How to Evaluate a Crypto Exchange Before You Deposit

The four questions before you deposit anywhere

In 2022 the exchange FTX and the crypto lending platforms Celsius, BlockFi, Voyager and Genesis all froze withdrawals or filed for bankruptcy. They taught the same lesson five times: a platform that "looks safe" because it has billions in declared deposits and a celebrity-endorsed marketing campaign can still become insolvent, and fast. The defensive question is not whether an exchange might fail (every exchange might) but whether the structural protections against that failure are in place.

Before depositing on any crypto exchange, run four questions. If any answer is unclear, the exchange does not pass.

Who regulates the exchange, and what do they actually require?
Does the exchange publish proof of reserves, and is it real?
What happens to my funds if the exchange becomes insolvent?
What is the withdrawal speed under stress, not advertised conditions?

The rest of this guide walks through each question with specifics, examples, and the failure cases that motivated each defensive layer.

Question one: who regulates it

For US-based holders, the meaningful regulators are: the SEC (securities classification), the CFTC (commodities, including most non-stablecoin crypto futures), FinCEN (anti-money-laundering compliance), and state-level money transmitter licenses (NYDFS BitLicense, California DFPI, others).

Platforms that operate in the US under state or federal licenses are subject to the corresponding state and federal oversight. How much regulatory recourse you actually have depends on each platform's license scope and its own disclosures, so read those before depositing. State money transmitter licenses can be looked up on NMLS Consumer Access.

Offshore exchanges — KuCoin, Bybit, OKX (outside their narrow US-restricted product), Bitfinex, Huobi — operate under various non-US jurisdictions. They may be perfectly well-run businesses, but as a US holder you have no regulatory recourse, no FDIC-equivalent protection, no SEC oversight, and limited ability to invoke US law if the exchange freezes your funds or refuses to release them. The 2024 KuCoin enforcement action — DOJ pursuing the company for failure to register as a money services business — illustrates the structural issue: US users on offshore exchanges may find their accounts frozen by their own government as the offshore exchange tries to come into compliance.

The practical rule: keep the bulk of your fiat-on-ramp and fiat-off-ramp activity on US-licensed exchanges. Use offshore exchanges only for specific products unavailable in the US (certain altcoin trading, certain derivatives), and only with funds you can afford to have frozen for an extended period.

Question two: proof of reserves

After FTX, every major exchange announced a "proof of reserves" program. Not all of them mean the same thing.

The strongest version: Merkle-tree proof of reserves. The exchange publishes a cryptographic structure showing every customer's balance (anonymized but verifiable) and the on-chain addresses holding the corresponding assets. Each customer can independently verify that their balance is included in the tree, and an auditor can verify that the on-chain balances match the sum of customer balances. Kraken pioneered this in 2014; Binance global publishes monthly Merkle proofs. Do not confuse this with audited financials: Coinbase, as a public company, files financial statements with the SEC, with an independent audit on the annual report. That tells you about the health of the company, but it is not proof of reserves — no customer can use it to check that their own balance is covered.

The medium version: an audited attestation from a public accounting firm stating that, as of a snapshot date, the exchange's on-chain holdings equal or exceed their customer liabilities. This is weaker because it does not let individual customers verify their inclusion, and the snapshot is a single point in time. Several mid-size exchanges publish this.

The weakest version: a marketing-grade statement that "we hold customer funds in segregated wallets" without any cryptographic proof, third-party audit, or independent verification. This is what FTX published before collapsing. Treat this tier as no proof at all.

The check to actually run: before depositing on any exchange, find their most recent proof-of-reserves report. Verify it is dated within the last 90 days. Read what the audit firm actually attested (not what the exchange's blog summarizes). If the report does not exist, is older than 90 days, or comes from an unknown audit firm, treat the exchange as untested.

Question three: what happens if the exchange becomes insolvent

The US framework for crypto exchange insolvency is unsettled. Crypto held on a regulated exchange is typically classified as either: (a) customer property that segregates from the exchange's general assets in bankruptcy, or (b) a general unsecured creditor claim, which means customers stand in line behind banks, employees, and tax authorities.

The Voyager and Celsius bankruptcies (2022-2023) made this question concrete. Customers ended up with partial recoveries, with the rest lost or tied up in litigation. Even that partial recovery happened only because both bankruptcies still had assets to distribute. FTX is the harder case: according to The New York Times, FTX's accounts had a hole of about $8 billion, and what customers got back depended on years of asset clawback by the bankruptcy estate.

The structural protections an exchange can offer:

Customer fund segregation. Customer funds held in trust accounts legally distinct from the exchange's general operating capital. New York-licensed exchanges (Gemini, Coinbase NY operations) operate under explicit fund-segregation rules.
FDIC-insured fiat sweep. Dollar balances swept into FDIC-insured bank accounts at partner banks, with the FDIC's $250,000 per depositor protection extending to the exchange customer. Coinbase USD balances are FDIC-insured through this mechanism.
Crime insurance on crypto reserves. Not the same as FDIC. Some exchanges (Coinbase, Gemini) carry policies against theft of cold-storage holdings. This does not protect against exchange insolvency or fraud by exchange employees — only third-party theft.

The practical rule: keep no more on any single exchange than you would tolerate losing entirely. For most holders, that is a working float of a few thousand dollars for tax-event timing, swap liquidity, and gas purchases — not the bulk of holdings.

Question four: withdrawal speed under stress

Every exchange advertises fast withdrawals during normal operation. The question that matters is withdrawal speed during stress: market volatility, regulatory action, a bank-run scenario where many customers try to withdraw simultaneously.

