Exchange Custody Risk: How Much Crypto Should Stay on an Exchange?
Exchange custody risk is the chance a platform failure traps your crypto. Measure your exposure, size an operating balance and weigh it against self-custody.
Key takeaways
- Custody risk is the share of your holdings one platform failure, freeze or hack could trap. Measure it per venue, not only in total.
- In the example, 80% sits on exchanges and 70% on one venue. A $1,950 operating balance would cut the exchange share to 10.8%.
- Batch withdrawals: at a hypothetical $6 each, moving $150 weekly buys costs 4.0% a year, while moving them monthly costs 0.9%.
- Self-custody swaps counterparty risk for key-management risk. It only lowers risk if you can store a recovery phrase safely offline.
On this page
When your coins sit on an exchange, you don’t hold them directly. You hold a claim on a company that holds them for you. That claim is only as good as the company’s security, solvency and honesty, which is why “where is it held?” belongs next to “what do I own?” in any portfolio check.
What is exchange custody risk?
It is the risk that assets held by a platform become unavailable to you because of something that happens to the platform, not to the coins. The SEC’s December 2025 investor bulletin on custody puts it plainly: “If the third-party custodian is hacked, shuts down, or goes bankrupt, you may lose access to your crypto assets.”
The same bulletin flags two practices to ask about. Some custodians “use deposited crypto assets as collateral for their own purposes (i.e., lending),” and some “may commingle crypto assets, instead of holding them individually for customers.” Both can matter a great deal if the platform fails.
Two protections you might take for granted are often missing. The FDIC states that it “does not insure assets issued by non-bank entities, such as crypto companies.” And the CFTC notes that platforms in cash crypto markets “may lack critical system safeguards, including customer protections.”
How to measure your exposure
Use two numbers, not one:
- Exchange share: value held on all exchanges ÷ total portfolio value.
- Largest single venue: value on your biggest platform ÷ total. This is the most one failure could trap.
Suppose you hold $18,000 in crypto, all figures hypothetical:
| Where it’s held | Value | Share |
|---|---|---|
| Exchange 1 | $12,600 | 70% |
| Exchange 2 | $1,800 | 10% |
| Hardware wallet | $3,600 | 20% |
| Total | $18,000 | 100% |
The exchange share is $14,400 ÷ $18,000 = 80%, and one platform holds 70% of everything.
- Low ≤ 20
- Moderate ≤ 50
- High ≤ 100
Our health check flags an exchange share between 20% and 50% as moderate and anything above 50% as high. Those are rough signals rather than rules, but 80%, with 70% at one venue, means a single company’s problems could freeze most of this portfolio.
How much should stay on an exchange? Size an operating balance
One practical approach is to keep on exchanges only what your plans require, and to size that amount deliberately. For the example, assume you buy $150 of crypto a week and withdraw once a month:
| Part of the operating balance | Amount |
|---|---|
| Purchases awaiting the monthly withdrawal | $650 |
| Rebalancing trades planned for the next two months | $900 |
| Float for fees and small adjustments | $400 |
| Operating balance | $1,950 |
That is 10.8% of the portfolio, down from 80%. If you split it across two platforms, the most any one of them could trap falls to about $975, or 5.4%. Each extra platform is another account to secure, so there is a trade-off in both directions.
Why batching withdrawals matters
Withdrawals cost money, and fees vary by platform and network, so check the current charge before you move anything. Suppose each withdrawal costs $6. Buying $150 a week is $7,800 a year:
- Withdrawing after every weekly buy costs 52 × $6 = $312, or 4.0% of what you invested.
- Withdrawing once a month costs 12 × $6 = $72, or 0.9%.
Batching keeps costs down at the price of a slightly larger balance on the exchange between withdrawals. Withdrawal fees vs network fees explains what each part of that charge pays for.
What could each failure cost you?
Compare the example portfolio as it stands with the same portfolio after keeping a $1,950 operating balance, split evenly across the two exchanges, and moving the rest to self-custody:
| What goes wrong | Trapped or lost now | After the change |
|---|---|---|
| Exchange 1 freezes withdrawals | $12,600 (70%) | $975 (5.4%) |
| Exchange 2 is hacked | $1,800 (10%) | $975 (5.4%) |
| You lose your wallet and recovery phrase | $3,600 (20%) | $16,050 (89.2%) |
The last row is the point. Moving coins off exchanges shrinks counterparty risk but concentrates everything in your own key storage. Neither column is safe by default; each shows which failure you are most exposed to, so you know where your precautions need to be strongest.
