Can an exchange take your money? Here is what has actually happened

"Can an exchange take your money" is a question with a boring answer and an interesting one. The boring answer is yes, obviously, in the sense that any business holding your money can fail to give it back. The interesting answer is that the six ways this actually happens behave completely differently — different warning signs, different odds, different things you can do — and lumping them together is why so much advice on this subject is useless.

So this page does not argue about whether exchanges are trustworthy. It sorts the failures by type, using cases that have been through courts and administrators rather than rumours, and then tells you which types you can do anything about.

Type one: the platform spent what you deposited

This is the failure that produced the largest losses, and it is the one most worth understanding, because it does not look like anything from the outside until the day it does.

The mechanism is simple. You deposit. The platform is holding an asset that is doing nothing. Somewhere inside the company, someone works out that the idle asset could be lent out, invested, or used as collateral, and that the returns would be very good. For a while, they are. Then a market moves, the position cannot be closed, and the assets that were supposed to be sitting there are not sitting there.

FTX is the case with a verdict attached: customer assets were used to cover an affiliated trading firm, and its founder was convicted of fraud in 2023. Celsius and Voyager, in 2022, are the same shape with different intent — businesses that had told customers they could earn a yield, which was true, without making equally clear that the yield came from lending customer deposits to counterparties who might not repay.

The uncomfortable part: from the customer's chair, "we defrauded you" and "we made a bad bet with your money" produce the same screen. Withdrawals are paused. The announcement mentions unprecedented market conditions. There is a promise of an update. The update does not come.

Type two: the platform was robbed

Exchanges hold concentrated pools of an asset that transfers irreversibly. That makes them a permanent target, and large thefts have happened repeatedly across the industry's history — Mt. Gox in 2014 being the case everyone remembers, with roughly 850,000 bitcoin unaccounted for.

What matters for you is not whether a platform can be attacked. All of them can. It is what happens next, and that comes down to two things: how much of customer assets sat in systems connected to the internet, and whether the company had the capital to absorb the loss.

Well-capitalised platforms have covered thefts out of their own funds and customers noticed nothing but a day of downtime. Thinly-capitalised ones have passed the loss to customers through a "socialised loss" or simply collapsed. Same event, opposite outcomes, and the difference was decided long before the attack.

Two things you can look at without any technical knowledge: whether the platform publishes anything about cold storage practice, and whether it maintains a dedicated reserve fund for exactly this scenario. Several large platforms do maintain such funds. Read what they actually say those funds cover — the details matter, and they are usually on the platform's own help pages, such as Binance's support centre.

Type three: nobody can find the keys

QuadrigaCX in 2019 is the canonical case. The Canadian platform's founder died, and the company said the private keys controlling customer funds had died with him. Investigators later concluded the story was worse than key mismanagement — the funds had been used elsewhere — but the initial premise was believable precisely because it is technically possible.

Custody that depends on one person is a real category of risk that does not exist in traditional finance in the same form. It is also the hardest for a customer to detect, because a platform with terrible internal controls and a platform with excellent ones present identical user interfaces.

This is the strongest argument for the "not your keys, not your coins" position — and also the point where that slogan needs its own examination, because self-custody replaces this risk with a different one that has its own body count. We take that apart separately.

Type four: the run

A platform can be broadly solvent and still fail, if enough people ask for their money at the same time and the assets are not instantly available. This is what banks used to do routinely before deposit insurance, and it is why deposit insurance exists.

Crypto platforms have no equivalent backstop in most countries. That means the rational move for any individual customer, at the first hint of trouble, is to withdraw immediately — and because everyone can see that logic, the rush arrives faster than it would in a banking system. A rumour on a Saturday can become a withdrawal pause by Monday.

You cannot prevent this. What you can do is decide in advance what your trigger is, because the useless version of this knowledge is realising on the day that you do not know whether to act. A written rule — "if withdrawals are paused for more than 24 hours without a specific explanation, I move what I can" — is worth more than any amount of monitoring.

Type five: the platform is fine, but your account is not

This is by far the most common thing that happens to ordinary people, and it gets almost no coverage because it is not a story.

Accounts get frozen during compliance reviews. Verification documents get rejected. A deposit that arrived from a third party triggers a source-of-funds request. A platform withdraws service from a country and gives residents a window to exit. None of these are the platform taking your money; all of them feel like it while they are happening.

What makes the difference between a bad week and a bad year:

• Your name matches everywhere. The name on the account, the bank account and the identity document should match exactly. Mismatches are the single most common cause of stuck withdrawals.
• Money comes from your own account. Third-party deposits are a compliance flag on nearly every regulated platform.
• You verified before you needed to. Doing identity verification while trying to withdraw during a market panic is the worst possible time; queues are long exactly when everyone wants out.
• You can find the real support channel. Which is not the person who direct-messages you offering to help — that is a well-worn attack, covered in the scams file.

