Disclosure: This article is information and opinion, not financial advice. See our full disclaimer.
FTX processed billions in daily volume and had a Super Bowl ad. Celsius had 1.7 million users. QuadrigaCX was Canada’s largest exchange. All three are gone, and in every single case, the warning signs were visible months before the money disappeared — to anyone who knew what to look for.
That’s the uncomfortable truth about exchange collapses: they’re rarely surprises. They’re pattern failures that most users didn’t check for. This guide covers the ten red flags that show up again and again in exchange post-mortems, and — more useful — the specific check you can run for each one, today, in a few minutes.
The short version
The biggest crypto exchange red flags are slow or newly restricted withdrawals, yields with no explained source, missing proof of reserves, no verifiable legal entity or license, guaranteed-return promises, a very young domain, unsolicited “support” contact, forced use of a native token, fee structures that don’t add up, and sloppy security basics.
1. Withdrawals get slower — or grow new “verification” steps
This is the flag that matters most, because it’s usually the last one you’ll see. Celsius froze withdrawals on June 12, 2022, citing “extreme market conditions” — it filed for bankruptcy a month later. FTX halted withdrawals on November 8, 2022, and was in Chapter 11 within three days. Before the freeze, users of both reported delays creeping from hours into days.
An exchange inventing new withdrawal hurdles — surprise re-verification, “security reviews” on outbound transfers only, minimum holding periods that didn’t exist last month — is often an exchange managing a liquidity problem.
Run this check: before depositing anything meaningful, deposit a small amount and withdraw it the same week. Time it. Then search “[exchange name] withdrawal problems” sorted by the last 30 days on Reddit and X. One angry user is noise; forty in a month is signal.
2. Yield with no explained source
Celsius offered up to 18% APY on some assets. Anchor Protocol, the engine behind Terra/UST, paid a “stable” 20% until the whole ecosystem erased roughly $40 billion in May 2022. Neither could ever explain, in concrete terms, where the yield came from — because the honest answer was “from new deposits and escalating risk.”
Yield itself isn’t a scam; staking and lending have real, modest returns. The red flag is the missing explanation. If the answer to “who pays this and why?” is marketing language instead of a mechanism, you are the mechanism.
Run this check: find the yield’s source in the platform’s own docs. If you can’t diagram it in one sentence (“they lend my ETH to margin traders and pass me part of the interest”), skip it.
3. No proof of reserves — or wallets you can’t find
After FTX, major exchanges started publishing proof-of-reserves: cryptographic attestations (usually Merkle-tree based) letting you verify your balance is included in wallets the exchange actually controls. Kraken, Binance, OKX, and others now publish these. An established exchange that still refuses to show reserves in 2026 is making a choice.
Be honest about the limits, though — proof of reserves shows assets, not liabilities. An exchange can display $2B in wallets while owing $3B. It’s a floor for trust, not a ceiling.
Run this check: look for a proof-of-reserves page on the exchange itself, then cross-check its main wallets on a reserves tracker like DefiLlama’s CEX transparency dashboard. Hidden wallets on a platform holding customer funds: walk away.
4. You can’t find out who actually runs it
QuadrigaCX lost about CA$190 million of customer money in 2019 when its founder died holding sole access to the cold wallets — investigators later concluded the exchange had been operating as a fraud, with fake trading and customer funds moved to the founder’s personal accounts. One man. No board, no audits, no second keyholder. Nobody checked.
A real exchange has a registered legal entity, named executives, a physical jurisdiction, and licenses you can verify in a government database — not just claim on a landing page.
Run this check: take the license number from the exchange’s footer and verify it at the source: the FCA register (UK), FinCEN’s MSB registry (US), or your local regulator’s list of authorized crypto providers (in the EU, MiCA-licensed CASPs are listed by national regulators). A license that’s claimed but not findable is worse than no license claim at all.
5. Guaranteed returns, “AI trading,” and risk-free anything
The oldest flag, still the most profitable for scammers. “Guaranteed 2% daily.” “Our AI bot never loses.” “Risk-free arbitrage.” No legitimate exchange guarantees returns — real ones make money from trading fees and spreads, and they say so plainly.
The 2025 twist is that the fake platforms look excellent. Cloned UIs, fabricated volume, manufactured Trustpilot reviews. Design quality stopped being a trust signal years ago; the promises are where the tell lives.
Run this check: if any marketing page contains the words “guaranteed,” “risk-free,” or a specific promised return, close the tab. This one check filters out the majority of outright frauds.
6. The domain is younger than the “since 2019” claim
Fake exchanges routinely claim years of history on a website registered eleven weeks ago. It takes under a minute to catch.
