Crypto exchange safety scores
8 exchanges, one security weighting, every input on the table. 4 of 8 carry a major incident on record; 7 publish proof-of-reserves.
Security claims in crypto are usually adjectives. This page replaces them with the five things that can actually be checked: whether the exchange proves what it holds, whether it has a fund to cover losses, what has gone wrong before and how it was handled, how long it has operated, and what protects your login. The score is the security weighting of our ranking model applied to those inputs, with nothing hand-placed.
| Exchange | Safety score | Security | Reputation | Proof of reserves | Protection fund | Incidents | Operating since | 2FA | Open account |
|---|---|---|---|---|---|---|---|---|---|
1. Kraken San Francisco, United States. | 9.0 | 9.6 | 9.4 | Published | — | None on record | 2011 (15 yrs) | Authenticator app, Hardware key, Passkey, Global settings lock | Open account |
2. Coinbase United States; publicly listed on Nasdaq. | 8.8 | 9.4 | 9.2 | Not published | Commercial crime insurance on hot wallet balances |
| 2012 (14 yrs) | Authenticator app, Hardware key, Passkey, SMS | Open account |
3. Binance No single global headquarters; regulated entities in France, Dubai, Bahrain and elsewhere. | 8.3 | 8.2 | 8.0 | Published | SAFU — a dedicated user asset fund held in stablecoins | 2017 (9 yrs) | Authenticator app, Passkey, SMS, Hardware key | Open account | |
4. OKX Seychelles-registered, with regulated entities in the EU, UAE and Singapore. | 8.3 | 8.4 | 8.0 | Published | Risk reserve fund for derivatives | None on record | 2017 (9 yrs) | Authenticator app, Passkey, Email, Anti-phishing code | Open account |
5. Bybit Dubai, UAE. | 8.0 | 7.8 | 7.8 | Published | Derivatives insurance fund covering liquidation shortfalls |
| 2018 (8 yrs) | Authenticator app, Passkey, Email, SMS | Open account |
6. Bitget Seychelles-registered, with regional entities in the UAE and Lithuania. | 7.7 | 7.6 | 7.2 | Published | Large self-funded user protection fund | None on record | 2018 (8 yrs) | Authenticator app, Email, SMS | Open account |
7. KuCoin Seychelles-registered. | 7.1 | 6.6 | 6.8 | Published | — | 2017 (9 yrs) | Authenticator app, Email, SMS, Trading password | Open account | |
8. MEXC Seychelles-registered. | 7.0 | 6.8 | 6.4 | Published | — | None on record | 2018 (8 yrs) | Authenticator app, Email, SMS | Open account |
How to read the table
Proof of reserves tells you the exchange shows what it holds. It does not show what it owes, so a published Merkle tree is a floor, not a guarantee. An auditor-attested proof or audited public-company accounts count for more in the security sub-score than a self-published tree.
Protection fund is money set aside to make users whole after a loss. The name varies — SAFU, insurance fund, user protection fund — and so does what it covers: some funds exist only to absorb derivatives liquidation shortfalls, which protects the exchange's order book rather than your deposit. Read the wording.
Incidents lists every major event on the record, with a source, and how it ended. A breach that was covered in full with withdrawals open throughout is a very different fact from one that was not; both appear here because the reader, not the exchange, gets to decide how much weight it deserves.
Operating since matters because a clean decade says more than a clean year. It is one input to the reputation sub-score, not the whole of it.
Citing this page
Scores and the inputs behind them may be quoted with attribution and a link. The full weighting is published on the methodology page; the underlying data, with a source and verification date for every claim, is on each exchange's data sheet.
Frequently asked questions
What does the safety score measure?
It is the security weighting of our ranking model: the security sub-score at 4× weight, reputation at 3×, then support, deposits and the rest at lower weights. The sub-scores themselves come from the inputs shown in the table — custody disclosure, protection funds, incident history and operating record — and are reviewed at least quarterly.
Does a high score mean my funds cannot be lost?
No. It means the exchange has a stronger record and better disclosure than those below it. Any exchange is a custodian; for balances you would be unhappy to lose, self-custody removes that risk entirely. Exchanges are for trading and moving fiat.
Why does an exchange with a hack still score well?
Because how an incident was handled matters as much as that it happened. Bybit and Binance both covered user losses in full and kept withdrawals open. An unresolved or partially covered loss would be scored very differently.
Is proof-of-reserves enough?
A Merkle-tree proof shows assets, not liabilities, and is self-published. We rate an auditor-attested proof (Kraken) and audited public-company financials (Coinbase) above a self-published tree, and a self-published tree above nothing.
How often does this page change?
Sub-scores are reviewed quarterly and immediately after any material event. The data behind this page was last verified 2026-09-04. Each exchange page shows its own next-review date.