This Phemex review starts with access, because many readers are not allowed to use it. Phemex is an offshore derivatives exchange founded in Singapore in 2019. As of October 2026 it is not authorised under the EU’s MiCA rules, the UK FCA lists it as an unauthorised firm, Ontario’s Capital Markets Tribunal banned it permanently in June 2025, and its terms exclude US residents. Where it is permitted, the key question is security: in January 2025 attackers drained an estimated $69 million to $85 million from its hot wallets. This draws on regulator decisions, incident reports and Phemex’s pages.
Key takeaways
- Phemex’s restricted list, as summarised from its terms, includes the US, UK, UAE, Australia, Hong Kong, India and four Canadian provinces; it holds no MiCA authorisation.
- The January 23, 2025 hack hit hot wallets on about 16 blockchains; Halborn estimated about $73 million, with North Korean involvement suspected but not confirmed.
- Phemex staged withdrawals back chain by chain, published proof of reserves and promised compensation; full terms of that plan are hard to verify publicly.
- Phemex’s help centre lists 0.01% maker / 0.06% taker on futures and 0.1% on spot for standard accounts.
- Selected BTC and ETH perpetuals advertise leverage up to 150x, which a price move of well under 1% can wipe out.
Where Phemex is registered and who it blocks
Phemex is not available to everyone, and where it does operate, its registrations are mostly anti-money-laundering filings rather than full licences. The picture as of October 2026:
| Jurisdiction | Status | Authority and date |
|---|---|---|
| United States | Excluded under Phemex’s terms. A FinCEN money services business registration has been reported for Phemex Ltd; FinCEN states its registrant list is not an endorsement or licence | Phemex terms; FinCEN MSB search |
| Ontario, Canada | Permanent ban from Ontario capital markets; $300,000 administrative penalty, disgorgement of US$39,712.43 and costs | Capital Markets Tribunal, Phemex Limited (Re), 2025 ONCMT 9, June 13, 2025 |
| United Kingdom | FCA warning: not authorised and may be targeting UK consumers; no FOS or FSCS access | FCA warning list |
| Austria | Warning that Phemex is not authorised for licensable banking services | FMA Austria |
| European Union | No MiCA authorisation found; a pre-MiCA Lithuanian VASP registration was reported for a Phemex entity, but Lithuania required MiCA licences from January 1, 2026 | ESMA interim MiCA register; Bank of Lithuania |
The Ontario case is the most detailed regulator record. The tribunal found that from November 2019 to January 2023 Phemex Limited and Phemex Technology Pte. Ltd. ran an unregistered crypto trading platform for Ontario residents; Phemex conceded the breaches in an agreed statement of facts in September 2024. Phemex also names Australia, the UAE, Hong Kong and India among restricted territories in its terms, last revised in mid-2025 according to third-party summaries; check the live terms on phemex.com before opening an account.
If your country or province is restricted, do not use Phemex. Masking your location breaches its terms and can lead to frozen balances. This review is not legal or financial advice.
The January 2025 Phemex hack, step by step
The incident is a textbook case of hot-wallet risk at a centralised exchange: the funds kept online to process withdrawals were taken, while cold storage was reportedly untouched.
| When | What happened | Source |
|---|---|---|
| January 23, 2025 | Blockchain security firms flag suspicious outflows from Phemex hot wallets; Phemex suspends withdrawals | Phemex statements; The Record |
| Same day onward | Attacker drains wallets one after another across roughly 16 chains, including Ethereum, Solana, XRP Ledger and Bitcoin, swapping freezable tokens for ones that cannot be frozen | Halborn, January 27, 2025 |
| January 24, 2025 | CEO Federico Variola says USDT and USDC withdrawals should resume within hours; staged reopening by chain follows | CoinGape; Phemex updates |
| Following weeks | Loss estimates settle in a range: about $69 million (Immunefi), about $73 million (Halborn), at least $85 million (later reporting citing on-chain analysts) | Immunefi; Halborn; BleepingComputer |
| February 2025 | Phemex reports restoration of withdrawal services, according to later reviews | Secondary reporting |
Halborn suspected compromised private keys, possibly because keys for several hot wallets were stored together, and noted the pattern resembled Lazarus Group operations. That attribution was a suspicion rather than a finding. Phemex did not publish a full public post-mortem identifying the root cause that we could locate as of October 2026.
