I reviewed Crypto.com on the channel in January 2022, three days before it was hacked. This is the 2026 version, written the way we now write every exchange review: what protects your money, what has actually gone wrong, what users complain about, and one decision the company made that tells you how it thinks. It is for anyone deciding whether to open an account, keep one, or move.

Not a sponsored review. We have no affiliate arrangement with Crypto.com. We are not financial advisers; this is education. Facts were checked on 17 September 2026 against Crypto.com's own pages, regulator registers and press reporting.

Is Crypto.com safe? The short answer

For buying, selling and moving money in and out, yes, with the usual account hygiene. For storing crypto, no, and that is not specific to Crypto.com: any exchange balance is an IOU from a company, and this company is private, unaudited in public, and has shown it will change the rules of its own token when it suits it. Buy, then withdraw to a wallet you control. Our guide on how to use a cold wallet covers the move.

Two-panel record for Crypto.com: protections and licences including MiCA, FCA, MAS, VARA, the CFTC derivatives stack and FDIC pass-through insurance, against incidents and complaints including the 2022 hack, the 2025 CRO re-mint, poor Trustpilot and BBB ratings, and regulatory fines

The left panel is stronger than most competitors can show. The right panel is why we still treat it as a place to transact, not to keep money.

Who is behind it, and where is it regulated?

Crypto.com started in Hong Kong in 2016 as Monaco, rebranded in 2018 and is run from Singapore by co-founder and chief executive Kris Marszalek. The retail app is operated by Foris DAX Asia, part of a Malta-registered group, and the company said it passed 100 million users in 2024. The app and the exchange are separate products: the app is a brokerage with prices that include a spread, the exchange is an order book with maker and taker fees.

The licence list is the strongest part of the case for it, and it is long.

  • A full MiCA licence from Malta's regulator in January 2025, valid across the European Union.
  • UK FCA registration for crypto activities since 2022, with the register noting that the Financial Ombudsman and compensation scheme do not cover it.
  • A Major Payment Institution licence from Singapore's MAS since 2023, and a Dubai VARA licence since 2023 with derivatives added in 2025.
  • In the US, state money transmitter licences, an SEC-registered broker-dealer bought in 2024, and, since September 2025, a full set of CFTC derivatives licences built on its purchase of the Nadex exchange. In February 2026 it received conditional approval for a national trust bank charter covering custody and settlement, not deposits or lending.

In 2024 the SEC sent it a Wells notice; Crypto.com sued, dropped the suit, and in March 2025 the SEC closed the investigation with no action. The regulatory record is not spotless. The Dutch central bank fined it 2.85 million euros in 2023, later reduced on appeal, for operating without registration between 2020 and 2022. And in 2025 it fought and lost against several US state gaming regulators over sports event contracts, withdrawing them from nine states in December; a class action followed in February 2026.

Has Crypto.com been hacked?

Once, seriously. On 17 January 2022 attackers bypassed two-factor authentication on 483 accounts and withdrew about $34 million in Ether, Bitcoin and other coins, as TechCrunch reported. Crypto.com reimbursed every affected user, reset all 2FA, added a 24-hour delay before withdrawals to newly whitelisted addresses, and introduced an account protection programme. That response was better than most exchanges manage, and there has been no comparable incident since.

Two smaller episodes are worth knowing. In 2021 an employee error sent an Australian customer AU$10.5 million instead of a $100 refund, which ended in court and prison for the recipients rather than in any loss to users. And in September 2025 Bloomberg reported that a member of the Scattered Spider group had accessed an employee account in early 2023; Crypto.com said limited personal data for a very small number of users was involved, no funds were at risk, and that reports of a hidden breach were unfounded. Status trackers still log periodic deposit and withdrawal delays, most recently in August 2026.

My January 2022 review, recorded three days before the hack: why I judged the hot and cold wallet policy acceptable and what I said every exchange user should expect on reporting. The user counts and bank details in it are out of date. Watch it on our CryptoTips channel.

What protects your money?

  • Custody. Crypto.com says customer assets are held one-to-one in institutional reserve accounts, but its security page no longer states a cold storage percentage or names its custodian. A 2021 announcement named Ledger Vault and a $750 million insurance programme covering theft and physical damage to custodied assets; whether that figure is current is not stated. Its US custody company has $120 million of cover arranged through Aon since early 2025.
  • Proof of reserves. The company's page still cites an engagement by Mazars from December 2022. No newer independent attestation has been published. Treat "audited reserves" claims from 2023 onward as unverified. Our guide to checking a crypto exchange's safety explains why proof of assets without liabilities is not proof of solvency.
  • Cash. For US residents, dollar balances sit at an FDIC-insured bank with pass-through cover up to $250,000, which protects you if the bank fails, not if Crypto.com does.
  • Account controls. App-based two-factor authentication, mandatory email-verified withdrawal whitelisting, passkeys, and the 24-hour delay on new addresses. Use all of them. Most user losses at any exchange come from phishing, and Crypto.com users are a regular target; our guide to fake crypto support scams shows the scripts.

