Crypto Exchange Risk After the Last Cycle: Custody, Proof of Reserves and Insurance in 2026

Crypto exchange risk in 2026 is the risk that a platform holding a customer's coins cannot or will not return them, and the last cycle showed how it happens. On December 13, 2022 the SEC charged FTX's founder with diverting customer funds to his trading firm through a virtually unlimited line of credit funded by the platform's customers, while raising more than $1.8 billion from investors ^[3]. Three protections that cover securities and bank deposits do not cover coins: SIPC protects cash and securities at a failed member broker up to $500,000 but states that bitcoin, ether, dogecoin and solana are not protected even at a member firm ^[1], and the FDIC warned on August 19, 2022 that deposit insurance does not cover crypto products and issued cease-and-desist letters to five companies for suggesting otherwise ^[2]. The scale at stake is large: Coinbase Global (COIN) alone reported $246 billion of assets on its platform at June 30, 2026, down from $294 billion three months earlier ^[4]. Bitcoin (BTC) closed at $77,300 on September 2, 2026, 21.8% higher than 30 days earlier, a reminder that the value exposed to custody risk can change quickly ^[6].

Crypto exchange risk: what actually went wrong last cycle

The FTX complaint is the clearest record of the failure mode. According to the SEC, customer funds were commingled with the founder's hedge fund, Alameda Research, which was exempted from the platform's risk safeguards and used the money for undisclosed venture investments, real estate and other purposes ^[3]. The failure was not a hack and not a market crash; it was the absence of segregation between customer property and the operator's own balance sheet. Every custody question an investor asks in 2026 is a version of the same one: if this company failed tomorrow, would my coins be mine or the estate's?

Three structural answers exist, with very different outcomes:

• Segregated custody at a regulated trust company. Assets are held for the customer's benefit, off the operator's balance sheet, and should not be available to the operator's creditors.
• Omnibus custody with a contractual promise. The platform pools customer coins and promises to keep enough on hand; whether customers are owners or unsecured creditors in a bankruptcy depends on the user agreement and the court.
• Self-custody. The customer holds the keys, and the platform holds nothing.

How the largest U.S. platform reports its custody

Coinbase's second-quarter 2026 investor materials show assets on platform of $246 billion at June 30, 2026, a $48 billion decline from March 31, which the company attributed mainly to outflows tied to exchange-traded fund activity, given its role as primary custodian for several spot bitcoin ETFs ^[4]. The company describes its custody platform as battle-tested and states that it stores more crypto than any other platform ^[4]. The useful point for investors is not the marketing language but the fact that a public company discloses the number every quarter, and that the spot bitcoin ETFs which use it as custodian disclose their holdings under securities law. Comparable disclosure from offshore platforms is voluntary and unaudited.

What changed in the rules for broker-dealers

On December 17, 2025 the SEC's Division of Trading and Markets said it would not object to a broker-dealer treating itself as having physical possession of a crypto asset security under the customer protection rule if it meets five conditions, including written policies and controls designed to protect private keys from theft, loss or unauthorized use, and assurance that no other person, including the customer or a third party, can transfer the asset without the broker-dealer's authorization ^[5]. This brings crypto securities custody inside the same possession-and-control framework that governs stocks. It does not extend SIPC coverage to bitcoin, which SIPC continues to treat as outside the Securities Investor Protection Act ^[1].

Proof of reserves: what it shows and what it hides

After 2022, many exchanges began publishing proof of reserves: a cryptographic attestation that wallets controlled by the exchange hold at least as many coins as customers are owed, often with a Merkle tree that lets each customer verify their own balance was included. It is better than nothing and worse than an audit. Its limits are specific:

1. It shows assets at one moment. Coins can be borrowed for the snapshot and returned afterward.
2. It rarely shows liabilities in full. Off-chain debts, margin loans and obligations to affiliates do not appear in a wallet balance.
3. It does not prove segregation. A wallet that holds enough coins can still belong to the operator's estate in bankruptcy.
4. It is usually not an audit under professional standards, and the accounting firm involved often disclaims an opinion on the exchange's solvency.

