This article is for general information, not financial or investment advice. Rules change, exchanges update their policies without much warning, so check current details directly with the platform or the relevant regulator before you act on any of it.
A crypto exchange being trustworthy and a crypto exchange being popular are two different questions, and people mix them up constantly. Ranking high on app store charts, running flashy ads, or having a name you've heard a hundred times tells you almost nothing about whether your funds are actually safe there. What tells you something is a specific set of checks – regulatory paperwork, proof of reserves, incident history, and how the platform's reviews hold up when you look closer than the star rating.
Key Takeaways
- Registering as a Money Services Business with FinCEN is self-reported. It confirms a form was filed, not that the exchange is licensed or supervised.
- Proof of reserves catches a missing pile of assets. It doesn't catch hidden liabilities or a founder who's the only person holding the private keys.
- Even Trustpilot ratings get gamed – Trustpilot suspended Binance's TrustScore in March 2026 after detecting fake reviews on the profile.
- Zondacrypto's 2026 collapse in Poland wasn't a hack. It was a missing founder and a cold wallet nobody else could open.
- A small deposit-and-withdrawal test still tells you more in five minutes than most "About Us" pages ever will.
A License Isn't Automatically a Green Light
The first thing most guides tell you to check is whether an exchange is registered somewhere official. Fair enough, but the word "registered" is doing a lot of quiet work here.
In the US, businesses handling crypto often register with FinCEN as a Money Services Business. What people miss: this registration is self-reported. The entity fills out a form, FinCEN posts it, and that's roughly the extent of the verification at that stage. A match in the registry confirms the paperwork was filed – it doesn't mean the business is licensed, supervised, or compliant with anything beyond having submitted the form. Worth checking anyway, since a business that hasn't even bothered to register is a much clearer red flag than one that has.
In the UK, the equivalent is the FCA Register. In the EU, the picture changed in 2026: MiCA (Markets in Crypto-Assets Regulation) now requires crypto-asset service providers to get authorized by national regulators, feeding into a centralized register run by ESMA. That's a heavier bar than a self-reported US registration, and it's part of why some platforms have been quietly folding or restructuring rather than clear it.
None of this replaces common sense. A license is a floor, not a guarantee.
Proof of Reserves Explains Less Than People Assume
Proof of Reserves became a household phrase in crypto after FTX collapsed in 2022, when investigators found a gap of roughly $8 billion between what FTX claimed to hold and what was actually there. PoR is the industry's answer: a cryptographic method, usually built on a Merkle tree, that lets an exchange prove it holds enough assets to cover what it owes customers, and lets any individual user check that their own balance was actually counted in that total, without exposing anyone else's numbers.
It's a real improvement. It's also not the whole picture, and 2026 gave a clean example of why.
In April 2026, a Polish forensic firm called Recoveris published an analysis showing that Zondacrypto's operational Bitcoin wallets – the ones used for daily withdrawals – had dropped from an average of about 55.7 BTC to 0.086 BTC. A 99.7% collapse. The exchange's CEO pointed to a separate cold wallet holding 4,503 BTC, worth roughly $330 million, as proof the company was still solvent. Except he then admitted the company couldn't actually access that wallet. The private keys belonged to the platform's founder, who has been missing since 2022 and never handed them over. So the "reserves" existed on paper and on a blockchain explorer, and were functionally useless to anyone. Polish prosecutors opened a fraud investigation, the entire supervisory board resigned, and the case became a genuine political story in Poland.
The lesson isn't that PoR is worthless. It's that a snapshot of assets says nothing about who can actually move them, or what the exchange owes on the other side of the ledger.
What Recent Collapses Actually Looked Like From the Inside
Reading about a handful of specific failures tends to stick better than a generic checklist, mostly because each one breaks in a slightly different way.
Bybit lost approximately $1.5 billion in Ethereum on February 21, 2025, in what the FBI attributed to North Korea's Lazarus Group. The attack didn't crack any encryption – it manipulated what the wallet signers saw on their screens during a routine transfer, tricking them into approving a transaction that sent funds straight to the attackers. Bybit closed the resulting gap in its reserves within about 72 hours, through loans, whale deposits and market purchases, and stayed operational. That part matters: a big hack doesn't automatically mean a platform is finished, if it has the balance sheet and the partners to cover the hole fast. What's less reassuring is how little of the stolen money has actually been recovered since – tracing and freezing funds after the fact has produced only a small fraction of the total, even with blockchain analysts and stablecoin issuers actively hunting for it.
