In the wake of the ongoing FTX debacle, I wonder the following: How can a retail investor check whether a cryptocurrency exchange is safe to use, at least minimize the risk?
By safe, I mean no losing one's money due to issues with the exchange.
Personal Finance & Money Stack Exchange is a question and answer site for people who want to be financially literate. It only takes a minute to sign up.
Sign up to join this communityIn the wake of the ongoing FTX debacle, I wonder the following: How can a retail investor check whether a cryptocurrency exchange is safe to use, at least minimize the risk?
By safe, I mean no losing one's money due to issues with the exchange.
Given that most of practical regulation for crypto exchanges seems to be bankruptcy law (SCNR), it is probably safe to assume that no exchange is safe and transfer money only when you want to trade and pull out your tokens to a cold wallet as soon as the transaction got through.
However, there might be some exchanges that have spun off from stock exchanges and - even though formally not regulated as stock exchanges- should pose a much lower risk than an exchange funded by someone without experience in the field. BSDEX (as a spin-off of Börse Stuttgart) would be an example that comes to my mind, there is probably something similar in other countries.
How can a retail investor check whether a cryptocurrency exchange is safe to use, at least minimize the risk?
Generally, you would want to look for regulatory insurances/assurances. In the US, for example, that would be SIPC. If the exchange or brokerage is a member of SIPC, the SIPC would provide some assurances that your assets would be recovered in case of failure or fraud.
Even if the assurances don't explicitly include crypto assets (as is with SIPC), the fact that the brokerage is part of the scheme guarantees that they undergo certain audits and process reviews by the regulator to provide these assurances. Unless the brokerage is managing crypto in a completely separate way from everything else (which is unlikely and would probably be uncovered by these audits and flagged), you'll get some level of assurance through this regulator scrutiny.
Unfortunately most crypto brokerages and exchanges try to intentionally avoid regulatory oversight, and present it as a feature of their activity, not a bug that it is.
Without any third party providing the assurances - your recourse would be conducting your own due diligence and auditing of the brokerage. Infeasible task for an individual investor, obviously.
How can a retail investor check whether a cryptocurrency exchange is safe to use
There's no really reliable way for ordinary retail investors to check that a cryptocurrency exchange won't fail sometime in the next year.
However investors are arguably different from traders.
There is no really good reason for an investor to ask a custodian to look after their cryptocurrency investment for them if it is a medium to long term investment that does not require active trading. Many cryptocurrencies can be held in a self-custodial (AKA "non-custodial") wallet that has no dependency on any exchange or similar business. Indeed one of the primary objectives of the creators of Bitcoin was to enable two parties to make payments to one another (and hold money) without the need for any trusted third parties.
What is needed is an electronic payment system based on cryptographic proof instead of trust, allowing any two willing parties to transact directly with each other without the need for a trusted third party.
Bitcoin: A Peer-to-Peer Electronic Cash System, Satoshi Nakamoto, 2008. (The "Bitcoin whitepaper", my emphasis)
How can a retail investor [...] at least minimize the risk [of exchange failure]?
By holding investments in their own non-custodial wallet, based on software running entirely on their own computer hardware, independently of any exchange or other custodian.
Unfortunately all exchanges are vulnerable to problems like FTX. However any custodial service is going to be a risk. The easiest way to mitigate this is to move the crypto you buy to a wallet you can control, then if that exchange goes bankrupt, your wallet is still safe. Trust no-one, least of all yourself and find a way to safeguard your wallet recovery phrases.
One of the core tenets of crypto (yes, not the only one) is that there is no regulation and oversight. This is praised as a major advantage, as it allows people to trade them and pay with them, without ’evil’ banks, regulators, or governments having their fingers in it.
Unfortunately, that means that no regulators or governments watch for you over these exchanges, or even cover their losses, and they are only as good and stable as their leaders make them.
In other words, you can’t have your cake and eat it - you have to pick either ‘evil’ oversight or the wild wild west.
Two options that, at the time of writing, have not yet been covered by the existing answers are:
Shifting the vulnerability from trust in exchanges and regulation (enforcement), to trust in verifiable, yet possibly complicated, code.
Properly decentralised exchanges allow ordinary retail investors to verify how they work (albeit with the help/explanations of (audits of) cyber security specialists), and where the assets/tokents etc. are stored.
Such decentralised exchanges still allow for zero-day exploits (new bugs that nobody ever found/used/published before). Additionally, the mere fact that the code is open source, does not mean it has also been critically evaluated.
One advantage of such DEX's is that, if x% of the "regular users" evaluate (a segment of) the DEX critically, the overall trust in these DEX's increase (because the efforts add up in terms of "trust"). The same thing can not be said of centralised exchanges, because "regular users" have no direct means of verifying opague, centralised exchanges. In essence, they do not have certainty in determining whether the centralised exchanges hold the funds, and typically rely on someone telling them that it is "safe". This someone can be the centralised exchange itself, a regulator, or a third party. If a lot of people rely on those entities, the cumulative "trust" in such a centralised exchange still is as strong as its weakest link/can not be added up in terms of "trust".
How can a retail investor [...] at least minimize the risk [of exchange failure]?
Past performance does not provide guarantees for the future, however; if users consistently withdraw all their funds from the centralised exchange, the ones without sufficient liquidity will soon be found. One could argue regular users could have more confidence in an exchange that showed a liquidity level of 100% for 10 years without a single hiccup than one that has no such track record.
So to put it in context of the quoted question, if users collectively and consistently withdrawl all their funds on a specific time, (I expect) many more (de)centralised exchanges will fail initially. Over time though, the trusted/reliable exchanges should survive such procedures.
The best way to check whether a cryptocurrency exchange is safe to use is to do your own research. Look for online reviews from other users, and try to find an exchange that has been in operation for a while and has a good reputation. You should also make sure that the exchange uses good security practices, such as keeping its user funds in cold storage.