What Is Counterparty Risk in Crypto?
Counterparty risk is the possibility that an organization responsible for holding, transferring, lending, or settling your assets fails to meet its obligations. It is a separate risk from the one most people focus on, which is the risk that the asset's price falls. Both can produce the same outcome — less money than you had — but they arrive through different doors, and hedging one does nothing about the other.
The distinction matters because of what a platform balance is: a record of what a company owes you. Whether the matching assets exist, where they are held, and whether you hold any priority claim if the company fails are separate questions the interface does not answer.
Who Are Your Counterparties?
Most people can name one — the exchange they log into. In practice a single position often depends on several organizations, and a failure at any of them can affect access to the asset.
- Centralized exchanges. They hold customer assets, match orders, and maintain the internal ledger recording who owns what. The account balance is a liability on their books.
- Custodians. Some platforms do not hold assets themselves; they engage a third-party custodian, adding a counterparty most customers never see named in the app.
- Stablecoin issuers. A stablecoin is a claim on an issuer or on the reserves it says it holds — exposure to that issuer's reserve quality, redemption policy, and legal status, not just to a price near a dollar.
- Crypto lenders and yield platforms. Depositing assets to earn a return generally means lending them. The counterparty is the borrower, or the platform standing between you and the borrower.
- Brokers and payment apps. Some venues sell exposure to crypto without the customer ever controlling keys, sometimes without any on-chain asset behind the position.
- Market makers, OTC desks, and settlement intermediaries. Large trades often settle bilaterally, with assets or cash in transit while one side is exposed to the other.
- Token issuers. A token whose value depends on a company continuing to operate, fund development, or honor a promise carries that company as a counterparty.
- DeFi operators retaining administrative control. A protocol described as decentralized may still have upgrade keys, an admin multisig, a pausable contract, or a treasury under a small group's control. Where that control exists, the group holding it is a counterparty regardless of the label.
Concentration is easy to miss when apparently separate positions route back to the same custodian, issuer, or jurisdiction.
How Platforms Fail
Failure is not one event but a family of them, with different warning signs and different consequences for customers.
- Insolvency. Liabilities exceed assets — from trading losses, lending losses, a collapsed related entity, or a holding that lost its value.
- Fraud or misappropriation. Customer assets used for purposes the terms did not disclose, or records that do not reflect reality.
- Cyberattack. A breach of hot wallets, signing infrastructure, or internal systems. Whether customers absorb the loss depends on the entity's balance sheet and terms.
- Withdrawal suspension. Withdrawals paused for maintenance, risk management, or legal reasons. On day one, a benign pause and a terminal one look identical from outside.
- Banking disruption. Loss of a banking partner can halt fiat deposits and withdrawals even when crypto operations are unaffected.
- Asset commingling. Customer assets pooled with company assets, or across customers, so no specific asset is identifiable as yours.
- Weak internal controls. No separation of duties, no independent board, no reconciliation between the internal ledger and on-chain holdings.
- Legal seizure or freeze. A court order, law-enforcement action, or creditor claim that immobilizes assets.
- Regulatory restriction. A licence withdrawn or a product barred, forcing the platform to restrict or close accounts in a region.
- Technical outage. Matching engine or API downtime, often during the volatile conditions in which access matters most.
- Loss of keys. Key material destroyed, inaccessible, or dependent on a single person.
- Inadequate reserves. Holdings that do not cover what customers are owed, in the right assets, when customers ask for them.
The awkward part is that several of these can be underway while the platform still looks entirely operational. Deposits process, charts update, support replies. Insolvency is a balance-sheet condition, not a user-interface state, and commingling produces no visible symptom until someone asks for everything back at once.
Is Crypto on an Exchange FDIC Insured?
No. The Federal Deposit Insurance Corporation insures qualifying deposits at insured banks against the failure of the bank. Crypto assets and other non-deposit investment products are not deposit accounts and are not covered — including when purchased through, marketed alongside, or otherwise associated with an FDIC-insured bank. A bank appearing somewhere in a platform's stack does not extend deposit insurance to crypto held there.