What do users complain about?

Service. On Trustpilot the platform scores 1.8 out of 5 across more than 9,000 reviews, with 73% one-star; the Better Business Bureau gives its US entity an F with a "pattern of complaints" warning and hundreds of unanswered cases. The themes repeat: accounts locked or restricted without explanation, transfers held for weeks, support that never escalates beyond a bot, and cards that never arrive. The app's pricing is the other complaint: the spread built into app prices is commonly put at half a percent to two percent or more, against the exchange's fee schedule, which is why anyone trading size should use the exchange and not the app.

The company is not short of money on the numbers it publishes: it reported $1.5 billion of revenue and around $300 million of net profit for 2024, though as a private company none of that is audited in public. It cut around 12% of staff in March 2026, citing artificial intelligence.

Why does the CRO re-mint matter?

Because it shows what happens when the company's interests and its token holders' interests diverge. In 2021 Crypto.com burned 70 billion CRO, 70% of the supply, and called it the largest burn in history. In March 2025 it proposed re-issuing exactly those tokens into a "strategic reserve", restoring the 100 billion supply. The community vote passed with 61% in favour only after a last-minute block of votes arrived, and Unchained reported that validators run by Crypto.com control the large majority of voting power while most independent validators voted no.

This was not theft and it was not illegal. It was a company reversing a promise about its own token because it could. If you hold CRO, that is the fact to weigh. If you only use the exchange, it is a signal about governance, and about the partnership with Trump Media announced in 2025, which included a CRO treasury vehicle and was terminated by mutual agreement in August 2026.

Our verdict: how should you use Crypto.com?

As a licensed on-ramp and off-ramp, and as a derivatives venue if you are in a jurisdiction where it is licensed for that. Its regulatory footprint is broader than almost any rival, its one hack was handled well, and its US dollar handling is sound. Against that, customer service is among the worst-rated in the industry, reserves have not been independently attested since 2022, and the CRO decision showed the company will put itself first. So: use the exchange rather than the app for anything beyond small purchases, switch on every account control, and keep nothing there you are not about to trade. We rate it 3.5 out of 5 for safety on that basis. For the wider comparison, our reviews of Kraken and Coinbase versus Kraken apply the same tests. Members can watch balances across exchanges and wallets in the Portfolio Tracker, and the Reviews hub has the rest.

Frequently asked questions

Is Crypto.com regulated?

Yes, in more places than most exchanges. It holds a full MiCA licence from Malta covering the EU, FCA registration in the UK, a Major Payment Institution licence in Singapore, a Dubai VARA licence, US state money transmitter licences, an SEC-registered broker-dealer and a full set of CFTC derivatives licences, plus conditional approval for a US national trust bank charter in February 2026.

Has Crypto.com ever lost customer funds?

In January 2022, attackers bypassed two-factor authentication on 483 accounts and took about $34 million. Crypto.com reimbursed every affected customer, reset all 2FA and added withdrawal delays and an account protection programme. No comparable incident has occurred since. Individual users continue to lose money to phishing, which no exchange can reimburse, so use app-based 2FA and address whitelisting.

Does Crypto.com have proof of reserves?

It published a Merkle-tree proof of reserves with an engagement by the accounting firm Mazars in December 2022, and still offers self-verification against that structure. No newer independent attestation has been published as of September 2026. Proof of reserves shows assets at a moment in time and not liabilities, so even a current one would not prove solvency.

Is Crypto.com safe for storing crypto long term?

No exchange is. A balance on Crypto.com is a claim on a private company, not coins you control, and its reserves have not been independently attested since 2022. Buy there if its licences and pricing suit you, then withdraw to a hardware wallet where you hold the keys. Keep on the exchange only what you intend to trade soon.

Why did Crypto.com re-mint 70 billion CRO?

In March 2025 the company proposed re-issuing the 70 billion CRO it had burned in 2021 into a strategic reserve, citing ecosystem funding and a planned CRO fund. The vote passed with 61% in favour after a late surge of votes, with validators linked to Crypto.com holding most voting power while most independent validators opposed it. It reversed a prior promise, which is the governance signal to weigh.

Is the Crypto.com app or exchange cheaper?

The exchange. App prices include a spread that reviewers commonly put at half a percent to two percent or more, higher on thinly traded coins, while the exchange charges published maker and taker fees. For small purchases the app's convenience may be worth it; for anything larger, trade on the exchange and check the total cost, including withdrawal fees, before you commit.

Keep learning