Exchange Risk in Crypto: What FTX Taught Us and How to Stay Safe

In November 2022, FTX — the world's second-largest crypto exchange at the time — collapsed in approximately 72 hours. An estimated €8-10 billion in customer funds were missing. The collapse followed a series of exposures about FTX's balance sheet and a Binance announcement that they were selling their FTT holdings — triggering a bank run that FTX could not handle.

What made FTX particularly shocking was its apparent legitimacy. FTX was registered in the Bahamas and had regulatory relationships in multiple jurisdictions. It was backed by prominent venture capital firms including Sequoia Capital and Paradigm. Its CEO Sam Bankman-Fried was a prominent figure who had testified before Congress and cultivated relationships with US regulators.

The subsequent bankruptcy revealed that FTX had been using customer deposits to fund trades through its affiliated trading firm, Alameda Research. This commingling of customer and proprietary funds is illegal in most jurisdictions and precisely the reason that regulated brokers in traditional finance must maintain strict segregation of customer assets.

FTX was not a one-off. The same year, Celsius, Voyager, and BlockFi also failed, all with customer funds frozen in bankruptcy proceedings. The pattern — exchange appears legitimate, customers deposit funds, exchange uses those funds improperly, exchange fails — has repeated throughout crypto's history.

Not all exchanges carry equal risk. Several factors predict lower risk.

Regulatory registration and oversight: Exchanges registered and actively supervised by financial regulators — the FCA in the UK, AFM/DNB in the Netherlands, FinCEN and state licenses in the US, BaFin in Germany — face external audit and compliance requirements that reduce (but do not eliminate) the risk of customer fund misappropriation. In Europe, look for exchanges with EU registration under MiCA (Markets in Crypto-Assets regulation).

Proof-of-reserves audit: Legitimate exchanges have third-party proof-of-reserves audits that verify their crypto holdings match customer balances. Exchanges like Kraken and Bitfinex have conducted these audits. A proof-of-reserves audit is not a complete financial audit — it does not verify liabilities — but it is better than no external verification.

Long operational track record: Exchanges that have survived multiple bear markets (Kraken since 2011, Coinbase since 2012) have demonstrated more resilience than exchanges that launched in 2020-2021 and have not been tested by a full bear market cycle.

Transparency about ownership and management: Regulated, publicly traded exchanges (Coinbase is publicly listed on Nasdaq) face disclosure requirements that reduce opacity risk. Offshore exchanges with unknown beneficial ownership carry higher risk.

Regardless of which exchange you use, these steps materially reduce your exchange risk exposure.

Keep only trading amounts on exchanges. Whatever you are not actively trading in the next 30 days belongs in self-custody. If you have €20,000 in crypto but are only actively trading €2,000 of it, move €18,000 to a hardware wallet. Your exposure to exchange failure is now €2,000, not €20,000.

Distribute across 2-3 exchanges. Keeping everything on one exchange concentrates your counterparty risk. Distributing across two or three regulated exchanges means a single exchange failure cannot wipe out all your exchange-held assets.

Enable withdrawal limits and address whitelisting. Most major exchanges allow you to restrict withdrawals to pre-approved addresses and set daily withdrawal limits. These controls mean that even if your account is compromised, an attacker cannot immediately empty it to an unknown address.

Monitor exchange health signals. Before depositing large amounts, check the exchange's proof-of-reserves data, withdrawal processing times (delays can signal liquidity problems), and any news about the exchange's regulatory relationships or funding. When these signals deteriorate — as they did for FTX in the days before its collapse — swift withdrawal is the right response.

The only complete solution to exchange risk is self-custody — holding your crypto in a hardware wallet where you control the private keys and no exchange can access your funds.

For long-term holdings (assets you will not touch for 6+ months), self-custody is the appropriate choice regardless of which exchange you 'trust.' Every exchange bankruptcy in crypto history — FTX, Mt. Gox, Celsius, Voyager — was unexpected by customers. The 'trust' they placed in those institutions proved misplaced. Self-custody removes trust as a variable: you do not need to trust an exchange if the exchange never holds your assets.

The practical threshold: once your total crypto holdings exceed €5,000, a hardware wallet (€100-€150) is essential risk management. The cost is trivially small relative to the risk it eliminates. For holdings above €20,000, using a hardware wallet for the majority of holdings with only active trading amounts on exchanges should be your standard practice.

Alpha Factory's hardware wallet guide and how-to-store-crypto guide cover the full self-custody setup process.