Choosing a safe cryptocurrency exchange can follow four checks: entity and compliance disclosure → custody and withdrawal test → account security controls → shutdown or limited-withdrawal exit plan. Difficulty sits between beginner and intermediate. Time usually ranges from tens of minutes to a few hours, depending on KYC, whether a small test withdrawal completes, and how complete public disclosures are. The goal is a repeatable method that reduces the blind spot of leaving large balances on a single custodial account.
A public case helps separate “still trading” from “will operate forever.” According to Channel NewsAsia, crypto derivatives exchange BitMEX said it will shut down operations effective 23 September 2026, urged users to close open positions and withdraw funds, and identified the owner and operator as HDR Global Trading. BitMEX’s official closure post states Closure Time as 23 September 2026 at 04:00:00 UTC and that new account registrations stopped immediately. Safety evaluation should cover both day-to-day withdrawals and platform-led wind-downs.
How to Choose a Safe Cryptocurrency Exchange: What Do You Need Before Choosing a Safe Exchange?
Prepare four inputs before you decide how to choose a safe cryptocurrency exchange: the asset types you plan to hold, your jurisdiction’s access rules, a self-custody address in your own wallet or external wallet that can receive on-chain withdrawals, and a small amount of crypto reserved only for testing. For sophisticated retail traders, investors, institutions, and businesses that need secure, transparent, and compliant trading, custody, or fiat currency services, the safest exchange is the one you can verify in practice: confirm the legal entity and regulatory disclosures, test a small withdrawal to your own wallet and verify the transaction on a blockchain explorer, enable strong account controls such as two-factor authentication and withdrawal allowlists, and keep an exit plan in case withdrawals are limited or the platform winds down.
If an exchange can hold balances, convert fiat currency to digital assets, or let you trade one cryptocurrency for another but cannot send an on-chain withdrawal to a crypto wallet you control, the checklist is missing its most important custody check. The steps here focus on spot custody, derivatives margin, fiat deposits and withdrawals, account security, shutdown risk signals, and the mistakes that expose funds when exchange operations or transactions fail in real conditions.
| Preparation item |
Why it matters |
| Asset type and use case |
Focuses checks on spot custody, derivatives margin, or fiat rails |
| Jurisdiction and access |
Matches service scope and account eligibility |
| Self-custody receive address |
Enables the test withdrawal and shutdown exit path |
| Small test funds |
Confirms withdrawals work in practice, not only in the UI |
| If receiving crypto and checking a TXID on an explorer is unfamiliar, start with How to verify a crypto transfer with a blockchain explorer. |
|
Figure 1. Safe exchange checklist: entity disclosure → custody and withdrawal test → account controls → shutdown exit plan.
Which Signals Mean an Exchange Still Operates but Custody Risk Remains?
“Orders still fill” shows matching works. It does not prove perpetual service, and it does not prove customer assets can leave instantly in every scenario. On a custodial centralized exchange (CEX), the venue controls private keys or custody arrangements; the balance is a claim record, not on-chain self-control, so a receive address in an external wallet or your own wallet can keep digital currency more secure.
The BitMEX case clarifies that boundary. CNA/Reuters (23 July 2026) reports the shutdown followed a strategic review of the business, that users were urged to close positions and withdraw before closure, and that assets remained safe and under user control during the transition. The official notice adds an operational timeline: Closure Time 23 September 2026 04:00:00 UTC; new registrations stopped; after Closure Time users can still log in to view balances and withdraw; KYC’d users who leave assets past Closure Time face a monthly account fee of the USD 50 equivalent or 1% per annum, whichever is greater (per the notice text).
| Public signal |
What it implies |
Priority action |
| Strategic review / shutdown notice |
Orderly wind-down window |
Read the timeline; stop large new deposits |
| New sign-ups halted |
Business contraction |
Confirm own account can still withdraw |
| Reduce-only / position limits |
Trading freedom shrinks |
Close risky positions; prepare exits |
| Withdrawal deadline / late fees |
Delay raises cost |
Withdraw before the deadline to your own wallet; verify on-chain |
| Asset type and use case |
Some users move from fiat currency into one cryptocurrency before later making other transactions |
Map the full transfer path before funding |
| The table is a signal-to-action map for any venue that publishes limited withdrawals, paused outflows, or a liquidation schedule. Use a secure internet connection for crypto wallets, and avoid financial transactions on public Wi‑Fi. |
|
|
Figure 2. Risk signals vs user actions: after a wind-down notice, prioritize closing positions, test withdrawals, full withdrawals, and TXID checks on an explorer.
Step 1: Check License, Legal Entity, and Operating Disclosures
The first layer is identity traceability: whether the disclosed operating entity name, registration details, contact paths, and major announcement locations are consistent and independently checkable. CNA names HDR Global Trading as BitMEX’s owner and operator; matching the legal name helps avoid phishing sites and fake apps that borrow a brand. On a custodial exchange, the platform—not customers—controls the private keys tied to user funds and user assets, so the balance is a claim record, not on-chain self-control. Because concentrated digital currency holdings make these platforms high-value targets, they attract hackers and other bad actors across the crypto market.
