No exchange is risk-free. On the evidence available in October 2026, though, Kraken and Coinbase rank as the safest crypto exchange options for US users, with Bitstamp (now owned by Robinhood) close behind. Kraken publishes verifiable proof of reserves. Coinbase discloses audited financials as a public company and holds a New York BitLicense. Gemini has strong regulatory credentials but is retrenching. This page shows the scorecard we used so you can judge any exchange yourself, and it covers the steps that cut your own risk most.
- “Safe” has several parts: the exchange stays solvent, resists hackers, keeps your assets separate if it fails, and protects your login.
- Proof of reserves is useful only when it covers liabilities too and you can verify that your own balance is included.
- FDIC insurance never covers crypto, and exchange “crime insurance” protects the exchange, not usually your hacked account.
- Even well-run exchanges have incidents. Bybit lost about $1.5 billion in February 2025, and Coinbase disclosed a customer-data leak in May 2025.
- The single biggest risk reducer is yours to control: strong login security, a withdrawal allowlist and self-custody for long-term holdings.
The safest crypto exchange scorecard: six tests
Our best crypto exchange list weighs fees, coins and features. This page looks only at security and the ability to get your money back. We apply six tests.
1. Proof of reserves, with liabilities
A proof of reserves (PoR) shows that an exchange holds on-chain assets at least equal to customer balances at a snapshot date. A good PoR includes a Merkle tree, a cryptographic structure that lets you check your own balance was counted, plus a third-party accountant’s review. Its limits: it’s a point-in-time snapshot, it covers only listed assets, and it usually doesn’t reveal company debts or off-chain obligations. A PoR is not a full financial audit.
2. Licensing and supervision
In the US, look for state money transmitter licenses (you can search any company on NMLS Consumer Access) and, ideally, New York oversight through a BitLicense or a NY trust charter, which is among the strictest regimes. In Europe, the Markets in Crypto-Assets Regulation (MiCA) now requires a crypto-asset service provider (CASP) license, and its transition periods ran out by 1 July 2026. A license doesn’t prevent hacks, but it brings capital, custody and audit rules, and a regulator who can step in.
3. What insurance actually covers
FDIC insurance can apply to US dollar balances held at partner banks on a pass-through basis. It never covers crypto. Exchanges that mention “crime insurance” generally mean a policy covering theft from the exchange’s own systems, often only for a portion of assets. These policies typically exclude losses when someone logs into your account with your stolen credentials. Read the exchange’s own insurance page and the fine print before treating insurance as a safety net.
4. Breach and incident history
A past incident isn’t automatically disqualifying. What matters is whether customers were made whole, how quickly and openly the exchange disclosed it, and what changed afterwards.
5. Cold storage and key management
Reputable exchanges keep most customer crypto in offline cold storage, with multi-signature or multi-party controls on hot wallets. The Bybit hack showed that the signing process itself can be the weak point: attackers compromised a third-party wallet interface and tricked signers into approving a malicious transaction. These claims are self-reported, so favour exchanges with independent attestations such as SOC 2 reports.
6. Customer-asset segregation in bankruptcy
The FTX and Celsius bankruptcies showed that terms of service and legal structure decide whether your coins are “yours” in a collapse. Look for clear terms that customer assets are held in custody for you and not lent out, plus a regulator that requires segregation. New York’s DFS issued guidance in January 2023 requiring licensed custodians to keep customer assets separate and to treat them as owned by customers.
Most secure crypto exchanges ranked against the scorecard
| Exchange | Proof of reserves | Key oversight | Notable incidents | Disclosure level |
|---|---|---|---|---|
| Kraken | Quarterly Merkle-tree PoR, third-party accountant; latest snapshot 30 June 2026 | US state licenses, MiCA license in the EU | No major theft of customer crypto publicly reported | Detailed PoR; self-verification tools |
| Coinbase | No Merkle PoR; audited financial statements in SEC filings | NY BitLicense, state licenses, MiCA license in the EU | May 2025 customer-data leak via bribed support staff (no keys or funds taken) | Public company (10-K, 10-Q) |
| Bitstamp (Robinhood) | Check current disclosures | Long-licensed in the EU, including MiCA (Luxembourg); US licenses | January 2015 hot-wallet hack of just under 19,000 BTC (about $5 million then) | Parent Robinhood is public |
| Gemini | Check current disclosures | NY-chartered trust company | Gemini Earn freeze in 2022 (users later repaid in kind); 2026 layoffs and exit from UK, EU and Australia | Public company since 2025 |
Kraken: strongest on proof of reserves
Kraken has run Merkle-tree proof of reserves for years, reviewed by an independent accountant. Its June 2026 snapshot showed reserve ratios at or above 100% for covered assets, including BTC, ETH, SOL, XRP and the major stablecoins, and any client can verify that their own balance was included. It also offers account protections such as a Global Settings Lock that blocks changes to security settings. Kraken hasn’t publicly reported a major theft of customer crypto. See our Kraken review for fees and features.
