On 16 October 2026 the trustee of Mt. Gox, the Tokyo centralized exchange that collapsed in 2014, moved the creditors’ repayment deadline again, from 31 October 2026 to 31 October 2027, according to a notice published by the trustee. Twelve years after the exchange froze withdrawals, wallets linked to the estate still hold about 34,388 bitcoin, worth roughly $2.8 billion, according to Arkham data reported by Decrypt. It is the fourth one-year extension, and our news report on the new Mt. Gox deadline has the detail.
That wait is the shortest explanation of what a centralized exchange is. It is one company doing three jobs at once: it runs a marketplace where buyers meet sellers, it checks who its customers are, and it holds their coins. When you hold bitcoin on such a platform, what you own is a claim on that company, written in its database. Most of the time the difference does not matter. When the company fails, it is the only thing that matters.
This lesson explains how a centralized exchange works from the inside: the order book and the engine that matches orders, the identity checks known as KYC, where client coins actually sit, what happened at Mt. Gox and FTX, what proof of reserves can and cannot show, and how a decentralized exchange differs. The EU’s MiCA rules come up only where they touch custody and trading; the regulation as a whole is in our guide to the MiCA regulation, the previous lesson of this path. How to pick a platform is covered in our guide to choosing a crypto exchange.
A centralized exchange is a marketplace, a checkpoint and a vault
A stock exchange such as the New York Stock Exchange runs a market but never holds your shares: a broker places your order and a separate custodian keeps the securities. A crypto exchange like Coinbase, Kraken or Binance usually does all of it under one roof. It lists the assets, takes your order, matches it, keeps the record of who owns what, and stores the coins.
The US Securities and Exchange Commission warned about that combination in an investor alert on crypto asset securities. It says the commingling of exchange, broker-dealer and custodial functions in one firm "creates conflicts of interest and risks for investors." The table below sorts the three jobs and the way each one tends to break.
| Job | What the company does | What can go wrong |
|---|---|---|
| Marketplace | Lists trading pairs, keeps an order book, matches buyers and sellers, publishes prices | Outages at busy moments, thin order books, an operator trading against its own clients |
| Checkpoint | Verifies identity, screens customers and transfers, reports suspicious activity | Weak checks that let criminal money through, leading to fines or a shutdown |
| Vault | Holds clients’ coins in its own wallets and clients’ cash in bank accounts | Theft from wallets, client money used for the firm’s own purposes, insolvency |
What you actually own when your coins sit on an exchange
When you buy 0.1 BTC on a centralized exchange, no bitcoin moves on the Bitcoin blockchain. The exchange changes two numbers in its own ledger: yours goes up by 0.1 BTC, the seller’s goes down. The coins themselves stay in wallets whose private keys the exchange controls. Your balance is a promise that the company will send you that amount when you ask.
Only a withdrawal turns the promise into coins. When you withdraw to a wallet whose keys you hold, the exchange signs a real transaction and the coins become yours on the chain, with no one able to freeze them. That is the difference between custodial and self-custody explained in our crypto wallets guide. The SEC alert puts the risk bluntly: people who deposit crypto with such a firm "might cease to have legal ownership of those assets."
The order book and the matching engine: how a buy order meets a sell order
Every trading pair on a centralized exchange, say BTC/USD, has an order book: two lists of standing orders. One list holds bids, offers to buy at a stated price. The other holds asks, offers to sell. The software that compares incoming orders with these lists and decides which trades happen is called the matching engine. Exchanges do not publish the code of their engines, and the details vary from one platform to the next, so what follows is the general mechanism used by most order-book markets, in stocks as well as crypto.
The usual rule is price first, then time. A buy order at a higher price gets served before a lower one; between two orders at the same price, the one that arrived first goes first. When a new order can be matched with one waiting on the other side, a trade happens at the price of the order that was already resting in the book.
Bids, asks and the spread, with a worked example
Here is an invented order book, with round numbers chosen only to show the mechanism. Nothing in it is a real price.
| Side | Price (USD per BTC) | Quantity (BTC) |
|---|---|---|
| Ask (sell) | 100,300 | 2.0 |
| Ask (sell) | 100,200 | 0.5 |
| Ask (sell) | 100,100 | 0.3 |
| Bid (buy) | 100,000 | 0.4 |
| Bid (buy) | 99,900 | 1.0 |
| Bid (buy) | 99,800 | 3.0 |
The best ask is $100,100 and the best bid is $100,000. The $100 gap between them is the spread. Nobody has agreed to trade inside it yet. A market with many orders close to the best prices is called deep or liquid; a market with few orders is thin, and big orders move its price.
