Every trader accepts counterparty risk, because a balance you can trade in seconds has to be held by somebody. Almost nobody has looked at what that acceptance means in the specific event they are accepting it for. The mechanism is not complicated, it is just never described in the marketing.
A balance displayed in an account is an entry in a private database, and it records that the operator owes you something. It is not a position on a public ledger, it has not moved when you traded, and no external observer can verify it. That description sounds harsh and it is simply accurate: internal ledgers are how every venue in every market operates, because settling each trade on a blockchain would be slower and more expensive than the trading itself.
The relevant question is therefore never whether a platform uses internal records, which they all do. It is what backs those records and what happens to your claim if the entity stops functioning. Those two questions have concrete answers that vary enormously between operators who present themselves identically, and the answers are found in legal structure rather than in security pages.
You do not hold crypto on a platform. You hold a claim against a company that holds crypto, and the two behave completely differently on the day it matters.
The single most consequential question is whether client assets are legally and operationally separated from the operator's own funds. Where they are segregated, held in identifiable accounts as property of the clients, an insolvency treats them as belonging to the clients rather than as part of the estate, and they are returned rather than distributed. Where they are commingled with operating funds, they become assets of the failed company, and clients join the queue of general creditors alongside landlords and suppliers.
That difference decides whether a failure costs you a delay or costs you most of your balance, and it is settled before anything goes wrong, in documents that are usually public. It is also the question that the reassuring language on a platform's website is least likely to answer, because phrases like your funds are secure and industry-leading custody describe operational security rather than legal ownership, and the two are unrelated.
The practical form of the check is to read the terms of service, specifically the sections on title and on what happens on insolvency. If the document says that assets may be pooled, lent, or used by the operator, then it has told you plainly that they are not segregated, and no amount of security certification changes what that sentence means when a court reads it.
They look identical from outside on the day they happen, and they have completely different warning periods.
The operator, or an affiliated entity, used client assets to earn a return, and the borrower did not return them. This is the most common cause of large failures and it is frequently disclosed in advance in language nobody reads: yield programmes, earn products, and lending desks are all mechanisms by which a balance stops being held and starts being owed. The failure is not sudden from the inside; it becomes visible only when redemptions exceed what can be recalled.
A theft, a compromised signing process, or a mistake in key management removes assets that genuinely existed. This is the classic failure mode of the sector's early years and it has become less common as custody practice matured, though it has never disappeared. It is the failure most likely to be survivable if the operator holds capital against it, and least survivable if the loss exceeds what the business is worth.
The reported balances did not correspond to holdings, and the gap was concealed. This is the rarest and the most damaging, because it defeats every check that relies on the operator's own reporting. It is also the case in which a published proof of reserves is worth the most, since a genuine one is difficult to fake, and the case in which its absence is most informative.
Trading and withdrawals stop first, usually with a notice describing the pause as temporary. Then an administrator or trustee is appointed, and the entity's assets and liabilities are assessed, which takes months at minimum. Client balances are frozen at whatever value the court adopts, and that valuation date is itself a substantial matter: in a falling market, being valued at the date of failure rather than the date of distribution changes the outcome considerably.
Recovery, where it happens, is partial and slow. Historical cases have taken years and returned fractions, and the fractions are consumed further by administration costs that are paid before creditors. The specific number depends on the segregation question above more than on anything else, which is why that question is worth the ten minutes it takes to answer while everything is still working.
There is one detail traders consistently get wrong. A position that was open when trading stopped does not stay open in any meaningful sense: it is a claim valued at a moment chosen by a process you do not control, and any hedge you held elsewhere continues to move while it does not. The exposure you thought was flat is not flat, and this has surprised sophisticated participants repeatedly.
An insolvency does not pause your market risk. It freezes one side of your book and leaves the other side trading.
In most large failures, something was observable in advance. Not a prediction, which nobody had, but a set of facts that were available and that a reader would have weighted differently afterwards.
Withdrawal friction is the most reliable of them, because it is the one thing an operator cannot fake for long. Processing times that lengthen without explanation, limits that appear, a maintenance window that extends, support responses that become slower and vaguer: these have preceded a majority of failures and they are visible to any customer who tries a withdrawal. A platform that is functioning normally processes a withdrawal normally, every time, and any deviation from that is information rather than an inconvenience.
