How to Check If a Crypto Exchange Is Safe: A Checklist You Can Actually Run

2026-09-20

Safety is not a property an exchange has or lacks; it is a set of specific questions, most of which you can answer yourself in an afternoon. Proof of reserves answers one of them well and several not at all, so a useful check has to be wider than that. What follows is a list of things to do rather than things to feel.

A runnable checklist for assessing a crypto exchange: what to check, how to check it, and what a passing answer looks like for each item

What safe can and cannot mean

No check tells you an exchange will still be operating in five years. What checks can tell you is whether the things you are able to verify hold up, and whether the operator behaves like an organisation that expects to be examined.

That is a narrower promise than the question usually implies, and it is also the only honest one. Treat every item below as reducing a specific uncertainty rather than as contributing to a score, because scores hide which uncertainty is left.

It also matters that the checks are independent of one another, so a platform can pass five and fail one, and knowing which one failed tells you more than any summary of the six. The other half of the answer is not about the platform at all. How much you keep there, whether your account controls are switched on, and whether you have tested a withdrawal are decisions you make, and they change your exposure more reliably than any disclosure does.

The checklist

Check	How to do it	What a pass looks like
Reserves are published	Find the report and the address list	A per-asset table with a stated date
You are in the committed set	Run your own inclusion proof	Your computed root matches the published one
Withdrawals work	Move a small amount at a normal time	It completes within the stated window
The entity is identifiable	Read the terms and legal notices	A named company and a jurisdiction
Controls exist for your account	Turn on everything the account offers	Two-factor, a withdrawal whitelist, alerts
Incidents are communicated	Read the status history	Outages listed with causes and durations

Work down the second column rather than the first, because the value here is in doing the checks and not in knowing they exist.

The checks you can do in ten minutes

Start with your own inclusion. If reserves are published, verifying that your balance was inside the committed set is a short mechanical procedure and it is the only part nobody can do for you, described in how to verify proof of reserves.

Then turn on every control the account offers. Two-factor authentication, a withdrawal address whitelist, login alerts and a device list cost nothing and remove the most common way individual accounts are actually lost, which is not an exchange failure at all.

This step is worth doing before the others, because an account that is not yet secured makes every other question academic. Finally, read the legal footer. Which company you are contracting with, where it is established and what the terms say about account freezes are facts you can establish in a few minutes, and their absence is itself a finding.

The checks that take longer but matter more

Test a withdrawal. Move a small amount at an ordinary moment, note how long it takes, and keep that number, because it is the baseline that lets you notice a change later. Doing this once a quarter is worth more than reading anything.

Read the disclosure rather than the headline. A per-asset breakdown, a stated snapshot time, published addresses and verifiable signatures are what distinguish a document from a slogan, and what is missing from a disclosure is often more informative than what is present, as set out in proof of reserves red flags.

Consistency across periods belongs in the same category, since a series measured the same way says more than a single strong result. Look at the history rather than the moment. A status page with a year of incidents, causes and resolution times tells you how an organisation behaves when things go wrong, which is the only period during which that behaviour matters.

What registration does and does not tell you

Registrations and licences are real and they are frequently over-read. A registration usually means an entity has filed with a regulator for a defined purpose, and that purpose is often narrower than readers assume.

What it does establish is that a named legal entity exists somewhere with obligations attached to it. That is not nothing, particularly compared with an operator whose corporate identity is difficult to determine at all.

What it does not establish is that your assets are protected, insured or supervised in the way a bank deposit might be. Reading a registration as a guarantee is the same error as reading full backing as solvency, discussed in what fully backed actually means.

Why your own behaviour is half the answer

Most individual losses do not come from an exchange failing. They come from compromised credentials, approvals given to something that asked for them, and funds sent to an address that was not the intended one.

None of that is addressed by reserves, licences or audits, and all of it is addressed by controls you can switch on this afternoon. The asymmetry is worth internalising: the risks you can remove entirely are the ones nobody writes reports about.

It is also the part of the problem with the best return on a small amount of effort, which is unusual and worth taking advantage of. The remaining exposure is structural rather than personal, and it is sized by how much you leave on a platform rather than by which platform you chose. That framing is developed in crypto exchange counterparty risk.

What to do when a check comes back badly

Separate a missing feature from a failed check. An exchange with no third-party assurance is behind; an exchange whose published root does not match your own computation is a different situation entirely, and only the second is urgent.

Repeat before concluding. Re-download the files, use the stated period, confirm you are comparing against the official published values, and keep both attempts, because most surprising results are input problems and the ones that are not deserve to be reported precisely.

There is also a middle response people forget: asking. A clear question about a specific field in a disclosure often produces either an answer or a silence, and both are informative. Then act in proportion. Reducing a balance is a smaller step than moving everything, it can be done immediately, and it changes your exposure without requiring you to be certain about anything.

The bottom line

Checking an exchange means running six specific tests rather than forming an impression: reserves published, your own inclusion verified, withdrawals tested, the entity identified, your account controls enabled, and incident history read.

Proof of reserves covers one of these well. The rest are yours to do, most of them are quick, and the two that take longest are the two that tell you the most. For more from Bitbase Academy, keep reading.