Now suppose you send a market order to buy 0.6 BTC, meaning "buy now at whatever price the book offers". The engine fills 0.3 BTC at $100,100, which empties that level, then 0.3 BTC at $100,200. You paid an average of $100,150 per bitcoin, $150 above the last best bid, plus the exchange’s fee. The difference between the price you saw and the price you got is called slippage, and on a thin book it can be much larger.
Market orders, limit orders and who pays the fee
A limit order sets the worst price you accept. A limit order to buy 1 BTC at $99,950 cannot be filled against the current asks, so it joins the bid list and waits, becoming the new best bid. You become what exchanges call a maker, because you added liquidity to the book. The person who later sells into your order is the taker. Many exchanges charge takers a higher fee than makers for that reason. Fee levels belong to the exchange reviews and the choice guide, not to this lesson.
A limit order protects you from a bad fill but may never execute. A market order always executes on a working market, but you do not control the price. Most exchanges also offer stop orders, which become market or limit orders once a trigger price is reached.
Internal ledger first, blockchain later
This design explains a common surprise for beginners. A trade on an exchange is instant, because it is only a change in the company’s database. A deposit or a withdrawal takes minutes or hours, because it is a real transaction that has to be confirmed on the blockchain, and many exchanges wait for several confirmations before they credit a deposit.
It also explains why the exchange can process millions of trades a day without paying network fees on each one. The blockchain only sees the money entering and leaving the exchange, not what happens inside it.
What MiCA requires of a trading platform in the EU
In the European Union, a crypto-asset service provider that runs a trading platform has to follow Article 76 of the MiCA regulation. The platform must set "non-discretionary rules and procedures to ensure fair and orderly trading", so the operator cannot pick which client gets filled. It must not deal on its own account on its own platform, and it may use matched principal trading only if the client consents. It must publish bid and ask prices and the depth of trading interest continuously during trading hours, and the price, volume and time of each trade as close to real time as is technically possible.
Article 76 also sets a settlement deadline: the platform must initiate the final settlement of a transaction on the distributed ledger within 24 hours of the trade, or by the close of the day for trades settled off the ledger. American platforms that trade crypto for their customers answer mainly to anti-money laundering registration with the federal government and to licences granted state by state, described in the next section.
KYC and AML: why an exchange asks for your passport
Opening an account at a regulated exchange means uploading an identity document, often a selfie or a short video, and proof of address. This is KYC, or know your customer, the identity checks that banks also run. They are one part of a firm’s anti-money laundering (AML) programme, which also includes screening customers against sanctions lists, watching transactions for patterns linked to crime, and reporting suspicious activity to the authorities.
Exchanges ask for more when the amounts grow. Larger deposits or withdrawals can trigger questions about where the money comes from, such as a payslip, a sale contract or tax records. The exact limits differ by platform and by country, so the figures shown in an app’s verification screen are the ones that apply to you.
The rules behind it, country by country
In the United States, a business that accepts and transmits crypto for customers is a money transmitter under the Bank Secrecy Act, according to FinCEN guidance of May 2019. FinCEN is the Treasury’s financial crimes unit. Such a firm must register with it as a money services business and run an AML programme, keep records and file suspicious activity reports. Registration is a filing, not an approval. States add their own layer: the Conference of State Bank Supervisors says states have licensed money transmitters that move cryptocurrencies for close to a decade, so a platform usually needs a licence in each state where it serves customers, with rules that differ from one state to the next.
British rules are changing. Crypto firms currently need a registration with the Financial Conduct Authority under the money laundering regulations. A full authorisation regime replaces it: the FCA says applications for authorisation open from 30 September 2026, and the new regime comes into force on 25 October 2027. Its guidance names operating a cryptoasset trading platform and safeguarding cryptoassets among the activities that may need an authorisation.
European law adds a travel rule: transfers involving a crypto-asset service provider must carry information on the sender and the recipient under the Transfer of Funds Regulation (EU) 2023/1113. That is why a European exchange may ask whether the wallet you withdraw to is your own. A new EU anti-money laundering regulation, applying from 10 July 2027, adds stricter customer checks for crypto firms.
When the checks fail: Binance in 2023
The largest enforcement case so far concerned the world’s biggest exchange by volume. In November 2023 Binance pleaded guilty in the United States to violating the Bank Secrecy Act, failing to register as a money transmitting business and breaching US sanctions law, and agreed to pay about $4.3 billion, according to the US Department of Justice. Its founder, Changpeng Zhao, pleaded guilty to a Bank Secrecy Act charge, stepped down as chief executive and agreed to a $50 million fine. Binance also accepted an independent monitor. The same day FinCEN announced its own $3.4 billion settlement, with a five-year monitorship, and the Treasury’s sanctions office OFAC reached a separate settlement.
