Can your exchange go bust? Ten case studies and how to check a licence

01The questions we get most: is Binance, HTX or Coincheck safe?

Most people searching "exchange bankrupt" or "is this exchange legit" have one platform in mind. So here are the facts on the brands we are asked about most, as of October 2026, before we get to the general method. One caveat up front: no exchange can promise it will never fail. This is the publicly verifiable picture, nothing more.

Binance has not gone bankrupt. It is still the world's largest exchange by volume and publishes Merkle-tree proof of reserves. In November 2023 it pleaded guilty in the US and paid about $4.3 billion; founder Changpeng Zhao was pardoned in October 2025. In Asia it operates as Binance Japan, holds a Thai licence through Gulf Binance, is licensed in Kazakhstan's AIFC and is registered with India's FIU-IND, but it is blocked in the Philippines and left Singapore back in 2021.

HTX (formerly Huobi) has not collapsed either. It still operates, but its Hong Kong arm withdrew its SFC licence application in February 2024, and it reportedly suffered a hack of about $113 million in November 2023, which the platform covered. In December 2025 Pakistan's regulator PVARA issued no-objection certificates to Binance and HTX; these are preparatory approvals, not operating licences.

Coincheck is not a scam. It is a crypto exchange registered with Japan's Financial Services Agency and was taken over by the Monex Group after its 2018 hack. Kraken says it has never lost customer funds to a hack and runs the industry's longest audited proof-of-reserves programme, yet it left Japan in 2023 and appeared on the Philippine SEC's August 2025 list of unregistered platforms: "not a scam" and "licensed where you live" are separate questions. Coinbase is a US-listed company holding a MAS licence in Singapore, and it has not gone bust.

02Ten case studies: collapses, hacks and exit scams

Line the big events up by outcome and the pattern is hard to miss. When something goes wrong, users of regulated, well-capitalised platforms with segregated assets usually get their money back; users of unregulated or fraudulent ones usually don't.

Loss figures are as reported at the time. Several hacks were attributed by the FBI and others to North Korea's Lazarus Group (TraderTraitor).

Licensed local platforms in Asia have had incidents too: India's CoinDCX lost about $44 million of company funds in July 2025, Indonesia's Indodax about $22 million in September 2024, and Korea's Upbit about ₩44.5 billion from a hot wallet in November 2025. In each case the platform absorbed the loss and customer balances were untouched. That is exactly why regulators insist on capital and cold-storage ratios.

03What actually protected users

Segregation of customer assets. When FTX failed, customer money and company money were mixed, and untangling it took two years. FTX Japan, bound by Japan's Payment Services Act, had to keep customer assets separate, so Japanese users were repaid first. Korea's Virtual Asset User Protection Act, in force since July 2024, requires at least 80% of user crypto in cold wallets and user won deposits held by banks. Singapore's MAS requires licensed platforms to hold customer assets in trust.

Regulation and capital. After DMM Bitcoin's hack, the group raised funds to make customers whole; Bybit used its balance sheet and bridge loans to close a $1.4 billion hole in three days. Unregulated platforms such as Thodex and JPEX faced no mechanism forcing them to pay anyone back.

Cold-storage share. Almost every big hack hit a hot wallet or a weak link in a multisig custody supply chain. The more sits in cold storage, the lower the ceiling on any single theft. It's one of the questions we ask in our crypto exchange rankings.

04Legit crypto exchanges: how to check a licence in each country

The only reliable test of a legit crypto exchange is the regulator's own register, not a "licensed worldwide" banner on the platform's homepage. JPEX falsely claimed licences in the US, Canada, Australia and Dubai. Here are the regulators and official registers for Asia's main markets, checked in October 2026.

Mainland China: under the 2021 notice of the People's Bank of China and nine other agencies, crypto trading services are illegal, including offshore exchanges serving mainland residents. There is no such thing as a licensed exchange there.

Three checks matter when you use a register. First, match the legal entity, not just the brand: one brand is often run by different companies in different countries, and only the local one is licensed. Second, match the website: the official domain should agree with the register, and fake domains often differ by one letter. Third, know registration from licensing: India's FIU-IND and the UK FCA's crypto registration are anti-money-laundering registrations and give investors no protection. Country detail is in our country guides, for example Hong Kong, Japan and Singapore.

05Proof of reserves: useful, but not insurance

After FTX, exchanges including Binance, OKX, Bybit, Bitget, KuCoin, Gate, HTX and Crypto.com began publishing Merkle-tree proof of reserves. The idea: the exchange hashes every customer balance into a cryptographic tree, publishes the root and its on-chain wallet addresses, and lets you confirm with your account ID that your balance was counted, and that the wallets hold at least that much.

The limits matter just as much. It is a snapshot: coins borrowed before it, or moved out after it, don't show. It rarely captures all liabilities: money owed to banks or market makers, off-balance-sheet guarantees or lending of customer assets may sit outside it. The assurance varies: some reports come from accountants or security firms, others are self-attested. Kraken has the longest-running audited programme.

No published PoR doesn't automatically mean trouble, and a published one doesn't mean all is well. CEX.IO, which we feature for card purchases, is a good example of reading the whole picture. Founded in 2013, it is a FinCEN-registered money services business in the US with money-transmitter licences in more than 30 states, and is registered with the UK FCA for anti-money-laundering purposes only. We found no public proof-of-reserves report, and it holds no licence from any Asian regulator. Put those facts together, then decide how much to keep on any platform.

06Red flags of a scam exchange, and a five-minute check

1. Check the register

   Find your regulator in the table above and confirm the platform's legal entity is licensed or registered.

2. Check the warnings

   Search the regulator's alert list and the news for "platform name + scam / collapse / warning".

3. Check the address

   Compare the website with the one on the register and bookmark it; install apps only from official stores and check the developer name.

4. Test a small withdrawal

   Deposit a little and make sure you can withdraw to your own bank or wallet before adding more.

5. Spread the risk

   Don't keep everything on one platform; move long-term holdings to your own wallet.

If you have already sent money to a suspicious platform, use the reporting channels in our security guide and beware "recovery" services, which are usually a second scam. To understand why every legitimate platform asks for ID, see KYC and buying limits. Official resources: the SFC suspicious platforms list and the Japan FSA's warnings to unregistered operators.

FAQ

Sources

• SFC Hong Kong: lists of licensed virtual asset trading platforms · checked Oct 2026
• Japan FSA: registered crypto-asset exchange service providers (1 Sep 2026) · checked Oct 2026
• Taiwan FSC Securities and Futures Bureau: VASP AML registration list · checked Oct 2026
• Securities Commission Malaysia: registered digital asset exchanges · checked Oct 2026
• SEC Thailand: licence check · checked Oct 2026
• FIU-IND compliance orders (Binance, KuCoin, Bybit and others) · checked Oct 2026

Keep reading