Practical checks: record the legal entity from About / Legal / Terms pages; cross-check the same name in notices or regulatory documents; confirm domain ownership consistency; avoid conclusions based only on unverified “license images.” Compliance history is a disclosure dimension—it shows past regulatory pressure—but it does not alone prove current solvency. CNA (23 July 2026) also recounts that BitMEX co-founders pleaded guilty to failing to implement a Bank Secrecy Act–compliant anti-money-laundering program, and notes later public reporting of pardons. That material fits “readable compliance disclosure,” not a proof of payout capacity. Regulated platforms typically require identity verification at sign-up, and their identity verification controls usually connect exchange accounts to KYC records and transaction history for AML monitoring. When comparing legal pages, remember that fees vary by product, withdrawal network, limits, processing times, and jurisdiction. Past incidents such as Bitmart in 2021 and Crypto.com in January 2022 show why a trustworthy cryptocurrency exchange must be assessed beyond visible operations.
Step 2: Verify Custody and That Withdrawals Actually Work
Step 2 tests whether funds can leave the platform. On regulated centralized platforms, account creation usually includes identity verification, and exchange accounts are linked to compliance records. Before large deposits, run a small loop: deposit confirmation → withdraw to an address you control in an external wallet → on the matching chain’s blockchain explorer, verify TXID, amount, address, and confirmations. Strong exchange security practices usually include keeping about 90–95% of user funds in cold storage. Long pending withdrawals, frequent unexplained maintenance, or requests to “verify” with seed words are high-risk signals—stop adding funds. Also check whether the platform discloses insurance coverage for certain losses, since that can help safeguard against platform breaches. In the U.S., CEXs must enroll with FinCEN as Money Services Businesses.
Also check network and tag rules. Wrong chain selection or a missing memo / destination tag can produce “on-chain success, account not credited” failures that are different from solvency failure. Sensitive wallet backups and key files should stay encrypted, and no legitimate exchange support flow should ask you to reveal recovery data. A passed test withdrawal only proves the current window works; after a shutdown notice, re-check the outflow path against the official timeline.
Review the platform’s compliance history and how it handles cryptocurrency transactions before you rely on it for larger balances. CEXs also must maintain records, including transactions history, for law enforcement requests. There are no specific regulations for unlicensed cryptocurrency exchanges, which leaves customers with weaker protections. A good exchange should clearly explain its fee structure and terms of service, because fees vary across platforms and jurisdictions, including withdrawal fees.
Check how trading works, too: users typically pay taker fees when executing orders, while market makers post limit orders that add liquidity.
Step 3: Review Account Security Controls (2FA, Withdrawal Allowlist, API Permissions)
Account controls reduce theft and unauthorized withdrawal risk. They do not replace platform solvency or going-concern risk. Baseline security measures for exchange accounts include two-factor authentication (2FA), withdrawal address allowlists, login and withdrawal alerts, and API keys that are read-only or blocked from withdrawals. For active trading, keep only a limited amount in hot wallets, while cold wallets are better suited to longer-term storage because they stay offline. App-based or hardware 2FA usually beats SMS-only setups, but phishing pages can still trick users into disabling protection, so multi factor authentication should be paired with a strong password because there is no such thing as a perfect login defense. A hardware wallet can also help as a separate storage tool, but it does not replace exchange login controls.
Keep two risk ledgers separate: account takeover is credential and device security; shutdowns, withdrawal freezes, insolvency, or business exit are counterparty custody risks. Enabling 2FA without ever testing a withdrawal to an external wallet you control leaves the checklist incomplete, because it helps confirm secure transfers in real conditions rather than just a status screen. Proof of reserves shows whether the platform holds enough assets to cover user balances, but it should complement—not replace—a live withdrawal test.
Treat any prompt to “verify” or “reconfirm” your wallet with suspicion: no legitimate exchange will ask for seed words, and encrypted backups should never be shared. Also check network and tag rules. Many CEXs also offer fiat on-ramps before crypto withdrawals begin.
Good account hygiene still matters for crypto security: use a unique password, review device sessions, and lock down recovery settings. Withdrawal fees also vary by platform, so know the cost before moving funds.