For a customer, the point is practical. Weak checks let criminal money in, and the penalties that follow land on the company whose balance sheet backs every client account.
Can you trade without KYC?
Readers often search for an exchange without KYC. Some routes exist: a decentralized exchange, where you trade from your own wallet, and some peer-to-peer platforms. They come with other risks. You get no customer support and no recourse if a counterparty or a fake site cheats you, the coins you receive may later be flagged by a regulated exchange, and your tax obligations are the same in any case. A centralized exchange that offers fiat deposits to people in the US, the UK or the EU without identity checks is, in most cases, operating outside the law in those places, which makes it a poor place to leave money.
Custody: where client coins really sit
An exchange holds two kinds of client property. Cash (dollars, euros, pounds) sits in bank accounts. Coins sit in blockchain wallets that the exchange controls. The way it organises those wallets decides how exposed clients are to theft and to the firm’s own mistakes.
Hot wallets, cold storage and the share in each
A hot wallet is connected to the internet and can sign withdrawals automatically. It is fast and convenient, and it is the part attackers aim at. A cold wallet keeps its keys offline, often split between several people and devices in different places, so moving funds takes a deliberate procedure and time. Exchanges keep a small share in hot wallets to meet everyday withdrawals and the bulk in cold storage, refilling the hot side when it runs low.
The share is self-declared. Coinbase wrote in a company blog post in December 2018, quoted by CryptoSlate, that it stores 98% or more of customer assets in cold storage; no independent check of that figure, or of a newer one, was available for this lesson. Treat any such percentage as the company’s statement.
Cold storage can still be robbed: Bybit, February 2025
On or about 21 February 2025, attackers took about $1.5 billion in virtual assets from the exchange Bybit. The FBI said in a public service announcement on 26 February 2025 that North Korea was responsible, a campaign it calls TraderTraitor, and that the thieves quickly converted part of the funds and spread them across thousands of addresses on several blockchains. The funds came from a multi-signature cold wallet on Ethereum. Safe, the company whose software Bybit used to approve transfers, said the attackers had gone through a compromised developer machine, and the investigators hired by Bybit found that code altered on Safe’s web interface changed the transaction while signers approved what looked like a routine one. Offline keys stop many attacks. They do not protect the moment when people and software approve a movement of funds.
One pool for many clients
Exchanges do not usually open a separate blockchain wallet for each customer’s holdings. A common arrangement, borrowed from brokerage where it is called an omnibus account, is one pool of coins covering many clients, with the split between them recorded only in the exchange’s own books. A deposit address may be personal to you, but the coins are swept into shared wallets afterwards. This is a plain-language description of a common practice, not a rule; exchanges describe their set-ups differently.
A shared pool is efficient but it makes two things critical: the accuracy of the internal ledger, and a legal guarantee that the pool belongs to clients and not to the company. If the books say clients own 100,000 BTC and the wallets hold 80,000, every client is short, and nobody can tell from the blockchain alone.
Segregation under MiCA, and what it does not promise
MiCA answers the second point for EU-authorised firms. Article 70 of the regulation says a provider that holds clients’ crypto-assets, or the means of access to them, must make "adequate arrangements to safeguard the ownership rights of clients, especially in the event of the crypto-asset service provider’s insolvency", and must prevent their use for its own account. Client cash other than e-money tokens has to be placed with a credit institution or a central bank by the end of the next business day, in an account kept separately identifiable from the firm’s own money. Those cash rules do not apply when the provider is itself a bank, an e-money institution or a payment institution, because those firms have their own safeguarding rules.
MiCA does not create a deposit guarantee or an investor compensation scheme for crypto. If an authorised firm loses client coins, the client’s protection is the segregation itself and the firm’s liability, not a public fund. Protection also applies only to the authorised legal entity: a sister company with the same brand in another country may sit outside it.
Safeguarding can fail even at a licensed firm. On 22 October 2026 the Central Bank of Ireland fined Coinbase Ireland, the group’s e-money company, €3,252,618 for breaches of safeguarding and outsourcing rules between November 2020 and August 2025. According to the settlement notice, the safeguarding account was short every day for at least 18 months, by up to €5.2 million in 2024. The regulator found no evidence of actual harm to customers, but noted the risk had the firm become insolvent. Our news report on the Coinbase Ireland fine has the reactions. That case falls under e-money rules, not MiCA, but the principle is the same: segregation is only as good as the daily reconciliation behind it.
