How to Choose a Crypto Exchange Without Taking Hidden Risks
The biggest risk at a crypto exchange is often the exchange itself. This guide covers who holds your keys, what protection you do and do not have, what trading really costs, and the terms worth reading before you deposit.
What to compare: crypto exchanges
- Who holds the private keys to your coins If the exchange holds the keys, you hold a claim on the exchange. If you hold them in your own wallet, you carry the security job yourself.
- A license or registration that covers your state Many states require crypto businesses to hold a money transmitter license or a state charter. Check your state regulator's list for the exact legal entity you would deal with.
- The customer agreement's section on custody and insolvency The terms say whether your assets are held for you or become the exchange's property. That wording decides where you stand if the firm fails.
- The full cost of a trade: fees, spread and withdrawal charges A simple buy screen can price in a wide spread with no separate fee line. Advanced screens use maker and taker fees. Withdrawals often cost extra.
- Security: hardware-key two-factor, withdrawal allowlists, alerts Account takeovers often start at the login. App or hardware-key two-factor and an address allowlist make a stolen password far less useful.
- Downloadable transaction history with cost basis The IRS treats crypto as property, so each sale or swap can be a taxable event. You need complete records to report them.
- No promise of insurance you cannot verify Crypto held at an exchange is generally not covered by SIPC or FDIC. Any claim of coverage should say exactly what is insured, by whom, and up to what.
Where your coins sit decides your risk. A stock in a brokerage account is held for you under a set of US rules that has been tested through broker failures, while crypto at an exchange lives under a patchwork of state licenses, customer agreements and whatever the firm’s own records show.
That makes choosing an exchange mainly a question of structure. Fees matter. Features matter. Neither matters if the firm fails with your assets on its books.
What follows is what to check, and where.
Custody: who holds the keys
A crypto asset is controlled by a private key. Whoever holds the key can move the coins.
On most exchanges, the exchange holds the keys and your account shows a balance. That balance is a record in the firm’s system. Some exchanges keep customer assets in segregated wallets. Others pool them. Some lend them out or use them in other business, if the customer agreement allows it, and the only way to know which applies to you is to read the custody and insolvency sections of that agreement line by line.
A self-custody wallet puts the keys in your hands. Nobody can freeze your coins, and nobody can recover them if you lose the recovery phrase.
What happens if the exchange fails
The sign-up page skips this part.
Crypto held at an exchange is generally not covered by SIPC, which protects securities and cash held at member brokers, or by the FDIC, which insures deposits at insured banks. Cash is a separate case. Some exchanges hold cash balances at partner banks, and that cash may have deposit coverage under the FDIC’s rules while the coins in the same account have none.
If the customer agreement treats deposited crypto as the exchange’s property, you may be an unsecured creditor in a bankruptcy. That means you file a claim and wait alongside everyone else the firm owes money to, with no guarantee of getting all of it back, or any of it, and no say over how long the process takes. The page on whether you can lose more than you put in covers losses from the trade itself. This is a separate risk, and it can hit a position that was profitable.
Licensing in your state
No single federal license covers every crypto exchange. Many states require a money transmitter license, and some have their own crypto rules or charters. Find your state’s financial regulator, search for the exchange’s legal entity name as it appears in the customer agreement, and confirm the license covers the state where you live, since a license held in one state says nothing about whether the firm may serve customers in another.
Some exchanges refuse residents of certain states. Take that seriously. Signing up anyway through a workaround means you have no regulator to complain to.
What trading really costs
Exchanges price trades in three places.
- Trading fees, often split into maker fees for orders that add liquidity and taker fees for orders that take it.
- The spread, which on simple buy and sell screens is often built into the quoted price.
- Withdrawal fees, charged per transfer and varying by coin and network.
The simple screen is where costs hide. It shows one price and a small fee. The price itself may sit well above the market.
Compare the quoted price against the exchange’s own order book or advanced screen before you buy. Then check withdrawal fees for the coins you hold, because moving coins off the exchange is the exit, and an exit that costs a lot is one you will put off.
Security features
Many account takeovers start with a stolen password or a hijacked phone number. Look for two-factor authentication through an authenticator app or a hardware security key, which are harder to hijack than text-message codes. Then look for a withdrawal address allowlist, a delay on new withdrawal addresses, and alerts for every login and every withdrawal, and turn every one of them on the day you open the account.
Tax records
The IRS treats digital assets as property. Selling crypto, swapping one coin for another and spending it can each be a taxable event, and you need the date, amount, cost basis and proceeds for every one of them to report it. Check that the exchange lets you download a full transaction history with basis, and export it at least once a year in case the firm, the account or your login disappears before you file. Current guidance is on the IRS page for digital assets. The page on what records a trader should keep for taxes covers the rest of the file.
Red flags
- Promised fixed returns on deposited coins.
- Claims of insurance with no named insurer, limit or scope.
- No legal entity name or state license you can verify.
- Withdrawal pauses, or delays blamed on “maintenance” that last for days.
- Pressure to deposit quickly for a bonus.
- A customer agreement that lets the firm use your assets with no limits.
Keep the comparison in proportion
A stock broker and a crypto exchange look alike on a phone screen, yet they sit under very different protection, and the checks in how to choose an online broker are only a starting point here. Keep on an exchange only what you are actively trading, withdraw the rest to storage you control or reduce the position, and read the agreement again whenever the firm announces a change to it.
Also asked
- Is crypto held at an exchange covered by FDIC or SIPC?
- Generally no. FDIC insurance covers deposits at insured banks, and SIPC covers securities and cash at member brokers. Crypto assets held at an exchange usually fall outside both.
- Should I move my crypto to a personal wallet?
- It removes exchange failure as a risk and replaces it with your own: lost keys or recovery phrases usually cannot be recovered by anyone. Weigh which risk you handle better.