Is My Crypto Safe on an Exchange? KYC, Custody, Freeze Risk
Lesson 9 of 10 · Beginner
How does a centralised exchange hold your assets?
When you deposit crypto on a centralised exchange (CEX), the assets are usually moved from your personal deposit address into a few large pooled wallets: part in “hot” wallets for daily withdrawals and a larger part in “cold” wallets. From that moment, your balance is just a number in the exchange's internal ledger.
Trades inside the exchange are not recorded on the blockchain either; the exchange simply moves numbers in its internal books. That is why trades are fast and carry no network fee. But it also means that a withdrawal is a request, not an automatic right: the exchange can delay or refuse it because of a security review, a legal restriction, a liquidity problem or an account freeze. Legally, you are a creditor of the exchange, and how well that claim is protected depends on the law of the country where the exchange operates and on its user agreement.
KYC, and why you should never use a borrowed account
Licensed exchanges must verify the identity of their users under anti-money-laundering rules. The checks do not stop at sign-up: according to an analysis published by the American Bar Association on OFAC settlements, exchanges screen users by IP address, device and behaviour throughout the life of the account. An account that is open today can be restricted tomorrow.
One high-risk pattern is the rented account: renting out or borrowing a bank account or a verified exchange account. The owner of an account used for money laundering or fraud can be treated as an accomplice in many jurisdictions. And whoever operates through someone else's account has no control at all: the real owner can withdraw the assets at any time, or the account can be closed. We teach no method of getting around identity checks or restrictions; those routes are both illegal and usually end in lost funds.
What does proof of reserves actually prove?
Some exchanges publish a proof of reserves report. The basic idea: the exchange discloses its wallet addresses so anyone can see the assets on the blockchain, and publishes the list of what it owes users in a structure called a Merkle tree, so each user can check that their balance is included in that list.
What it shows: at the time of the report, specific assets were held at the disclosed addresses.
What it does not show:
- that those assets were not borrowed or moved immediately after the report;
- that all of the exchange's liabilities, including loans and off-chain obligations, appear in the report;
- that the assets are liquid and of good quality.
So proof of reserves is better than nothing, but it is not a substitute for a full audit.
Exchange hacks: even the big ones
Recent history shows that an exchange's size does not guarantee its security:
- Bybit, February 2025: according to Picus Security citing the FBI, the Lazarus group compromised the Safe wallet development infrastructure and manipulated the transaction that signers saw, taking about 1.5 billion dollars; the largest theft in crypto history.
- Nobitex, June 2025: according to BleepingComputer, a group calling itself Predatory Sparrow sent about 90 million dollars to addresses nobody holds the keys to, effectively burning the funds, and leaked the exchange's source code.
- Coinbase, May 2025: according to CNBC, several support staff were bribed and leaked customer data, which was then used in scams impersonating support.
The common lesson: keep on an exchange only what you need for trading, and treat any “support” contact you did not initiate as suspicious.
Freeze and sanctions risk: documented facts with dates
Freeze risk comes from several directions, and it is best understood through documented facts. Users in sanctioned regions face an additional layer of risk: international platforms restrict service to those jurisdictions and screen continuously.
- Platform enforcement: in November 2022, Kraken paid OFAC about 362,000 dollars over 826 transactions by users who appeared to be in a sanctioned jurisdiction, and in 2022 Bittrex was fined 24 million dollars over users in sanctioned countries. Platforms respond to cases like these by tightening checks and closing accounts.
- Sanctions on service providers: according to US Treasury announcements, OFAC added several exchanges and related services in sanctioned regions to its sanctions list in 2026. The practical consequence: international platforms and issuers screen for links to sanctioned entities, and assets that have been in contact with them may be flagged, frozen or rejected.
- The token issuer: Tether said in a statement on 28 September 2026 that during 2026 it had helped freeze about 550 million dollars of USDT linked to sanctions-related activity.
The honest conclusion: assets on an exchange, or held as USDT, are not an insured bank deposit. Freezes, account closures and local restrictions are real and documented. Expose yourself only to the extent you can tolerate being locked out, keep records of your transactions, and do not trust anyone selling a “guaranteed method” against freezes.
Common mistakes
- Treating an exchange balance as the same thing as assets in a personal wallet; on an exchange you are a creditor.
- Renting out or borrowing a verified account; it carries legal risk and takes control of the assets away from you.
- Seeing a proof-of-reserves report as a full audit and a guarantee of solvency.
- Keeping all your assets on an exchange because it is “a big exchange”.
- Trusting a call or message from “support” that you did not initiate.
- Buying a promise of a “guaranteed method” to prevent account or Tether freezes.
What do volume and data say here?
Some of an exchange's behaviour can be checked on the blockchain, and some cannot:
- Addresses disclosed in proof of reserves: you can open them in an explorer and see how the balance changed over time. A sharp, unexplained fall in reserves is a sign worth asking about.
- Exchange inflows and outflows: on-chain dashboards show total deposits and withdrawals of large exchanges. But internal transfers between an exchange's own wallets, or custodians, can create false signals; do not interpret this data with certainty.
- Token freeze operations: adding an address to the USDT blacklist is itself a transaction on the blockchain and can be seen in an explorer. According to Crypto Briefing, on 9 October 2026 Tether froze about 1.45 million USDT in THORChain vaults and reversed it about three hours later, an example showing that a freeze can catch unintended targets too.
What you cannot see: the exchange's internal ledger, its liabilities and its compliance decisions about your account. So on-chain data does not complete the picture; it only makes part of it verifiable.
📊 See real gold futures volume behind these ideas: free order flow course · today's gold volume map
Frequently asked questions
What is the safest crypto exchange?
We do not rank or recommend any exchange. Instead of names, look at the criteria: licence and regulator, security record, reserve transparency, sanctions and restriction risk, and how much you actually need to keep there.
Can an international exchange close the account of a user in a sanctioned country?
Yes. The documented record shows that international exchanges review accounts throughout their life by IP, device and behaviour, and have restricted or closed accounts linked to sanctioned countries. We do not teach ways to get around these checks.
What is the risk of renting out an exchange account?
In many jurisdictions the owner of an account used for money laundering or fraud can be treated as an accomplice. In addition, your assets and identity documents end up in someone else's hands.
Education only, not a recommendation to buy or sell; we never give signals. Price examples are illustrative. Test any method on a demo account first, with strict risk management.