Crypto Exchange Risks After FTX

Six categories of risk that still break exchanges in 2026 — and how to mitigate each.

Reviewed by Stephan Kulik · Last updated: 2026-04-23 · How we rank

Key takeaways

Post-FTX, six distinct risk categories remain: fraud, hack, regulatory freeze, rehypothecation, withdrawal halt, stablecoin depeg.
Proof of Reserves is now table stakes — absence of PoR is itself a red flag.
Regulatory freeze is the most underestimated — action can force a 30–60 day withdrawal window with little notice.
The single most effective mitigation is self-custody for long-term holdings.

The FTX lesson in one paragraph

FTX wasn't a hack. It wasn't a regulator. It was internal fraud: customer deposits had been moved to Alameda Research to cover trading losses. When users tried to withdraw, the money wasn't there. The collapse erased roughly $8B in customer funds (later partially recovered in bankruptcy). The key takeaway: custodial trust is fragile, and "looks fine" isn't a substitute for verification.

Risk 1 · Fraud (FTX, Celsius, Voyager)

Customer funds used for purposes other than stated — to cover trading losses, fund acquisitions, pay executives, etc. Detectable with proper auditing and segregation of customer assets. Mitigation: only use exchanges with Proof of Reserves and audited financials (not one or the other), and only those that explicitly disclose segregation of customer funds in Terms of Service.

Risk 2 · Hack (Mt. Gox 2014, Bitfinex 2016, Coincheck 2018, WazirX 2024)

External attacker drains hot wallets or exploits a bridge. Major exchanges now keep 95%+ of assets in cold storage with multisig, but hot wallets are still targeted. Mitigation: check the exchange\'s cold-storage policy, multisig setup, bug-bounty program, and past security incidents.

Risk 3 · Regulatory freeze (Binance UK 2021, Binance US 2023, KuCoin US 2025, Gemini UK 2026)

Regulator (SEC, CFTC, FCA, BaFin) acts against the exchange or against your jurisdiction. Access is restricted, often with a compressed withdrawal window (30–60 days). Mitigation: use an exchange licensed in your jurisdiction; don\'t rely on a single exchange; keep withdrawal paths (wire, SEPA, self-custody) tested and ready.

Risk 4 · Rehypothecation (Celsius 2022, BlockFi 2022–2023)

Platform takes your deposit, lends it to an institutional borrower, keeps your balance on the app showing the original amount. If the borrower defaults (Three Arrows, Genesis), the platform\'s liabilities exceed its assets. Mitigation: read the ToS carefully for "may lend" / "may rehypothecate" language. Exchanges generally don\'t rehypothecate spot assets; yield products (Earn, Staking, BlockFi Interest Account) often do.

Risk 5 · Withdrawal halt (FTX 2022, Celsius 2022)

Exchange suspends withdrawals "temporarily" due to "unusual activity". Often the first visible sign of bigger problems. Mitigation: if you see a withdrawal halt announced — even with a reassuring explanation — treat it as a serious warning. Don\'t deposit more. Consider withdrawing existing balances when halts lift.

Risk 6 · Stablecoin depeg (UST/Luna 2022, USDC briefly 2023)

The stablecoin in your account loses its peg. UST collapsed 99%. USDC briefly traded at $0.87 in March 2023 (SVB exposure). Mitigation: diversify across stablecoins (USDC + USDT + DAI), keep exposure to algorithmic stablecoins minimal, and prefer stablecoins with transparent attestations.

A mitigation stack

Choose exchanges with strong regulatory + PoR + audit (Coinbase, Kraken, Bitstamp top the list)
Diversify — split between 2 exchanges in different jurisdictions for balances >$10K
Self-custody long-term holdings — hardware wallet for anything not actively traded
Diversify stablecoins if you hold significant stable exposure
Test withdrawals periodically — confirm the path works before you need it
Watch for halt announcements — any unusual suspension is a pre-emptive warning

Frequently asked questions

What exactly happened with FTX? +

In November 2022, FTX — then the third-largest crypto exchange — collapsed after revelations that customer deposits had been transferred to Alameda Research, a sister trading firm, to cover losses. When a bank run started, FTX could not honor withdrawals. Founder Sam Bankman-Fried was convicted of seven counts of fraud in 2023. Roughly $8B in customer funds was missing at the time of collapse, though bankruptcy proceedings in 2024–2025 recovered a substantial portion, eventually paying customers back near dollar-value at the time of filing (though not at 2022 crypto peak values).

Could an FTX-level collapse happen again in 2026? +

Yes — but it's harder. Post-FTX, (1) Proof of Reserves is now table stakes at major exchanges, (2) regulators (CFTC, SEC, FCA, BaFin, MAS) are materially more active, (3) customer awareness is higher. The specific failure mode (commingling customer funds with a sister trading firm) is better detected now. But new failure modes always emerge — exchanges that avoided the last failure often invent the next.

What is "rehypothecation" in the crypto context? +

Rehypothecation is using pledged collateral for the lender's own purposes. In crypto: a platform takes your deposited BTC, lends it out to institutional borrowers for yield, and still shows "1 BTC" in your balance. If the borrower defaults or the platform needs the BTC urgently, your balance may not be recoverable. This was the core failure at Celsius (2022) and BlockFi (2022–2023), where customer funds were loaned extensively to Three Arrows Capital and others.

Which risk category is most underestimated? +

Regulatory freeze. Binance's $4.3B DOJ settlement (2023) didn't collapse the exchange, but individual users in specific jurisdictions (US retail pre-settlement, UK users under FCA restrictions) faced immediate withdrawal windows. KuCoin's January 2025 US exit forced account closure on short notice. Regulatory action can freeze your funds faster than fraud does — often with a 30-60 day window to withdraw.

How do I know if my exchange has real PoR? +

Check three things: (1) the attestation is performed by a named audit firm (Mazars, Armanino, Deloitte, not "self-attested"), (2) attestation is monthly or quarterly (not annual), (3) you can download the Merkle root and verify your own balance in it. See our <a href="/proof-of-reserves-explained/">PoR guide</a> for the full evaluation checklist.

Does "insured" mean safe? +

Partial. Crypto insurance (e.g., Coinbase's Lloyd's coverage, Gemini's insurance through Aon) covers specific scenarios — hot-wallet theft, for example — not custodial fraud or bankruptcy. FDIC insurance on USD cash balances (Coinbase, Kraken Bank) covers fiat but not crypto. Read the exact language: "insurance" without scope-of-coverage language is often marketing, not genuine protection.

Is a regulated exchange always safer than an unregulated one? +

Usually but not always. FTX was regulated in the Bahamas — clearly that did not prevent collapse. Strong regulators (CFTC, SEC, FCA, BaFin, FINMA, MAS) provide real oversight; weak-jurisdiction regulators (some offshore) do not. Evaluate the regulator, not just the fact of regulation.

What's the single most effective risk mitigation? +

Self-custody for long-term holdings. An exchange is where you execute trades and convert fiat. Once funds are yours to hold, move them to a hardware wallet. This eliminates exchange-level risks (fraud, hack, freeze, rehypothecation) entirely for the self-custody portion. See our <a href="/seed-phrase-security/">seed-phrase security guide</a>.