Some platforms hold US dollar balances at partner banks in arrangements they describe as eligible for pass-through deposit insurance. Even where that is accurate for the cash, it says nothing about the crypto: insurance follows the type of asset and the failure being insured against, and it protects against the failure of the bank rather than the failure of the crypto platform. Confirm what any such arrangement actually covers against current FDIC guidance at fdic.gov rather than relying on a platform's own description of it.
Private insurance is the other thing mistaken for deposit insurance. A platform may carry commercial crime, cyber, or custody policies. Those are contracts between the platform and an insurer, not a government guarantee to customers. They typically cover named perils only, carry deductibles and aggregate limits that may be small relative to total customer assets, and pay the company rather than individual account holders. "Our assets are insured" is not an answer; the policy's covered perils, exclusions, and limits are.
Investor-protection regimes for securities accounts are sometimes invoked by analogy. Those have their own defined scope, generally addressing a broker's failure to return customer property rather than a decline in value, and their application to crypto assets is unsettled. Do not assume a securities-account protection extends to a crypto holding — check the scope stated by the relevant body, such as sipc.org, for the specific account and asset in question.
Platform Due-Diligence Questions
Each of these has a determinable answer in the account terms, custody disclosures, corporate filings, or the platform's own documentation. An answer that cannot be found is itself a finding.
- Which legal entity holds the assets? The brand on the app is often not the contracting entity. Find the entity named in the terms of service, and check whether the entity you deposit to is the same one that custodies.
- Are the assets held on-chain, or only recorded internally? Some products give exposure to a price without any corresponding asset held for you.
- Are customer assets segregated from company assets? Segregation is the difference between assets identifiable as customers' and a pool the company can treat as its own.
- What rights do customers have in bankruptcy? Terms sometimes state explicitly whether assets are customer property or whether the customer is a general creditor. Read that clause specifically.
- Which jurisdiction governs the account? Governing law and the insolvency regime that would apply are usually stated in the terms, and they may not be where you live.
- Do withdrawals carry restrictions or limits? Daily caps, holding periods after deposit, minimums, network support, and the platform's stated right to suspend withdrawals.
- Does the platform publish independently verifiable information? Audited financial statements, regulatory filings, licences you can look up in a public register, or on-chain addresses you can inspect yourself.
- Does insurance exist, and what exactly does it exclude? Named perils, limits, deductibles, whether it covers hot and cold storage differently, and who the beneficiary is.
- Can assets be transferred to an external wallet at will? If withdrawal to a self-controlled address is not supported, the position cannot be moved out of the platform's risk at all.
Hypothetical example — for education only.
A trader works through the list for a platform holding a five-figure USD balance. The terms name an offshore entity, the custody page describes a pooled omnibus arrangement, the bankruptcy clause is silent on asset ownership, and withdrawals are capped below the balance held. None of that predicts failure. It does establish that the position depends on the entity's solvency and that exiting quickly at size is not guaranteed.
Proof of Reserves and What It Does Not Prove
A proof-of-reserves exercise typically demonstrates control of certain on-chain assets and, in stronger versions, lets a customer verify their own balance is included in a claimed total. That is useful, and narrower than the word "proof" suggests.
| What it can show | What it may not establish |
|---|---|
| Assets controlled | Whether those assets were borrowed for the occasion, pledged to someone else, or shared with another entity |
| A customer balance was included | Whether all customer balances were included, if the liability set is self-reported |
| A point in time | The position an hour later — nothing in a snapshot is continuous |
| One asset or one entity | Obligations at affiliates, off-chain liabilities, debt, or legal claims |
| Arithmetic performed by a firm | An audit of financial statements, which is a different engagement with a different opinion |
Solvency means assets exceed liabilities. A report that addresses the asset side thoroughly and the liability side loosely cannot answer that, and an attestation is not an audit opinion on a company's financial statements. Many published exercises are agreed-upon-procedures engagements in which the practitioner reports on specific procedures without expressing an opinion on the whole. The report's own scope section states what it does and does not conclude; the announcement summarizing it does not.
Read alongside licences, filings, and audited statements where they exist, a reserves report adds information. Read as a solvency guarantee, it substitutes a comfortable feeling for a verified fact.