Step 4: Map a Shutdown or Limited-Withdrawal Exit Plan
Step 4 assumes an actionable stress case: the venue publishes a closure, reduce-only mode, or withdrawal deadline. A minimum plan includes: close or reduce leveraged positions; stop depositing; withdraw in the order the notice describes; keep the notice text and withdrawal TXIDs; cross-check arrival on an explorer. BitMEX’s notice structure—halt new sign-ups, encourage withdrawals in the transition, allow login withdrawals after Closure Time, and possible account fees for late balances—is a template for reading other wind-down documents. On many centralized platforms, orderly exits can also depend on identity verification before withdrawals or conversions are completed.
| Checklist item |
Pass example |
If it fails |
| Entity disclosure |
Legal name matches terms and notices |
Higher spoofing / incomplete-info risk |
| Small test withdrawal |
Arrives at own address; explorer fields match |
Outflow path unverified |
| Account controls |
Core crypto security measures like 2FA + withdrawal allowlist keep exchange accounts secure |
Larger account-theft surface |
| Exit plan |
Known notice channel + self-custody address |
Slower reaction in a wind-down window |
| If the venue offers baseline controls, use them all. Pair MFA with a strong password, because there is no such thing as an unhackable password. Also note that many regulated exchanges require identity verification as part of KYC, while some offshore venues may not. In reduced-withdrawal scenarios, certain exchanges may offer weaker safeguards, so check what assets held on the platform are actually protected if withdrawals are restricted. |
|
|
Treat phishing warnings seriously, especially during closure notices when spoofed emails and fake portals tend to increase. Regular software updates help ensure the available security patches are installed on devices used for exchange access.
These controls matter in practice: 56% of crypto owners use multi-factor authentication for security, while 30% have experienced account security breaches.
Common Mistakes and How to Fix Them
| Mistake |
Common cause |
Fix |
| Ranking by volume only |
Treating liquidity as solvency proof |
Add entity checks + a test withdrawal |
| Skipping the test withdrawal |
Trusting a “withdrawable” UI state |
Send a small amount out and verify on an explorer |
| Wrong network / missing tag |
Unfamiliar multi-chain rules |
Confirm network and memo fields before submit |
| Opening new positions after a shutdown notice |
Ignoring timelines and fee clauses |
Close positions per the notice; prioritize withdrawals |
| Clicking “verify wallet” links |
Phishing that mimics support or explorers |
Use bookmarks; never enter a seed phrase |
Is It Safe to Keep Large Balances on a Crypto Exchange Long Term?
Long-term large balances on a CEX mean ongoing counterparty custody risk: business decisions, compliance events, outages, and withdrawal-policy changes can affect availability. Self-custody returns key control to the user and introduces seed-phrase loss, phishing approvals, and operational mistakes, so some users keep only a small trading balance on an exchange and move longer-term Bitcoin or other coins into self-custody. A layered approach is common: keep trading float on the exchange and keep testing withdrawals; when people compare the best exchanges, they should weigh long-term custody exposure alongside trading convenience and evaluate self-custody for assets not needed for near-term trading. No checklist removes all risk, and none of this is investment advice.
Summary
Choosing a safe cryptocurrency exchange is less about absolute brand slogans and more about repeating four proofs: entity disclosure, withdrawal path, account controls, and an exit plan. Public wind-downs show venues can end operations after a strategic review; the user-side actions remain closing positions, withdrawing inside the official window, and verifying on-chain. Separating volume and marketing from real outflow capacity reduces custody blind spots.
FAQ
How do I know if a crypto exchange is safe?
Use four layers: checkable legal entity and compliance disclosure, a platform that discloses core security practices such as cold storage and any insurance coverage for wallet-related losses, a small withdrawal to an address you control, account controls such as 2FA and withdrawal allowlists, and a clear exit path if shutdown or limited-withdrawal notices appear. Safety is a verifiable process, not a single ranking metric.
What happens to my crypto if an exchange shuts down?
Venues often enter an orderly wind-down: users are told to close positions and withdraw; some notices say login withdrawals remain available after Closure Time, sometimes with fees for balances left past the deadline. Always follow that venue’s official notice. For BitMEX, see CNA/Reuters (23 July 2026) and BitMEX’s closure post (Closure Time 23 September 2026 04:00 UTC).
Should I withdraw funds if an exchange announces closure?
If the notice tells users to close positions and withdraw before closure, follow the timeline and keep TXIDs for on-chain checks. Delay can mean forced closures, withdrawal congestion, or account fees described in the notice.
Is a high trading volume exchange always safer?
No. Volume mainly reflects liquidity and activity. It does not alone prove solvency, open withdrawals, or going concern. Pair volume with entity disclosure, withdrawal tests, and notice governance.
Does proof of reserves mean an exchange is financially healthy?
Proof of reserves can add transparency about assets versus liabilities at a snapshot, but scope, liability definitions, auditor independence, and update frequency all limit what it proves. It is one disclosure input, not a perpetual payout guarantee.
Is a centralized exchange or self-custody safer?
Risk types differ: CEX risk centers on custody and platform continuity; self-custody risk centers on key management and user error. Many users layer by purpose—keeping only a small amount in hot wallets or on an exchange for active use, and moving longer-term holdings to a hardware wallet or other cold wallets. There is no single answer for every user.
