When you deposit your Bitcoin or Ethereum into a centralized exchange like Binance or Coinbase, you’re not really holding it. You’re trusting someone else to hold it for you. And that’s where the danger starts.
Who Really Owns Your Crypto?
Most people think if they see their balance on an exchange, they own it. They don’t. Under the fine print of Coinbase’s Terms of Service (Section 4.2), funds held in your account are not your property until withdrawn. Same goes for Binance, Kraken, and nearly every other major platform. You have a claim - not ownership. The exchange controls the private keys. That means if they get hacked, go bankrupt, or freeze withdrawals, you lose access. And it’s happened before - and often.In 2014, Mt. Gox lost 850,000 BTC - worth $450 million at the time - and vanished. In 2023 alone, exchanges were hacked for over $3.8 billion. Every single dollar stolen came from centralized platforms. Decentralized exchanges? Zero losses. Why? Because they don’t hold your keys. You do.
The Security Gap: Cold Storage, Multi-Sig, and Patch Delays
You’d think top exchanges would lock down their systems. But data from CipherTrace’s 2023 Security Report shows only 38% of the top 20 exchanges use true multi-signature wallets. That’s a fancy term for requiring multiple approvals before moving funds - a basic safety step. The rest rely on single keys. One breach, and everything’s gone.Cold storage - keeping assets offline - should be the norm. But Chainalysis found that, on average, exchanges keep only 63% of assets in cold storage. Experts recommend 95% or higher. That leaves nearly a third of user funds online, vulnerable to hackers. And when a vulnerability is found? The average exchange takes 47 days to patch it, according to CoinGecko. By then, it’s too late.
Even big names aren’t immune. Binance scored just 5.2 out of 10 on OSL Academy’s 2024 security rating, mainly because of weak withdrawal verification. Kraken and Coinbase scored higher - 7.8 and 7.5 respectively - but even they’ve had outages, delays, and breaches. No one’s bulletproof.
Withdrawal Freezes and Regulatory Roulette
It’s not just hacks. Exchanges can shut down withdrawals overnight. In May 2021, Coinbase froze withdrawals during a market crash, affecting 1.2 million users. Why? Liquidity crunch. They couldn’t meet demand. Users were stuck with paper gains - no way to cash out.Regulation is another wild card. Binance pulled out of Canada in 2023 after regulators demanded compliance changes. In 2021, Turkey’s Thodex exchange collapsed after local regulators cracked down, leaving 400,000 users with nothing. These aren’t rare events. They’re part of the model. Exchanges operate in legal gray zones. When pressure mounts, they flee - and users get left holding worthless digital receipts.
Insurance? Not What You Think
Many users assume their funds are insured. They’re not. Not by the FDIC. Not by any government. Some exchanges advertise insurance - but here’s the catch: coverage varies wildly. In the U.S., top exchanges like Coinbase may insure up to 75% of assets. In emerging markets? Often just 15-25%. The $570 million WazirX hack in November 2023? Only a fraction of stolen funds were covered. Most users got nothing.And even when insurance exists, payouts are slow. Reddit threads from 2023 show users waiting 17 days just for a response after a hack. One user, u/WazirXVictim, lost $18,500 and never got a cent back. Trustpilot reviews for major exchanges average just 2.8 out of 5 for security and asset protection. Coinbase? 3.1. Binance? 2.3. That’s not confidence. That’s resignation.
What Users Do (and Don’t) Do to Protect Themselves
Most people don’t even try. Ledger’s 2024 Security Survey found only 12% of users connect their exchange accounts to hardware wallets. That’s the gold standard - a physical device that stores keys offline. Even fewer enable withdrawal address whitelisting (38%), use authenticator apps instead of SMS for 2FA (only 41%), or verify transaction signatures (22%).And here’s the kicker: only 8% of retail users regularly check exchange security policies. Most assume the platform is safe because it’s popular. But popularity doesn’t equal security. It just means more people are trusting it - which makes it a bigger target.
