Leaving crypto on a centralized exchange is convenient. You can trade, earn yield, use a debit card, and forget the complexity of seed phrases. You're also trusting the exchange completely — with their security, their solvency, their regulatory standing, and their willingness to honor a withdrawal request when you need it most.
The Two Distinct Risks
1. Account-level risk
Someone compromises your login and drains your exchange balance. This happens constantly — SIM swaps, phishing, credential stuffing, malware-scraped session cookies. The exchange's security team may help reverse internal transfers, but once funds leave the platform, they're typically gone.
2. Platform-level risk
The exchange itself fails. Either the company becomes insolvent (FTX, Celsius), gets hacked at the custody layer (Mt. Gox, Bitfinex 2016), or freezes withdrawals during market stress (QuadrigaCX, various smaller venues). In bankruptcy, you become an unsecured creditor. Expect 20–80% recovery after 2–3 years of litigation, if you get anything.
What Exchange Insurance Actually Covers
Exchanges often advertise "FDIC insurance" or "SIPC protection." Read carefully:
- FDIC insurance covers USD deposits held at partner banks — not crypto. If the exchange holds your dollars at Chase, Chase covers you; the crypto side has no equivalent.
- SIPC doesn't apply to crypto at all. It covers securities at failed brokerages.
- "Criminal insurance" some exchanges carry covers hot-wallet theft but usually has carve-outs for customer-side compromises, regulatory events, and certain fraud types.
Read the terms before trusting marketing language.
When Exchange Storage Is Reasonable
- Active trading balance — funds you're actively moving in and out of positions.
- Spending balance — dollar-cost-averaged buys awaiting withdrawal to cold storage.
- Small holdings you'd be comfortable losing to a worst-case platform event.
- Fiat on-ramps and off-ramps — the job exchanges do best.
When It Stops Making Sense
- Balances above a level you'd be comfortable losing entirely.
- Holdings you've decided not to actively trade.
- Any exchange showing withdrawal delays, rising support backlogs, or strange PR moves.
- Offshore or thinly-regulated venues — exchange-fee savings don't compensate for counterparty risk.
Hardening Your Exchange Account
If you do use an exchange, harden it as you would a brokerage:
- Hardware key 2FA — YubiKey or equivalent. Avoid SMS 2FA; see our SIM swap guide.
- Withdrawal allowlist — lock withdrawals to specific addresses with a time-delay before new addresses can receive.
- Unique email not used anywhere else. A separate, never-published email address dramatically reduces targeted-phishing risk.
- Different password, stored only in a password manager protected by hardware-key 2FA.
- Enable anti-phishing code (offered by Binance, OKX, Bitget) so legitimate emails are distinguishable from phishing.
Which Exchanges Carry Less Risk
No exchange is risk-free, but the category varies meaningfully:
- Lower risk: Coinbase, Kraken, Gemini — US-regulated, publicly audited (Coinbase), long track record.
- Moderate risk: Binance, OKX, Bybit — larger offshore exchanges with stronger reserves proof but less regulatory oversight.
- Higher risk: Smaller regional exchanges, new entrants, and anything offering unusually high yields. Yield almost always reflects risk you can't see.
See our exchange legitimacy guide for a verification routine on less-known platforms.
If Your Exchange Is Acting Strange Right Now
Withdrawal delays, support going silent, strange policy changes, or unexplained feature removals are all classic early-warning signs of an imminent halt. If you see any combination of these on an exchange holding meaningful value, withdraw before further news breaks. You can always deposit again later; you can't always recover funds from a frozen platform.
If you're already experiencing a withdrawal issue, see our can't withdraw from an exchange guide.
Bottom Line
Exchanges are payment rails and trading venues, not savings vaults. Size your exposure to what you can afford to lose if the platform disappears tomorrow — because platforms sometimes do, and you'll be glad you planned for it.