Limiting Platform Concentration
Counterparty risk cannot be diversified away, because using any platform means accepting some. It can be sized, spread, and made recoverable.
- Keep only active trading capital on an exchange. What needs to be there is the amount being traded, not the whole portfolio.
- Withdraw long-term holdings to appropriate custody. Which arrangement counts as appropriate depends on the holding and your own competence — see hot wallets vs. cold wallets.
- Test a small withdrawal before moving a large amount. A small transfer confirms the address, the network, any memo or tag requirement, and that withdrawals are processing right now.
- Whitelist withdrawal addresses where supported, ideally with a time delay on adding new ones, so a compromised session cannot immediately send funds somewhere new.
- Use phishing-resistant multifactor authentication. A hardware security key or passkey resists credential phishing in a way that codes read from a screen or delivered by text message do not.
- Keep offline account-recovery records. Which entity, which email, which addresses, and transaction history for tax and claim purposes. If a platform's site goes down, records that existed only inside it are gone.
- Review platform and jurisdiction risk periodically. Terms change, entities are restructured, and licences are granted and withdrawn — a platform assessed two years ago may not be the same counterparty today.
- Avoid a single point of failure. One venue, one custodian, one stablecoin issuer, one device, one jurisdiction, or one person who knows how to access anything are each a single point of failure. Spreading across several also multiplies the number of accounts to secure, which is a real cost rather than a free win.
Everything above is platform-side. The account-side practices — how a seed phrase is stored, how devices are kept clean, how backups are tested — are covered separately in the wallet security score, and both halves have to hold for the arrangement to work.
Self-Custody vs. Third-Party Custody
A crypto wallet does not store assets. It holds the private keys used to access them, while the assets exist as entries on a blockchain. The custody question therefore reduces to a simpler one: who holds the keys, and what happens when that party fails.
| Criterion | Self-custody | Third-party custody |
|---|---|---|
| Who controls the keys | You | The platform or its custodian |
| Main failure mode | Personal error, loss, theft, or coercion | Platform insolvency, fraud, breach, freeze, or legal restriction |
| Recovery path | Your own backup, and nothing else | Account recovery through the platform, subject to its solvency and processes |
| Convenience for active trading | Lower — funds must be moved on-chain to trade | Higher — assets sit where the order book is |
| Inheritance and estate planning | Requires a deliberate plan for key access that survives you | Platform process, which may require probate documentation |
| Who bears operational responsibility | You, continuously | The platform, to the extent its terms and balance sheet allow |
There is no winner in that table. Self-custody removes platform counterparty risk and replaces it with personal operational risk, which is not obviously smaller — losing a seed phrase can permanently eliminate access to the assets, and exposing one can let someone else take control of them. Third-party custody outsources the operational burden to an organization that may do it better than you would, at the price of depending on that organization. The appropriate choice depends on technical competence, trading frequency, the size of the holdings, and the threat model being defended against.
Lending, Yield, and Rehypothecation Risk
Depositing assets into a yield product is a different act from holding them. In most arrangements it transfers control and converts a custody relationship into a credit one: the platform now owes you assets rather than holding assets for you, and repayment depends on its ability to pay.
Rehypothecation is the re-pledging of assets already pledged as collateral. Where permitted, the same underlying asset can support several obligations at once — which works until multiple claimants want it back in the same week. Terms sometimes grant a broad right to use, pledge, or lend deposited assets; that clause, not the advertised rate, describes what has happened to the deposit.
An advertised yield figure describes none of this. It does not say where the return comes from, who is borrowing, what collateral backs the loan, whether there is a lock-up or a redemption queue, or where you stand relative to other creditors in a default. A higher rate is compensation for something. Working out what that something is, before depositing, is the only way to judge whether the compensation is adequate.
Common Mistakes
- Treating a platform balance like a bank deposit. In most arrangements it is an unsecured claim on a company, with no deposit-insurance backstop behind it.
- Assuming "insured" means deposit-insured. Private policies have named perils, exclusions, aggregate limits, and a beneficiary that is usually the company.