What Phemex changed afterwards
Phemex’s public response had three parts. First, it reopened withdrawals gradually and reviewed them manually for a period, crediting deposits sent to old addresses after review. Second, the CEO shared a proof of reserves snapshot and stated that cold wallets holding most funds were secure. Third, Phemex said it was preparing a compensation plan and took a snapshot of user balances; reporting at the time did not include final payout terms, and we could not confirm from primary sources how fully affected balances were covered.
Proof of reserves has limits worth stating plainly. A reserves snapshot shows that assets were held at a moment; unless paired with an audited view of liabilities, it does not show the exchange owes less than it holds, and it says nothing about how keys are managed. Treat it as one data point, not a safety certificate.
What did not change: Phemex users have no deposit insurance or government compensation scheme, and the exchange remains offshore. For a framework to compare custody practices across platforms, see our guide to the safest crypto exchanges.
Phishing note: Phemex’s official domain is phemex.com. The FCA has separately warned about a different firm using a similar “Phemex Global” name, which shows how lookalikes appear. Type the address yourself or use a bookmark, install apps only from links on that site, and treat unsolicited “account managers” and support DMs as scams.
Phemex futures and spot fees (table)
Standard rates below come from Phemex’s help centre as of October 2026. Phemex’s live fee page shows personalised rates after login and says the transaction record is final, so your own rate may differ by VIP level.
| Product | Maker | Taker | Notes |
|---|---|---|---|
| Perpetual futures (VIP 0) | 0.01% | 0.06% | Funding payments charged separately between longs and shorts |
| Spot (VIP 0) | 0.10% | 0.10% | Discounts for holders of Phemex Token (PT) per fee page |
| VIP tiers | Lower | Lower | Reached by 30-day volume or asset balance; check the VIP portal |
Phemex ran a time-limited zero-fee promotion when it launched round-the-clock TradFi futures in February 2026; such promotions end and should not be confused with standard pricing. Funding rates on perpetuals can cost more than trading fees over a long holding period, and they change every funding interval.
Leverage on Phemex: the risk you take
Phemex’s newest materials advertise up to 150x leverage on selected BTC and ETH perpetuals, while its January 2026 futures guide cited up to 100x. Maximum leverage only applies to the smallest position tiers; larger positions require more margin.
A rough, illustrative calculation shows why high leverage is dangerous. Ignoring fees and maintenance margin, your initial margin is gone after an adverse move of about 1 divided by the leverage:
- At 150x, roughly a 0.67% move against you.
- At 20x, roughly a 5% move.
- At 5x, roughly a 20% move.
In reality, liquidation comes earlier because Phemex requires maintenance margin and uses a mark price, and fees and funding reduce your buffer. Isolated margin limits loss to the margin assigned to one position; cross margin can draw on your whole futures balance. Our explainers on leverage trading and spot versus futures go deeper on the mechanics.
Phemex review: how it compares with larger derivatives venues
On listed rates, Phemex’s 0.01% standard futures maker fee is lower than the 0.02% standard maker rate that a 2026 Forklog comparison attributes to Binance, Bybit and OKX. That is the main pricing argument for it. Against that, consider order-book depth (thinner books mean more slippage on large orders), the 2025 incident, and the absence of any major licence covering retail derivatives. Larger offshore venues have their own regulatory problems, so the comparison is about degrees of risk, not a safe alternative. Our roundup of crypto derivatives exchanges sets out the criteria, and our how to buy crypto hub links other exchange reviews.
FAQ
Is Phemex safe after the 2025 hack?
Phemex kept operating, restored withdrawals and published proof of reserves after losing an estimated $69 million to $85 million from hot wallets in January 2025. However, the root cause was never fully published, compensation terms are hard to verify, and users have no insurance or compensation scheme. Keep only active trading balances there, if you use it.
Can US residents use Phemex?
No. Phemex’s terms list the United States as a restricted territory as of October 2026. A FinCEN MSB registration reported for a Phemex entity is an anti-money-laundering filing and does not authorise serving US retail traders. Using a VPN to get around the restriction breaches the terms.
What are Phemex futures fees?
Phemex’s help centre lists 0.01% maker and 0.06% taker for standard futures accounts as of October 2026, with lower rates for VIP tiers. Spot trades cost 0.1% for both sides. Funding payments apply separately to perpetual positions and can outweigh trading fees over time.
Does Phemex have proof of reserves?
Yes. Phemex published proof of reserves, including after the January 2025 hack. A reserves snapshot shows the assets held at that moment; it does not prove the exchange’s total liabilities are covered, and it is not an audit of security practices.
Crypto is volatile and risky; this is education, not financial advice. Do your own research.