Yield is the second. A return offered on a balance has to come from somewhere, and the possible sources are lending, trading with the deposits, or subsidy. All three mean the assets are not simply held, and a rate substantially above what short-term government paper pays is a statement about which of the three is operating. This is not an accusation, it is arithmetic, and it was available in the marketing material of most of the entities that later failed.
The third is concentration of control. Where a single individual can move assets without a second approval, where the same person controls the exchange and the affiliated trading firm, or where the entity's audited accounts do not exist, the failure modes that require concealment become available. None of these guarantees anything; together they describe how much has to go right for nothing to go wrong.
A reserve attestation demonstrates that a set of addresses controlled by the operator held a certain balance at a moment in time. That is a real fact and it is narrower than the way it is usually presented. It says nothing about liabilities unless those are attested alongside it, nothing about what happened between two observations, and nothing about whether the assets were borrowed for the occasion, which has happened.
The version that carries weight includes liabilities, so that the comparison is between what is held and what is owed rather than between what is held and nothing. Some implementations let each customer verify that their own balance was included in the total, which closes the most obvious gap. Both features are identifiable from outside, and a proof that has neither is demonstrating solvency the way a photograph of a wallet demonstrates net worth.
The correct weight to give it is real but bounded. Its presence is a positive signal about one specific failure mode. Its absence, on a platform large enough that producing one would be straightforward, is a more informative signal than its presence, because the cost of producing it is low and the reason not to is rarely good.
None of this argues for withdrawing from platforms entirely, which would substitute a set of risks that are worse for most people and would make trading impractical. It argues for treating platform balances as a position with a counterparty rather than as cash, and sizing that position the way any other exposure would be sized.
The practical version is short. Keep on any platform only what the trading you are actually doing requires, and move the rest to custody you control. Read the two paragraphs of the terms of service that describe title and insolvency, once, per platform. Test a withdrawal periodically rather than only when you need one, because the test is the signal. Split balances across more than one operator once the amount matters, on the reasoning that failures are entity-specific. And treat a yield offered on an idle balance as a disclosure that the balance is being used, which it is.
The uncomfortable summary is that the questions worth asking are legal and dull, and the reassurances offered are technical and vivid. Custody hardware, insurance descriptions and security certifications all address the operational failure mode, which is the least common of the three. The two that have destroyed the most client money are answered in the terms of service and in the balance sheet, and neither appears on a landing page.
Security pages describe theft. Insolvency describes ownership. The failures that have cost clients the most were not thefts.
Usually you own a claim against the operator rather than the assets themselves, and the distinction only becomes visible in an insolvency. Whether the assets are legally segregated as client property or pooled with company funds decides whether you are returned your holdings or join the queue of general creditors, and it is stated in the terms of service.
That client assets and the operator's own funds sit together rather than in separate identifiable accounts. On failure, pooled assets become part of the estate and clients rank alongside other unsecured creditors. Segregated assets are treated as belonging to the clients and are returned. It is the single most consequential difference between two platforms that look identical.
It is one input and it is narrower than it appears. A reserve figure alone shows assets at a moment without showing liabilities, without covering the period between observations, and without proving the assets were not borrowed for the snapshot. A version that attests liabilities and lets customers verify their own inclusion is meaningfully stronger.
Withdrawal friction is the most reliable, because it cannot be faked for long: lengthening processing, new limits, extended maintenance, slower and vaguer support. Beyond that, a yield offered on idle balances tells you the assets are being used, and concentration of control over asset movement tells you how much has to go right.
They stop being positions and become a claim valued at a date the process chooses, not one you choose. Anything you held elsewhere as a hedge keeps trading while that side is frozen, so an exposure you believed was flat is not. This has caught out sophisticated participants repeatedly.
Only what the trading you are actually doing this month requires. The rest belongs in custody you control, because a balance on a platform is exposed to the operator by design and that exposure buys you nothing while it is idle. Splitting across more than one operator helps once the amount matters, since failures are entity-specific.
Treat it as a disclosure rather than a benefit. A return has to come from lending your assets, trading with them, or a subsidy, and all three mean the balance is not simply being held. That is not automatically wrong; it is a different product from custody, and it should be sized as one.
It changes the questions rather than answering them. Licensing usually imposes segregation and reporting requirements, which addresses the failures that matter most, and it varies enormously between jurisdictions that all use the word regulated. What matters is what the specific licence requires of client asset handling, which is a matter of public record.