The historical reference points:

FTX, November 2022: withdrawals were paused after the Alameda-related rumors started. Customers who got their withdrawals out before the pause were fine; customers who were still waiting ended up in the bankruptcy process.
BlockFi, November 2022: paused withdrawals after the FTX collapse, then entered bankruptcy proceedings. Customer funds stayed frozen while the bankruptcy process ran.
Celsius, June 2022: paused withdrawals citing "extreme market conditions." Never resumed. Bankruptcy filed July 2022.
Mt. Gox, 2014: withdrawals slowed in early 2014, then paused entirely in February. Customers waited 10+ years for partial recovery through the Japanese rehabilitation process.

The pattern: the exchange pauses withdrawals "temporarily" citing operational reasons. The pause becomes permanent. Customers who withdrew before the pause are fine; customers who waited are not.

The defensive behavior: when an exchange starts showing stress signals — unusual social-media activity from leadership, rumored counterparty exposure, surge in withdrawal-request times — initiate withdrawals immediately. Do not wait to see if the situation resolves. The cost of being wrong about a false alarm is a network fee; the cost of being right and waiting is the entire deposit.

The signals that an exchange is in trouble

The early-warning signs to watch:

Withdrawal delays. If a withdrawal you initiated 12 hours ago is "processing," something is off. Reach out to support, screenshot the response, initiate the rest of your withdrawal queue.
Leadership social-media activity. CEOs of healthy exchanges tweet about products and roadmap. CEOs of stressed exchanges suddenly tweet about "FUD," "concentrated attacks by competitors," or "irresponsible journalism."
Counterparty rumors. If credible journalists or on-chain analysts (Whale Alert, ZachXBT, Coinage) flag suspicious flows between the exchange and a known-distressed counterparty, treat the rumor as actionable.
Stablecoin redemption issues. If the exchange's native stablecoin or token loses its peg or normal trading range, the exchange's solvency is in question.
Sudden leadership changes. A surprise CEO transition, a "personal reasons" departure, or a board reshuffle during operating stress is rarely random.

None of these signals individually proves anything. When they start to stack up, do not wait for confirmation: withdraw while withdrawals still work.

The fee structures that matter

Trading fees on major US exchanges in 2026:

Coinbase Advanced. Maker 0.40% / Taker 0.60% at the lowest tier; drops to 0.00% / 0.05% at the highest VIP tier. Default Coinbase (the simple interface) charges much higher fees — use Coinbase Advanced.
Kraken Pro. Maker 0.16% / Taker 0.26% at the lowest tier; 0.00% / 0.10% at the highest. Kraken Pro is the only acceptable Kraken interface; the simple "Kraken" interface has higher fees.
Gemini ActiveTrader. Maker 0.20% / Taker 0.40% lowest; 0.00% / 0.03% highest. ActiveTrader is the lower-fee interface; the default "Gemini" web interface charges convenience fees.
Binance.US. Maker 0.10% / Taker 0.10% lowest; 0.02% / 0.04% highest. Lower base fees than US competitors, with the caveat that Binance global has the regulatory baggage discussed above.

Withdrawal fees vary by asset, chain and exchange; each exchange shows its current fee on the withdrawal screen before you confirm. ETH withdrawals scale with network gas. The defensive practice: consolidate small withdrawals to reduce per-transaction fees, but never let "saving on fees" delay you during a stress event.

A workable setup, and why

For a US-based holder in 2026, one workable setup looks like this: a US-licensed exchange such as Coinbase Advanced as the primary fiat on-ramp and tax-reporting hub (US-licensed venues issue IRS tax forms and export tax-lot data that US tax software can import). Binance international as a secondary for products unavailable on US-licensed venues, with the explicit understanding that those funds are at risk if US regulatory action escalates. If Binance International is available in your jurisdiction, you can verify the referral field on the Binance registration page. Eligibility and any fee benefit depend on local restrictions, Binance's current terms and your account status; this site is an independent affiliate. Use the link or skip it — both options are fine.

In that setup, no single exchange holds more than a few weeks of trading float. The rest goes to a hardware wallet — a Trezor Safe 3, for example — with a BIP-39 passphrase. The estate-recovery document records where the device and the metal backup plate are; the passphrase is memorized, with a hint on the plate that means nothing to a thief but jogs the owner's memory when needed.

The minimum defensive setup, for someone starting today

Pick one US-licensed exchange. Coinbase and Kraken are two examples. Open the account, enable hardware-key 2FA, and turn on the address allowlist with a waiting period for newly added addresses.
Pre-register your hardware wallet's receive address on the allowlist. Now any withdrawal from this exchange can only go to your hardware wallet, regardless of who has the password.
Never keep more than 30 days of operating need on the exchange. Move the bulk to the hardware wallet the same week you buy.
Set up withdrawal-confirmation notifications. Email and authenticator app, both. A surprise withdrawal notification is your earliest warning of compromise.
Once a quarter, run the four-question check on your exchange. Regulator status, proof-of-reserves freshness, insolvency protections, withdrawal speed. Move funds elsewhere if any answer has degraded.

The single rule

"Not your keys, not your coins." The phrase is repeated to the point of cliché, but the lesson remains: an exchange balance is an IOU. The exchange's solvency, regulatory compliance, and operational integrity all sit between you and your assets. Keeping crypto on an exchange is appropriate for working float; keeping the bulk of your stack there is taking risk you cannot price.