Coinbase: strongest on regulatory disclosure
Coinbase doesn’t publish a Merkle-tree PoR. Instead, as a US-listed company, it files audited financial statements with the SEC that report customer custodial balances. It holds a New York BitLicense, and in its FY2025 annual report it says customer crypto held under UCC Article 8 should not form part of its estate in bankruptcy. It adds that courts haven’t yet tested this. Its weak point was operational. In May 2025 it disclosed that criminals had bribed overseas support contractors to leak data on less than 1% of monthly transacting users, enabling impersonation scams. No passwords, keys or funds were taken directly. Coinbase refused a $20 million ransom, estimated costs of $180–400 million and pledged to reimburse customers who were tricked into sending funds.
Bitstamp: long track record, new owner
Bitstamp is one of the oldest exchanges still operating. Robinhood completed its roughly $200 million acquisition on 2 June 2025. Bitstamp holds a MiCA authorization from Luxembourg’s regulator and many national licenses. Its hot-wallet hack in January 2015 is old history, but worth knowing. For US customers, Bitstamp by Robinhood accounts can no longer open new positions from 1 February 2027 (selling and withdrawing still work), as Robinhood moves them to its main app.
Gemini: strong charter, shakier business
Gemini operates under a New York trust charter, a demanding custody framework. However, its Gemini Earn product froze in 2022 when partner Genesis failed, and users waited until 2024 to recover their assets. In 2026 the company cut about 30% of staff, exited the UK, EU and Australia, and lost three senior executives. Retrenchment isn’t evidence of unsafe custody, but business health is part of exchange risk.
What about Binance, OKX and Bybit?
These large offshore exchanges publish Merkle-tree reserve reports, and many people use them outside the US. Weigh their regulatory history, though. Binance pleaded guilty in 2023 to US anti-money-laundering violations and paid about $4.3 billion. OKX’s operator pleaded guilty in February 2025 to running an unlicensed money transmitting business and agreed to pay more than $504 million. Bybit suffered the largest exchange hack on record in February 2025: about $1.5 billion in ETH was stolen by North Korea’s Lazarus Group through a compromised Safe{Wallet} developer machine. Bybit said it restored 1:1 backing within about 72 hours using loans and purchases, so customers weren’t left short. Our crypto exchange comparison covers availability by region.
How to make any exchange safer for you
Most individual losses on exchanges come from account takeovers, not from the exchange being hacked. These steps matter more than which logo you pick:
Licence scope matters when judging safety; our review of Swyftx’s Australian licensing explains why its AFSL does not cover spot crypto trading.
For a case where legal restrictions matter more than features, our review of HTX (formerly Huobi) sets out the UK designation, EU transaction ban and 2023 hacks.
- Use a passkey or hardware security key for login and withdrawals where offered. Avoid SMS codes, which are vulnerable to SIM swaps.
- Turn on a withdrawal address allowlist with a waiting period for new addresses, so a hijacked session can’t send funds anywhere instantly.
- Use a unique email and password for each exchange, stored in a password manager.
- Treat inbound calls as scams. After the Coinbase data leak, fake “Coinbase security” calls became common. Exchanges don’t phone you to move funds into a “safe wallet”.
- Keep only what you trade on the exchange. Move long-term holdings to a wallet you control.
- Spread risk across more than one regulated platform if you hold large balances.
Our crypto security guide covers phishing and SIM-swap defences in depth. If you’re just starting out, our how to buy crypto guide explains the full process from account to wallet.
FAQ
What is the most secure crypto exchange in the US?
Kraken and Coinbase have the strongest combined security records for US users. Kraken leads on verifiable proof of reserves, and Coinbase on regulatory disclosure, with a NY BitLicense and audited SEC filings. Neither is risk-free. Account security on your side, such as passkeys and withdrawal allowlists, and moving long-term holdings to self-custody make a bigger difference than choosing between the two.
Are crypto exchanges insured?
Partly, and rarely in the way people assume. US dollar balances held at partner banks may have FDIC pass-through coverage, but crypto never does. Exchange crime insurance usually covers theft from the company’s own systems and often only part of it. It generally excludes losses when your login is compromised. Check each exchange’s insurance disclosures for the specifics.
What happens to my crypto if an exchange goes bankrupt?
It depends on the exchange’s terms, legal structure and regulator. If assets are properly held in custody for customers and segregated, they should be returned. If not, customers can end up as unsecured creditors, as happened at FTX and Celsius. Courts haven’t fully settled how US custody law applies to crypto, which is one more reason to keep long-term holdings in self-custody.
Is proof of reserves enough to trust an exchange?
No. Proof of reserves shows that on-chain assets matched customer balances on one date. It doesn’t reveal company debts, prove the assets weren’t borrowed for the snapshot, or protect you from hacks or fraud afterwards. Treat it as one positive signal alongside licensing, audited financials, incident history and clear custody terms.
Crypto is volatile and risky; this is education, not financial advice. Do your own research.