A proof of reserves therefore answers the question "were the coins there on that day" and leaves open "whose coins are they" and "what else does the company owe."

Insurance: what is and is not covered

Three kinds of protection get confused. FDIC insurance covers deposits at an insured bank if the bank fails; it does not cover crypto held anywhere, and the FDIC has ordered companies to stop implying that it does ^[2]. SIPC covers cash and securities at a failed member brokerage up to $500,000, including $250,000 for cash, but excludes unregistered digital assets and never covers a decline in value ^[1]. Commercial crime insurance, which some platforms buy, covers a portion of assets against theft such as a hack or employee fraud, is usually far smaller than total customer assets, and generally excludes losses from a customer's own compromised credentials. None of the three covers the FTX case, where the loss came from the operator's own use of customer money rather than from a bank failure, a broker failure or a theft by outsiders ^[3].

What investors may consider in 2026

The market-oriented lesson of the last cycle is that disclosure and competition, not bans, separated the survivors from the failures: platforms that publish audited financials, use regulated custodians and disclose customer asset totals each quarter attracted the assets, while opaque ones lost them. Regulation that requires segregation and clear bankruptcy treatment supports that process; regulation that pushes activity offshore undermines it. Practical steps follow from the risks above. Investors may consider keeping only trading balances on any platform, checking whether the user agreement treats customer coins as customer property, reading the platform's public filings if it has them, and treating a proof of reserves as a starting point rather than a guarantee. Price data on DataPorium's crypto page shows bitcoin's 30-day gain of 21.8% into September 2, 2026 and its 90-day gain of 21.2%; the same volatility that creates those gains is what makes a frozen withdrawal queue so costly ^[6].

The last cycle showed that crypto exchange risk is a segregation question, and neither proof of reserves nor insurance answers it the way regulated, disclosed custody does.

Key takeaways

• FTX failed because customer funds were commingled with an affiliated trading firm, not because of a hack, according to the SEC's December 2022 complaint ^[3].
• SIPC excludes bitcoin, ether, dogecoin and solana from protection; FDIC insurance does not cover crypto held anywhere ^[1][2].
• Coinbase reported $246 billion of customer assets on platform at June 30, 2026, down $48 billion in a quarter on ETF-related outflows ^[4].
• Proof of reserves shows assets at one moment; it does not show liabilities, segregation or solvency.
• Since December 2025, broker-dealers can custody crypto asset securities under the customer protection rule if they meet strict private key controls ^[5].

Frequently asked questions

Is crypto on an exchange insured?

Not by the FDIC, which covers bank deposits only, and not by SIPC, which excludes unregistered digital assets such as bitcoin and ether. Some platforms carry commercial crime insurance for a portion of assets against theft, which does not cover an operator misusing customer funds ^[1][2].

What is proof of reserves and can it be trusted?

It is a snapshot showing that an exchange's wallets held at least the coins owed to customers on a given day. It does not show off-chain liabilities, prove that customer coins are segregated, or amount to an audit of solvency.

What happened to FTX customers' money?

The SEC alleged in December 2022 that customer funds were diverted to the founder's hedge fund, Alameda Research, through an effectively unlimited credit line and used for venture investments, real estate and other undisclosed purposes ^[3].

How much crypto does Coinbase hold for customers?

Coinbase reported $246 billion of assets on its platform at June 30, 2026, down from $294 billion at March 31, 2026, with most of the outflow tied to ETF activity for which it acts as custodian ^[4].

Sources & References

1. [1] SIPC: What SIPC protects
2. [2] FDIC press release PR-60-2022: Advisory to FDIC-insured institutions regarding crypto companies (August 19, 2022)
3. [3] SEC press release 2022-219: SEC charges Samuel Bankman-Fried with defrauding investors in crypto asset trading platform FTX
4. [4] Coinbase Global, Inc. Q2 2026 shareholder presentation (Form 8-K exhibit, SEC EDGAR)
5. [5] SEC Division of Trading and Markets: Statement on the custody of crypto asset securities by broker-dealers (December 17, 2025)
6. [6] DataPorium crypto prices (BTC-USD daily history)