- Never testing a withdrawal. Learning whether withdrawals work at your size should not happen on the day you urgently need them to.
- Keeping the entire portfolio on one venue. Convenience concentrates every failure mode above into a single organization.
- Reusing exchange-account credentials. A password reused from a breached site, or an email account without strong multifactor authentication, makes the exchange's own security largely irrelevant.
- Assuming a large or well-known platform cannot fail. Size indicates scale, not solvency, and brand recognition is a marketing outcome rather than a balance-sheet fact.
- Skipping the terms of service. The clauses deciding what happens in a failure — asset ownership, governing law, the right to suspend withdrawals, the right to lend deposits — sit in the document nobody reads.
Limitations
No amount of due diligence can fully verify a private company's internal solvency from outside. Financial condition is disclosed selectively, disclosures can be incomplete or outdated by the time they are read, and the most consequential facts — how customer assets are actually held, what has been pledged, what related entities owe each other — are frequently not public at all. A platform that answers every question on this page well can still fail.
Regulatory protections differ substantially by jurisdiction and are still developing. Requirements for asset segregation, custody standards, capital, disclosure, and the treatment of customer assets in insolvency are inconsistent between countries and changing in many of them, so a protection that exists in one place may have no equivalent in the jurisdiction that governs an account. This page describes the United States position on deposit insurance and speaks generally elsewhere; it is not a statement of the law in any particular place.
Crypto transactions may also be irreversible. A transfer sent to the wrong address, on the wrong network, or to a party that will not return it generally cannot be recalled, and there is no chargeback mechanism. That asymmetry is why testing withdrawals and whitelisting addresses matter more here than the equivalent habits would in banking.
Exchange and Custody Risk FAQs
Are crypto assets FDIC insured?
No. The FDIC insures qualifying deposits held at insured banks. Crypto assets and other non-deposit investment products are not covered, even when they are purchased through, or associated with, an FDIC-insured bank. A platform may hold its own private insurance, but that is a commercial policy with its own limits and exclusions rather than deposit insurance.
Is it safe to keep crypto on an exchange?
No custody arrangement can be described as safe. Holding assets on an exchange trades away control of the private keys in exchange for convenience, faster trading, and platform-managed recovery. The tradeoff is counterparty risk: insolvency, fraud, a security breach, a withdrawal freeze, or a legal restriction at the platform can affect access to assets regardless of what the asset itself is worth.
What is counterparty risk in crypto?
Counterparty risk is the possibility that an organization responsible for holding, transferring, lending, or settling your assets fails to meet its obligations. It is separate from market risk. An asset can hold its value perfectly while the platform recording your claim to it becomes unable to return it.
Does proof of reserves mean an exchange is solvent?
No. A reserves attestation can indicate that certain assets existed at a particular moment. Solvency depends on assets exceeding liabilities, and many attestations do not establish the full liability side, do not cover the whole business, are point-in-time rather than continuous, and are not equivalent to an audit of financial statements.
Should I use self-custody instead of an exchange?
It depends on technical competence, trading frequency, the size of the holdings, and the threat model. Self-custody removes platform counterparty risk and replaces it with personal operational risk, since a lost seed phrase can permanently eliminate access and an exposed one can let someone else take control. Many people use both, keeping active trading capital on a platform and longer-term holdings elsewhere.
What happens to my crypto if an exchange goes bankrupt?
The outcome depends on which legal entity held the assets, whether customer assets were segregated from company assets, the account terms, and the insolvency law of the governing jurisdiction. In some circumstances customers have been treated as unsecured creditors of the business rather than owners of specific assets, which can mean a partial recovery after a lengthy process. That is a possibility that depends on the facts, not a certainty, and rules differ substantially by jurisdiction.
Related Tools and Guides
- Hot wallets vs. cold wallets — the custody types themselves, and which holdings suit which arrangement.
- Wallet security score — the account-side practices this page deliberately leaves out: seed phrase storage, device hygiene, backups, and authentication.
- Crypto portfolio diversification — custody and platform concentration as a form of concentration risk alongside asset concentration.
- Crypto risk management guide — the full framework this page is part of.