Is proof of reserves enough reassurance?
Some platforms publish proof-of-reserve reports. The PCAOB, which oversees the auditors of public companies, warned in 2023 that these “are not audits” and “do not provide any meaningful assurance,” that they “likely do not address the crypto entity’s liabilities,” and that they cover assets “at one point in time.” A reserve report can be one input, but it can’t tell you whether customer claims are fully covered.
Better questions come from the SEC bulletin: What insurance applies if the custodian fails? How are assets and keys stored? Does the platform lend or commingle customer assets? What fees apply to transfers and closing an account?
Self-custody has risks too
Moving coins off an exchange doesn’t remove risk; it moves it to you. The SEC bulletin notes that a private key “cannot be changed or replaced,” and “if you lose your private key, you permanently lose access to the crypto assets.” Self-custody only lowers your total risk if you can:
- Store a recovery phrase safely offline, never typed into any website or shared with anyone; see seed phrase security
- Choose between an online and an offline wallet knowingly; see hot vs cold wallets
- Check every destination address before a withdrawal; see how to verify a crypto address
If those steps aren’t in place yet, work through the crypto wallet security checklist before moving a large balance.
Common custody mistakes
- Counting only the total. 40% spread across four platforms is a different risk from 40% on one.
- Forgetting dormant accounts. Small balances on platforms you no longer use still carry the platform’s risk.
- Rushing into self-custody. A lost recovery phrase is a permanent loss, not a temporary freeze.
- Treating reserve reports as audits. They show a snapshot of assets, not the full balance sheet.
Enter your current exchange share in our portfolio health check and see where custody sits among the vital signs of a healthy crypto portfolio.
The bottom line
Exchange custody risk is measured by how much one platform’s failure could trap, so track both your total exchange share and your largest single venue. Keep what your plans need on exchanges, batch withdrawals to control costs, and move the rest only once your own key storage is solid.
Frequently asked questions
Is it safe to keep crypto on an exchange?
It depends on the platform and on how much you leave there. The SEC's custody bulletin warns that if a third-party custodian is hacked, shuts down or goes bankrupt, you may lose access to your crypto. Some custodians also lend or commingle customer assets. Keeping only what you need for planned activity limits how much any single platform problem can affect you.
How much crypto should I keep on an exchange?
There is no universal figure. One approach is an operating balance: purchases waiting to be withdrawn, trades you plan in the next month or two, and a small float for fees. In the example, that comes to $1,950, or 10.8% of an $18,000 portfolio. Our health check flags 20% to 50% on exchanges as moderate and more than 50% as high.
Does proof of reserves mean my crypto is safe?
No. The PCAOB, which oversees audits of public companies, warned in 2023 that proof of reserve reports are not audits and do not provide meaningful assurance. They usually show assets at one moment and may not address the platform's liabilities, so they cannot confirm that customer claims are fully covered. Treat them as limited information, not a guarantee.
Is crypto held on an exchange insured?
Not by deposit insurance. The FDIC states that it does not insure assets issued by non-bank entities such as crypto companies. Some platforms carry private insurance, but its limits and exclusions vary, and it may not cover every type of loss. Ask the platform what is covered, up to what amount and under which events before relying on any insurance claim.
Sources
- Crypto Asset Custody Basics for Retail Investors – Investor Bulletin — U.S. SEC — Investor.gov
- Investor Advisory: Exercise Caution With Third-Party Verification/Proof of Reserve Reports — Public Company Accounting Oversight Board (PCAOB)
- Advisory to FDIC-Insured Institutions Regarding Deposit Insurance and Dealings with Crypto Companies — Federal Deposit Insurance Corporation
- Customer Advisory: Understand the Risks of Virtual Currency Trading — U.S. Commodity Futures Trading Commission
This content is for education only and is not financial, investment, tax or legal advice. Crypto assets are volatile and you can lose money. Examples use hypothetical numbers. See our disclaimer and editorial policy.