Run this check: look up the domain on a WHOIS service (ICANN’s lookup works fine). Registered four months ago but “trusted since 2018”? Done. While you’re at it, sanity-check trading activity: a platform claiming huge volume but showing near-empty order books and wide spreads is printing numbers, not matching trades.
7. Someone brought you there
Nobody legitimate DMs strangers about an exchange. The “wrong number” text that becomes a friendship that becomes an investment tip is a documented playbook — pig-butchering operations run it at industrial scale, and the “exclusive platform” they steer you to is controlled by them end to end. It shows you fake profits until your deposit is large enough to be worth stealing, then invents a “tax” you must pay to withdraw.
Same family: “support agents” who contact you first. Real exchange support never initiates contact, and never asks for passwords, 2FA codes, or seed phrases. The Coinbase incident of late 2024 — where bribed support contractors leaked data on tens of thousands of users — shows even real support channels get weaponized for follow-up phishing.
Run this check: ask how you found this platform. An ad or your own research is normal. A person you’ve never met in real life is the red flag itself — the platform is almost irrelevant at that point.
8. Everything routes through their token
Forced conversion of deposits into a native token, withdrawals paid only in that token, or “boosted” yields exclusively for token holders — these structures make your exit dependent on an asset the platform itself controls and can devalue. FTX’s balance sheet was famously propped up by FTT, its own token; when its value cracked, so did the exchange.
To be fair on the trade-off: native exchange tokens aren’t inherently scams — BNB holders get real fee discounts on Binance, and that’s a legitimate loyalty mechanic. The line is optionality. A discount for using the token is fine. A requirement to hold it to get your money out is not.
Run this check: read the withdrawal terms before depositing. If exiting in the asset you deposited isn’t guaranteed, don’t enter.
9. The fee math doesn’t add up
Fees you can’t find before signing up. Withdrawal fees discovered only at withdrawal time. Spreads wide enough to hide a second fee inside. Legitimate exchanges publish full fee schedules — maker/taker rates, withdrawal costs per asset — because competing on fees is part of their business. Platforms that hide fees are telling you where their real revenue comes from.
Run this check: find the complete fee schedule in under two minutes without creating an account. Can’t? That’s your answer.
10. Security basics are missing
No app-based or hardware 2FA (SMS-only is weak). No withdrawal address whitelisting. No mention of cold storage policy. No bug bounty program. No disclosed security audits. Typos in the interface. Each of these alone is minor; three together describe a platform that treats security as a cost, and platforms like that eventually prove it — over $2 billion was stolen from crypto services in the first half of 2025 alone, per Chainalysis.
Run this check: before funding an account, confirm the exchange supports authenticator-app or hardware-key 2FA and address whitelisting. Enable both on day one.
Already on an exchange that’s waving flags?
Don’t announce, don’t wait for clarity, don’t hope. Withdraw in stages starting now — flag number one teaches that by the time trouble is official, withdrawals are already frozen. Move funds to a wallet you control or a licensed exchange you’ve verified. If a withdrawal gets blocked, document everything (screenshots, ticket numbers, timestamps) and file a report with your national fraud authority — recovery is rare, but reports are what get platforms investigated and domains seized. And ignore anyone who contacts you offering to “recover” your funds for a fee; recovery scams specifically farm the victims of the first scam.
FAQ
How do I know if a crypto exchange is legit?
Verify, don’t vibe: confirm its license in the regulator’s own database, check the domain age against its claimed history, find its proof-of-reserves page, test a small deposit-and-withdrawal cycle, and search for withdrawal complaints from the last 30 days. Fifteen minutes of checking beats any number of five-star reviews.
Are unregulated exchanges automatically scams?
No — regulation varies wildly by country, and some functional exchanges operate in gray zones. But an unregulated exchange offers you no legal recourse when something goes wrong, and “something goes wrong” is a recurring event in this industry. Treat unregulated platforms as high-risk venues for money you can fully afford to lose, not as a home for savings.
Can I get my money back from a fake exchange?
Usually not, and anyone who guarantees recovery is running the follow-up scam. Your realistic moves: report to your national fraud authority and the platform where the scammer found you, notify your bank if fiat was involved (chargebacks occasionally work for card deposits), and document everything. Law enforcement does seize scam infrastructure — but individual restitution is the exception, not the rule.
Is it safe to keep crypto on any exchange long-term?
Safer than it was in 2022, on the top licensed platforms — but “not your keys, not your coins” survived as a saying because it keeps being true. Our view: an exchange is a place to trade, not a place to store. For meaningful long-term holdings, self-custody in a hardware wallet removes the entire category of risk this article is about.
Spotted an error or an outdated fact? Tell us — corrections policy here.
Leave a Reply