A crypto exchange is a platform where users buy, sell and swap crypto-assets against each other or against fiat currency such as dollars or euros. Seen through the lens of crypto security & rules, the decisive questions are who holds the customers’ assets, how the platform protects them, and which licensing, anti-money laundering and consumer protection rules apply to it.
Most trading volume runs through centralized exchanges that act as custodians and intermediaries, while decentralized exchanges execute trades through smart contracts directly from users’ wallets. The two models carry very different risks, from operator insolvency and fraud on one side to smart contract bugs and phishing on the other.
How a centralized crypto exchange operates
A centralized exchange runs an order book and matching engine similar to a traditional trading venue. Customers deposit fiat or crypto into accounts held by the exchange, trade balances recorded in its internal ledger, and withdraw to their own wallets or bank accounts when they choose.
Because most trades never touch a blockchain, internal transfers are fast and cheap. The trade-off is counterparty risk: until withdrawal, the customer holds a claim on the exchange, not the coins themselves. Exchanges typically keep most assets in cold storage offline and a smaller share in hot wallets to process withdrawals.
| Component | Function | Key risk |
|---|---|---|
| Matching engine | Pairs buy and sell orders | Outages during volatile markets |
| Custody system | Stores client assets in hot and cold wallets | Key theft, insider misuse |
| Fiat gateway | Bank and card deposits and withdrawals | Banking partner withdrawal |
| Compliance stack | KYC, transaction monitoring, sanctions screening | Fines, account freezes |
| Derivatives and lending desks | Margin, futures, yield products | Leverage and liquidation losses |
Types of crypto exchanges
The term covers several business models. Each one places custody, control and legal responsibility in a different place, which determines both the user’s safety and the regulatory treatment.
| Model | Who holds assets | Typical rules | Main user risk |
|---|---|---|---|
| Centralized exchange (CEX) | Exchange | Licensing, KYC, AML | Insolvency, fraud, freezes |
| Decentralized exchange (DEX) | User wallet and smart contracts | Varies, often unclear | Contract bugs, phishing |
| Brokerage app | Broker or custodian partner | Licensing, KYC, AML | Wide spreads, limited withdrawals |
| Peer-to-peer marketplace | Escrow or the counterparties | Platform-level KYC | Payment fraud, scams |
| Hybrid exchange | User, with off-chain order matching | Depends on structure | Operator dependence |
A decentralized exchange removes the custodian but not the risk. Trades are priced by an automated market maker or on-chain order book, users sign every transaction themselves, and losses usually come from malicious token approvals, fake tokens with familiar tickers or front-running. Regulators increasingly look at the front end and its operator rather than the contracts, so access to a DEX interface can still be restricted by jurisdiction.
Rules that apply to crypto exchanges
Most major jurisdictions now treat exchanges as regulated financial service providers. In the European Union, the MiCA regulation requires authorization as a crypto-asset service provider, with duties on capital, governance, segregation of client assets, complaint handling and market abuse prevention. Elsewhere, exchanges may need money transmitter, virtual asset service provider or securities licenses.
| Obligation | What it requires | Purpose |
|---|---|---|
| KYC | Verify customer identity before trading | Prevent anonymous abuse |
| AML monitoring | Detect and report suspicious transactions | Counter money laundering |
| Travel rule | Send originator and beneficiary data with transfers | Traceability between providers |
| Sanctions screening | Block sanctioned persons and addresses | Enforce sanctions law |
| Asset segregation | Keep client assets apart from own funds | Protect clients in insolvency |
| Disclosures | Fees, risks, conflicts of interest | Informed customer decisions |
These requirements follow international standards set by the FATF, which extended its recommendations to virtual asset service providers. Implementation still differs between countries, so a platform licensed in one place may serve customers elsewhere without equivalent protection.
Security risks and how exchanges address them
Exchange failures fall into two broad groups: external attacks such as hot wallet hacks and account takeovers, and internal failures such as commingling of client funds, hidden leverage or outright fraud. The second group has caused some of the largest customer losses in crypto history.
- Proof of reserves reports show on-chain holdings, but without liabilities they cannot prove solvency.
- Multi-signature and MPC custody spread key control so that no single employee can move funds.
- Withdrawal allowlists and delays limit damage if an account password or session is stolen.
- Independent audits and regulatory supervision check governance, segregation and financial statements.
Users face risks of their own: phishing sites imitating exchange logins, SIM swap attacks against SMS codes, fake support agents, and pig butchering scams that lead victims to deposit into fake trading platforms that look like real exchanges.
When an exchange does fail, customers typically become unsecured creditors in insolvency proceedings unless assets were properly segregated. Recoveries can take years and are often paid in fiat at the value on the bankruptcy date, which is why segregation rules are central to modern exchange regulation.
Choosing and using an exchange safely
A careful user starts by checking whether the exchange is licensed in the user’s own jurisdiction and whether client assets are legally segregated. Beyond that, practical habits matter more than any single feature.
- Enable hardware security keys or app-based two-factor authentication instead of SMS codes.
- Keep only trading balances on the exchange and move long-term holdings to self-custody.
- Bookmark the official address and never log in from search ads or messages.
- Record deposits, trades and withdrawals, because they are usually relevant for crypto tax.
The idea in brief
A crypto exchange is a marketplace for digital coins. On most exchanges, you hand your money to the company, and it keeps track of what you own, much like a bank account for crypto.
That is convenient, but it means you are trusting the company to stay honest and solvent. Rules such as identity checks and separation of customer money exist to make that trust safer, and moving coins you do not trade to your own wallet reduces how much you depend on it.
A practical scenario
A retail investor in the European Union wants to buy about 3,000 euros of bitcoin each year. Before opening an account, she checks the public register to confirm the exchange holds a MiCA authorization, completes identity verification with her passport, and activates a hardware security key.
She buys monthly through the exchange’s order book, then once a quarter withdraws the accumulated bitcoin to a hardware wallet, first adding the address to a withdrawal allowlist with a 24-hour delay. When a phishing email later imitates the exchange and asks her to reconnect her account, the attempt fails: the stolen password alone cannot pass the security key or redirect withdrawals.