What proof of reserves proves, and what it quietly does not

After 2022, most large platforms began publishing proof of reserves. It is a genuine improvement and it is routinely oversold, so it is worth being precise about what it does.

What it shows: that at a moment in time, the platform controlled a set of on-chain addresses holding a certain quantity of assets, and — in the Merkle tree versions — that your own balance was included in the total that was claimed. You can verify your own inclusion without anyone learning anyone else's balance. That is real cryptography doing real work.

What it does not show: what the platform owes. Reserves are one side of a balance sheet. A platform could hold a billion in visible assets and owe three billion to customers and lenders, and a reserves-only attestation will show a healthy-looking number. Borrowed assets can be moved in before a snapshot and out after it. Off-chain liabilities do not appear on chain at all.

The industry term for the missing half is proof of liabilities, and combining both is what people mean by proof of solvency. Approaches using zero-knowledge proofs are being developed to close the gap. As of our check in August 2026, no widely-adopted standard delivers full, continuously-verified solvency, and if a platform's marketing implies otherwise, read the actual methodology document rather than the headline.

Practical stance: a platform with no proof of reserves at all is telling you something. A platform with one has cleared a low bar, not a high one. Weight it accordingly.

Type six: the platform leaves your country

The least dramatic entry on the list, and the one most likely to affect a reader in an ordinary year.

Platforms withdraw from markets. Sometimes it is a regulator's decision, sometimes it is the platform deciding a licence is not worth the cost, and occasionally it is a payment partner rather than the platform that leaves — with the same practical effect, because the local deposit and withdrawal method stops working.

When this happens properly there is an announcement and a withdrawal window, usually measured in weeks or months. Trading is disabled first, withdrawals last. Nobody takes your money and nothing is stolen. The failure mode is administrative: people miss the notice.

They miss it because the announcement goes to the email address on the account, and the account was opened years ago with an address they no longer read. Then the window closes, and recovering the balance becomes a support case in a jurisdiction the platform has just exited — which is exactly the moment its support capacity for that market is smallest.

Two habits cover this entirely: use an email address you actually read, and check any account you have not looked at in six months. The second one also catches expired verification documents, which is the other reason a dormant account becomes difficult.

How to read a bankruptcy outcome, if you are ever in one

Worth knowing in advance, because the vocabulary is unfamiliar precisely when you are least able to absorb it.

Three things surprise people consistently:

You are probably an unsecured creditor. Not an owner of specific assets — a person owed money, standing in a queue behind secured creditors and administration costs. Whether customer assets were legally yours or the platform's turns on how they were held and on the terms you agreed to, and those terms are frequently less protective than customers assume.

Your claim is frozen at the filing date. The value is fixed at the moment proceedings began. If you held an asset that later tripled, your claim does not triple with it — you are owed the earlier figure. FTX customers are being repaid in dollars against November 2022 balances for exactly this reason, and it is the single largest source of anger about an outcome that is, in recovery-percentage terms, unusually good.

It takes years, and it involves paperwork. Claims must be filed, deadlines are real, and the claims agent's website — not social media, and never someone who contacts you — is the only place to do it. Bankruptcy proceedings attract a second wave of fraud aimed at creditors, offering to buy claims cheaply or to expedite recovery for a fee.

If you ever need it, the official claims agent for a proceeding is a matter of public record. For FTX that is the court-appointed claims site, and every large proceeding has an equivalent. Anyone who contacts you first about your claim is not it.

So what does any of this let you actually do?

Most advice at this point becomes a list of things nobody does. Here is the shorter version, ordered by how much protection it buys per unit of effort.

1. Do not keep money on a platform that you are not using. This is the whole game. Exchange failures hurt in proportion to what was sitting there. Everything else is a rounding error next to this one habit.
2. Decide your exit trigger before you need it. Write it down. "Withdrawals paused without explanation" or "the platform stops answering support" are workable triggers. "I'll know when something feels off" is not.
3. Withdraw a small amount early. The first withdrawal is where you discover the fee, the delay, the verification tier you did not know about. Find out with a small amount rather than under pressure — this is really a question about whether you can get money out at all, and it is worth testing.
4. Spread across two platforms if the amount matters to you. Diversifying platforms costs a little friction. It removes the single point of failure that has caused every case on this page.
5. Check whether anything is insured before you assume it is. The answer surprises most people, which is why it has its own page.

One last note on the FTX numbers, because they get quoted in both directions. Customers are being repaid, and the main classes have now passed 100% of their claim value — that is genuinely better than the early expectation of near-total loss. It is also a repayment in dollars against a balance frozen in November 2022, arriving in tranches across four years. Both halves are true, and which half you emphasise usually says more about what you already believed than about the case.