DSJEX and its sister operation, BG Wealth Sharing, collapsed in May 2026 after running a $150 million Ponzi scheme that promised daily returns between 1.3% and 2.6%. What stands out isn't the scheme itself – fixed daily returns are close to a guaranteed red flag on their own – but that thirteen regulators across five continents had already issued public warnings about it before it fell apart. The warnings existed. Almost nobody who lost money seems to have checked for them.
BlockFills, a Chicago trading and lending firm, filed for Chapter 11 in March 2026 after freezing customer withdrawals, with a lawsuit alleging it had commingled client crypto with its own operating funds and quietly built up a shortfall of around $77 million. Those specific allegations haven't been proven in court, but the frozen withdrawals were very real for the people who couldn't get their money out.
Three different failure modes – external attack, custody dependent on one missing person, and an old-fashioned Ponzi scheme with a regulatory paper trail nobody read. None of them required exotic technical knowledge to spot in hindsight.
Reading Trustpilot and Reddit Without Getting Played
Checking user reviews is standard advice, and it's still worth doing – just not at face value.
In March 2026, Trustpilot suspended Binance's TrustScore after finding a batch of fake reviews on the exchange's profile. Around the same time, close to 80% of Binance's reviews on the platform sat at one star. That's a strange combination if you think about it for a second: a company allegedly buying fake positive reviews while its genuine review base skewed overwhelmingly negative. It's a decent reminder that a star rating on its own tells you very little. What's more useful is whether individual reviews are dated, whether they're marked as verified, and whether they link back to something checkable.
ChangeNOW, for one, publishes a running feed of dated real customer reviews sourced directly from Trustpilot, with each entry linking back to the original post so anyone can go confirm it wasn't invented. That doesn't prove the sample is complete or unfiltered – a company choosing what to show on its own site is still a company choosing – but at least the individual entries are traceable, which is more than most marketing pages offer.
Independent outlets do their own digging separately from anything a platform publishes about itself. BeInCrypto's 2026 review of ChangeNOW is one example of that kind of hands-on, third-party writeup, worth reading alongside – not instead of – whatever the exchange says about itself.
Reddit works a bit differently. There's no star rating to game, but threads get buried, and a handful of loud complaints can look like a bigger pattern than it actually is. Search for the exchange name plus "withdrawal" or "support" and skim a few months of results rather than one thread.
Five-Minute Tests You Can Run Before You Deposit Anything
A few checks take less time than reading this article did.
Send a small amount – twenty dollars is enough – and try to withdraw it right away. If the platform delays for days, or suddenly asks for an "anti-money-laundering fee" before it'll release your own money, that's the scam pattern almost word for word: it's the same trick DSJEX ran before withdrawals stopped entirely.
Check whether an AML/KYC policy is published somewhere official, not just mentioned in a help-center article that can be edited without notice. Even privacy-focused platforms need one; its total absence usually means either the operation is too immature to have written one, or it's avoiding scrutiny on purpose.
And pay attention to how a swap actually works. A platform that only needs a destination wallet address is asking for less than one that wants you to connect your wallet directly, granting it permissions over your assets. That's a different security model, and it's a common vector for phishing.
Skim whatever review page the platform runs before bothering with the withdrawal test, then grab a handful of those entries and check them against Trustpilot yourself. Two minutes, maybe three if the review page is buried somewhere odd. Either the numbers roughly match and you move on, or they don't – and that's your cue to keep looking.
FAQ
Does a low Trustpilot score always mean an exchange is untrustworthy?
Not necessarily. Financial services in general attract disproportionately more complaints than praise, since frustrated users are far more likely to leave a review than satisfied ones. Look at what the negative reviews actually describe – repeated withdrawal problems are a different signal than one-off complaints about fees or slow support.
What is proof of reserves, in plain terms?
It's a cryptographic method that lets an exchange demonstrate it holds enough assets to cover what it owes users, using a Merkle tree so individual customers can confirm their own balance was counted without seeing anyone else's data. It shows assets exist. It doesn't show what the exchange owes elsewhere, or who controls the keys.
Does FinCEN registration mean a platform is regulated?
No. It means the business filed a registration form. FinCEN doesn't verify the information submitted and explicitly warns that registration isn't an endorsement.
What's the fastest single test before trusting a new platform with real money?
A small deposit followed immediately by a withdrawal attempt. Legitimate platforms process it without friction. Scams tend to introduce delays or fees at exactly that step.