In the US and the UK, no insurance scheme for coins
American readers used to bank and brokerage accounts should know what is missing. Bank deposits are covered by FDIC insurance and brokerage accounts by SIPC protection if the firm fails. The SEC’s investor alert, after describing those schemes, states: "There are no such protections for accounts that you place with crypto asset entities." Whether coins held by a US exchange would belong to its customers or to its creditors in a bankruptcy depends on the exchange’s terms and on how a court reads them.
When an exchange fails, customers become creditors: Mt. Gox and FTX
Two collapses shaped everything above. They differ in cause, but they ended the same way for customers: a frozen balance, a court process, and a long wait for part of the money.
Mt. Gox, 2014: the hacked market leader
Mt. Gox, run from Tokyo by Mark Karpelès, was among the biggest bitcoin exchanges in the world by 2014. In February of that year it froze withdrawals, then filed for bankruptcy protection in Tokyo, blaming hackers for the loss of 750,000 customer bitcoins and 100,000 of its own. In March 2014 it said it had found about 200,000 BTC in an old-format wallet it had thought empty, NBC News reported, which left roughly 650,000 unaccounted for. In March 2019 the Tokyo District Court convicted Karpelès of manipulating electronic data, gave him a suspended sentence of two years and six months, and cleared him of embezzlement, according to the Associated Press.
Creditors approved a rehabilitation plan on 20 October 2021, and the Tokyo District Court confirmed it the same day; it became final on 16 November 2021, according to the trustee’s notice. The trustee made the first repayments in bitcoin and bitcoin cash on 5 July 2024, ten years after the collapse. In its October 2026 notice he says the main repayments are largely done, but many creditors have still not completed the steps needed to be paid, which is why the deadline now runs to 31 October 2027.
FTX, 2022: customer deposits used by a sister firm
FTX fell in a few days. On 2 November 2022 CoinDesk published a balance sheet of Alameda Research, the trading firm of FTX founder Sam Bankman-Fried: about $5.8 billion of its $14.6 billion in assets was FTT, a token FTX itself had created, as TechCrunch summed up at the time. On 6 November Binance’s chief executive said Binance would sell its FTT. Customers rushed to withdraw, and by 8 November withdrawals were effectively paused. On 11 November 2022 FTX Trading, Alameda and dozens of affiliated companies filed for Chapter 11 bankruptcy in Delaware, according to the first-day declaration filed in the case.
The new chief executive appointed to run the bankruptcy, John J. Ray III, who had handled the liquidation of Enron, wrote in that declaration, dated 17 November 2022: "Never in my career have I seen such a complete failure of corporate controls". At trial, prosecutors showed that customer deposits had been used by Alameda. A jury convicted Bankman-Fried on seven fraud and conspiracy counts on 2 November 2023. On 28 March 2024 Judge Lewis Kaplan sentenced him in Manhattan to 25 years in prison, finding that FTX customers had lost $8 billion, AAP reported. Bankman-Fried said he would appeal.
For customers, the key decision came in the bankruptcy court. Judge John Dorsey confirmed the FTX plan in October 2024. About 98% of creditors were to receive at least 118% of their claim in cash, with claims valued in dollars at the time of the November 2022 filing, The Block reported; an adviser to the estate told the court it did not have the crypto needed to repay in kind. That sounds generous until you notice the date. A customer who held one bitcoin was repaid in dollars at its November 2022 value, not in bitcoin, and missed the rise that followed.
What both cases teach about your claim
When a centralized exchange becomes insolvent, the coins in your account stop being something you can withdraw and become a claim in a legal process. Four things then decide what you get back. The first is whether the coins were legally yours or the firm’s, which is what segregation rules such as MiCA’s Article 70 try to settle in advance. The second is how much is actually left once the administrators count the wallets. The third is time: two years for FTX customers to see a confirmed plan, more than ten for Mt. Gox. The fourth is the valuation date, since claims are often fixed in money at the price of the day the company filed.
| As of 23 October 2026 | Mt. Gox | FTX |
|---|---|---|
| Withdrawals stopped | February 2014 | About 8 November 2022 |
| Insolvency filing | February 2014, Tokyo | 11 November 2022, Delaware (Chapter 11) |
| Reported cause | Coins missing, blamed on hackers | Customer deposits used by Alameda Research |
| Reported hole | About 850,000 BTC, about 650,000 after coins were found | $8 billion of customer losses (judge’s finding at sentencing) |
| Plan approved | 20 October 2021 (final 16 November 2021) | 7 October 2024 |
| Customers paid from | 5 July 2024, in BTC and BCH | After the plan, in dollars at November 2022 values |
| Status | Deadline 31 October 2027; about 34,388 BTC in linked wallets (Arkham) | Distributions under the plan |
Proof of reserves: what it shows and what it hides
After FTX, many exchanges began publishing a proof of reserves: evidence that they hold at least as many coins as their customers’ balances add up to. It has two halves. On the asset side, the exchange shows which blockchain addresses it controls, often by signing a message with their keys, so anyone can add up the coins on them. On the liability side, it has to show the total of what it owes its customers.
