FTX collapsed in November 2022 with an $8.9 billion hole in customer funds, and the mechanism was almost boring in hindsight: the exchange quietly funneled customer deposits to its affiliated trading firm, Alameda Research, and there was no independent way for a depositor to check that the coins showing up in their account actually existed anywhere. That single failure — no verifiable proof that customer assets were segregated and fully backed — is the thread that should run through how you evaluate any exchange today.
The Core Lesson: Custody Is the Product
An exchange's trading interface, fee schedule, and token listings are marketing. The actual product you're buying when you deposit funds is a custody promise: that the exchange holds what it says it holds, keeps it separate from its own operating capital, and won't lend it out to a sister company without your consent. FTX broke all three. Evaluating an exchange now means checking for the specific mechanisms that would have caught FTX's fraud before it reached $8.9 billion, not just reading a trust badge on the homepage.
What Proof of Reserves Actually Proves — and What It Doesn't
Proof of reserves (PoR) is a cryptographic attestation, usually a Merkle-tree snapshot, showing that an exchange's on-chain holdings meet or exceed what it owes depositors at a point in time. Most major exchanges now publish some form of PoR following FTX's collapse. The catch: a snapshot proves reserves existed on the day it was taken, not that they'll still be there next week, and it says nothing about liabilities the exchange owes elsewhere (loans, legal judgments, or a sister trading firm's losses). Treat PoR as a floor, not a guarantee — the real signal is whether the exchange publishes it on a recurring schedule with a named third-party auditor attached, not a one-off PDF.
A Practical Checklist Before You Deposit
- Recurring, audited proof of reserves — monthly or quarterly, from a named auditor, not a single self-reported snapshot.
- Segregation of customer funds — check the terms of service for explicit language that customer assets aren't used for the exchange's own trading, lending, or as collateral.
- Regulatory licensing in your jurisdiction — a money transmitter license or equivalent means a regulator can subpoena records; FTX's offshore structure was specifically built to avoid this.
- No affiliated trading desk with privileged access — Alameda Research had a hidden line of credit inside FTX that other users didn't have; ask whether the exchange runs or favors an internal market maker.
- Insurance or protection fund size relative to total deposits — a named, funded pool (not just a marketing claim) that covers a meaningful fraction of custodied assets.
- Withdrawal track record under stress — search for whether the exchange has ever paused or delayed withdrawals during a volatile period; a clean history here is worth more than any single feature.
Comparison: What to Look For, By Exchange Type
| Exchange Type | Typical Custody Model | Regulatory Exposure | Best Use Case |
|---|---|---|---|
| Large regulated exchange (e.g. Coinbase, Kraken) | Segregated custody, regular PoR, licensed in major markets | High — subject to SEC/state regulators, periodic audits | Long-term holding, larger balances |
| Global offshore exchange (e.g. Bitget, OKX) | PoR published, but licensing varies sharply by country | Mixed — often licensed in some regions, unregulated in others | Active trading with funds you actively manage down, not park |
| Self-custody wallet + DEX | You hold the keys; no exchange counterparty risk at all | None — no custodian to fail | Anything you're not actively trading right now |
The Habit That Actually Protects You
No amount of due diligence on an exchange's PoR page replaces the simplest control: don't keep more on any single exchange than you'd be comfortable losing entirely. FTX users who moved profits to self-custody wallets regularly lost nothing when the exchange froze withdrawals; users who treated FTX as a savings account lost everything in that account. Proof of reserves, licensing, and insurance funds all reduce the odds of a repeat, but none of them reduce the odds to zero — withdrawing to a hardware wallet or a second, unrelated exchange periodically is the only control that fully removes single-exchange counterparty risk.
FAQ
Did proof of reserves exist before FTX collapsed?
Some exchanges published informal reserve claims earlier, but there was no industry norm for recurring, audited PoR. FTX itself made public claims about being fully backed that turned out to be false, which is exactly why unaudited, one-time claims aren't sufficient on their own.
Is a licensed exchange automatically safe?
No. Licensing means a regulator has oversight and recourse exists if something goes wrong, but it doesn't prevent fraud or mismanagement — it mainly improves the odds of detection and of you having legal standing afterward.
How much of my balance should I leave on an exchange?
There's no fixed number, but the practical rule many traders use is: only what you need for active trading in the near term. Anything you intend to hold moves to self-custody or is split across unrelated platforms.
Do protection funds actually pay out?
Some have, in limited cases of hacks rather than fraud. They're a partial backstop, not full insurance — check the fund's stated size against the exchange's total customer deposits to gauge how much coverage it could realistically provide.
The Verdict
The FTX collapse didn't happen because crypto exchanges are inherently unsafe — it happened because one exchange's claims about custody went unverified until it was too late. Picking a safer exchange today means favoring recurring third-party-audited proof of reserves, real licensing, and no hidden affiliated trading desk, and then backing that choice with the one habit that removes counterparty risk entirely: not leaving more on any single platform than you can afford to lose.