Even the basics are ignored. In 2024, a Google Ads scam tricked users into clicking fake customer support links. Twelve exchanges were hit. $85 million stolen. People thought they were talking to real support. They weren’t. The exchange had nothing to do with it - but users still blamed the platform.
Who’s Moving Away - And Why
Institutional investors aren’t stupid. Firms managing over $100 million in crypto avoid exchange wallets entirely. According to the 2024 Institutional Crypto Investor Survey, 68% use third-party custodians like Fireblocks or Copper. These are enterprise-grade systems built for security - not trading volume.Even retail users are catching on. Chainalysis reports that 47% of new crypto users (those who joined in 2023-2024) move their assets to self-custody within 18 months. They start on an exchange because it’s easy. Then they learn the risks. And they leave.
The Future: Self-Custody or Bust
Exchanges know the game is changing. Kraken launched real-time hack insurance in April 2024 - covering 100% of assets up to $1 million per user. Binance now forces 24-hour delays on new withdrawal addresses. Coinbase rolled out multi-party computation (MPC) wallets for all users in March 2024 - a step toward decentralized security without giving up convenience.But these are bandaids. The real solution? You holding your own keys. The future belongs to exchanges that let you move seamlessly between trading and self-custody. Not ones that lock you in.
By 2026, Deloitte predicts 78% of top exchanges will offer native self-custody integrations. That’s good. But don’t wait for them to make it easy. Do it yourself. Use a hardware wallet. Enable withdrawal limits. Turn off SMS 2FA. Check your exchange’s security page - if it’s less than 50 pages long, they’re not serious.
Centralized exchanges aren’t going away. They’re too convenient. But convenience is the enemy of security. If you leave crypto on an exchange longer than you need to, you’re gambling. And the house always wins.
Are centralized exchange tokens insured by the government?
No. Not in any country. Unlike bank deposits protected by FDIC insurance in the U.S., crypto held on exchanges has no government backing. Some exchanges buy private insurance, but coverage varies - often covering only 15-75% of assets, with long delays and strict limits. Most users are unaware their funds aren’t insured at all.
Can I get my money back if an exchange gets hacked?
Rarely. After major hacks like Mt. Gox, FTX, or WazirX, most users lost everything. Even when exchanges have insurance, payouts are slow, partial, or nonexistent. Some users received tokens as compensation - but those tokens often lost value. Recovery is not guaranteed. The only reliable way to protect your assets is to hold them yourself.
Why do exchanges still exist if they’re so risky?
Because they solve real problems. They let you buy crypto with a credit card, trade instantly, and access dozens of coins in one place. Decentralized exchanges (DEXs) can’t match that ease of use - yet. For beginners, CEXs are the only practical entry point. But they’re a trade-off: convenience for control. Once you’re comfortable, move your funds off the exchange.
What’s the safest way to store crypto?
Use a hardware wallet like Ledger or Trezor. These devices store your private keys offline, away from hackers. Pair it with a strong password, enable withdrawal address whitelisting, and use an authenticator app (not SMS) for two-factor authentication. Never leave large amounts on an exchange - even for a day.
How do I know if my exchange is secure?
Check their security page. Look for: true multi-signature wallets, cold storage ratios above 90%, public audit reports, and clear insurance details. Kraken and Coinbase publish detailed whitepapers - many others don’t. If the exchange hides its security practices, assume the worst. Also, check user reviews on Trustpilot or Reddit for recent withdrawal issues or hack responses.
Rebecca Andrews
I'm a blockchain analyst and cryptocurrency content strategist. I publish practical guides on coin fundamentals, exchange mechanics, and curated airdrop opportunities. I also advise startups on tokenomics and risk controls. My goal is to translate complex protocols into clear, actionable insights.
More Articles
Bybit Crypto Exchange Review - Security, Fees & 2025 Hack Impact
A detailed Bybit crypto exchange review covering security, fees, the 2025 hack, and whether to keep assets on the platform or use self‑custody.