How a Merkle tree lets you check your own balance
The usual tool for the liability side is a Merkle tree. Each customer balance becomes a leaf, labelled with a scrambled version of the customer’s identifier. Pairs of leaves are combined into a parent that stores their sum and a hash of both, and so on up to a single root holding the total. The exchange publishes the root. Each customer receives the short branch connecting their leaf to the root and can check that their balance is included and that the sums add up.
Ethereum co-founder Vitalik Buterin described the method in a post of 19 November 2022. If the assets cover the total in the root, he wrote, "you’ve proven the exchange has the funds to pay back all of its depositors." He also listed the weaknesses.
The limits: a snapshot, a self-reported total and excluded users
A proof of reserves is a snapshot of one moment. Coins can be borrowed for the day of the check and returned after. Two exchanges could pass the same collateral back and forth to pass their checks, a risk Buterin raises. An exchange could also leave some customers out of the tree; as Buterin notes, it "could also just exclude those users from the tree and have the same effect", which only works if few people check their branch. And it says nothing about debts that are not customer balances, such as loans the exchange has taken.
Auditors drew the same line. In December 2022 the accounting firm Mazars, which had produced reports for Binance and others, paused all its work on crypto proof of reserves. As a Bloomberg report carried by American Banker explained on 16 December 2022, such reports check what a firm holds but not what it owes, and only at one point in time. Buterin’s post argues that zero-knowledge proofs can show that no balance in the tree is negative without revealing anyone’s account, which closes some gaps but not the off-chain debts.
Reading a proof of reserves in practice
Three checks are worth doing when an exchange publishes one. Look for the date of the snapshot and how often it is repeated. Check whether the liability side is included and whether you can verify your own balance in it. And see whether an independent firm examined it, and with what wording: an attestation on agreed procedures is not an audit of the company’s accounts.
Centralized exchange vs decentralized exchange
A decentralized exchange is a set of smart contracts on a blockchain. You trade from your own wallet, no company holds your coins, and in most cases nobody asks for your identity. Many use an automated market maker: instead of an order book, a pool of two tokens prices each trade with a formula. Others run order books on fast blockchains. The table compares the two models on the points this lesson covered.
| Centralized exchange (CEX) | Decentralized exchange (DEX) | |
|---|---|---|
| Who holds the coins | The exchange, in its wallets | You, in your own wallet, until the trade settles on-chain |
| Identity checks | KYC required by law in the US, UK and EU | Usually none at protocol level; front-end websites may block some countries |
| How trades are matched | Order book and matching engine on company servers | Automated market maker pools or an on-chain order book |
| Main failure modes | Insolvency, theft from exchange wallets, frozen withdrawals | Smart-contract bugs, fake tokens, slippage, front-running |
| Fiat deposits | Bank transfer and card | Not directly; you need crypto first |
| Help if something goes wrong | Customer support and a regulator | None beyond community channels |
| Regulation | Licensed or registered entities (MiCA, FCA, FinCEN and states) | Largely outside current licensing rules; under review in several places |
Size has shifted. Spot trading on decentralized exchanges equalled about 24% of centralized exchange spot volume in July 2026, a record and up from 17% a year earlier, according to data from The Block. That is a ratio of DEX volume to CEX volume, not a share of the total; other data providers present a share of combined volume and so print lower percentages for the same months.
Using a centralized exchange with your eyes open
Millions of people use exchanges every day without trouble. The habit worth having is to know what you hold. Before depositing, check that the exact company you sign up with is authorised where you live: the ESMA register for MiCA providers in the EU, the FCA register in the UK, FinCEN’s money services business list and your state’s licence for US platforms.
Keep on the exchange what you plan to trade, and move long-term holdings to a wallet whose keys you control if you are ready to look after a seed phrase (our seed phrase security guide explains how). Test a withdrawal with a small amount before you need it. Turn on two-factor authentication with an app or a security key rather than SMS, and use a withdrawal address allowlist when the platform offers one.
We review the main platforms one by one: Binance, Coinbase, Kraken, and for European readers Bitvavo and Bitpanda. To compare them on your own criteria, use our exchange selection guide. Later lessons of this path walk through buying bitcoin and ether step by step.
