custody, with the setup covered in crypto wallets for beginners and the succession side in crypto inheritance.
This is educational information, not financial advice. No platform is risk-free and this framework reduces risk rather than removing it.
The checklist
- Am I asking about custody risk, security risk, or my own operational risk?
- Who holds the keys, and is that stated clearly?
- How long has it operated, and how were past incidents handled?
- Is there a proof of reserves, and does it include liabilities?
- Is it licensed where I live, and does the register confirm it?
- What does the insurance actually cover?
- Is the team named and the company traceable?
- Can I enable hardware two-factor and a withdrawal allowlist?
- Have I tested a small withdrawal to my own wallet?
- Would I be all right if this balance disappeared tomorrow?
If you want a second opinion on a specific platform, members can ask Ask Crypto AI privately. There is more on protecting what you hold in our scams and risk hub.
Frequently asked questions
How do I know if a crypto exchange is safe?
Work through custody model, security track record, proof of reserves, licensing, insurance, transparency and account controls. The strongest single signal is whether withdrawals work quickly and without obstruction, because struggling platforms restrict withdrawals before they announce anything. Test with a small withdrawal to your own wallet before committing a meaningful balance.
Is it safer to keep crypto on an exchange or in a wallet?
A self-custody wallet is safer against platform failure, which is the risk that has destroyed the most value historically. An exchange is safer against your own mistakes, since it can help with a forgotten password. The usual answer is both: trade on an exchange, hold long-term savings in self-custody.
What is proof of reserves?
A published cryptographic record showing an exchange controlled certain assets at a point in time, usually letting you verify your own balance is included. It is a good signal but limited: unless liabilities are attested too, it cannot show whether assets exceed what the exchange owes customers.
Does a crypto exchange being regulated mean my money is protected?
Not in the way bank regulation protects deposits. Licensing usually imposes anti-money-laundering duties, reporting and sometimes custody requirements, but crypto balances rarely carry deposit insurance. Check what the specific licence covers on the regulator's own register rather than trusting a badge on the website.
What is the biggest red flag on a crypto platform?
Difficulty withdrawing your own funds. Fees to release a withdrawal, sudden verification demands after you request one, or unexplained delays are the most reliable indicator of an insolvent or fraudulent operation. Guaranteed returns and anonymous teams running custodial products are close behind.
Are hardware wallets completely safe?
They remove the largest risk, which is your key being exposed on an internet-connected device, but they do not make you immune. A hardware wallet will still sign a malicious transaction if you approve it, and it cannot help if your recovery phrase is lost or shared. It protects the key, not your judgement.
