Phemex

Phemex is a centralized exchange that started as a derivatives venue and now offers spot trading, perpetual futures, copy trading, trading bots, savings and staking products, a crypto card and fiat on-ramps. Its about page says it was founded in 2019 by former Morgan Stanley executives and claims more than 10 million users. Federico Variola is chief executive; a December 2025 Phemex blog post presents him in that role.

Phemex is privately held and does not publish accounts, a list of shareholders or a group structure chart. Its terms of use define the contracting party as the Phemex group entities that provide a given service and name one of them: PHEMEX POLAND sp. z o.o., registered in Katowice. The terms are governed by Singapore law, with disputes going to arbitration at the Singapore International Arbitration Centre, and its press releases carry an Apia, Samoa dateline. Phemex does not list a licence on the pages we read, and the Polish entity's name in the terms is not, by itself, evidence of a licence.

Phemex's token, PT, gives a discount on trading fees when used to pay them: 20% on spot and 10% on futures, according to the fee page.

The derivatives side offers perpetual contracts margined in USDT, USDC or the underlying coin. The public product API showed a maximum leverage of 150x on the BTC/USDT perpetual on 29 October 2026, with funding paid every eight hours at 00:00, 08:00 and 16:00 UTC. Phemex's own brand guide quotes up to 100x on USDT-margined contracts generally; the limit varies by contract and position size.

The spot market lists several hundred coins, and the brand guide claims more than 600. Copy trading lets users follow lead traders, who take a share of their followers' profits. Phemex's built-in bots include grid, martingale and funding-rate arbitrage strategies and trade with the user's own funds. Phemex also runs a demo trading mode for practice without real money.

Short selling on Phemex means opening a short perpetual position or selling borrowed coins on margin. Both carry liquidation risk: if the price moves against the position far enough, it is closed automatically and the margin is lost.

Phemex charges a maker and a taker fee that fall as 30-day volume and average balance rise through levels from Standard to Star VIP. The fee page fills its table only for signed-in users, but the public product API lists the default spot rate for BTC/USDT as 0.1% for both sides, and Phemex's help center gives the standard futures rate as 0.01% maker and 0.06% taker. Market orders, stop-losses and take-profits always pay the taker rate.

Withdrawal fees vary by coin and network and are shown at withdrawal. Phemex's navigation advertises zero deposit fees for SWIFT, SEPA and FPS bank transfers; those run through a third-party provider, Legend Trading, and are unavailable to residents of 46 countries listed in the help center, including Canada, the UK, the Netherlands, Poland, Brazil and Nigeria.

Our own measurement on 14 July 2026 found an all-in cost of 0.1001% for a $10,000 bitcoin purchase, rising to 0.1185% at $100,000, with 28.5 BTC of resting orders within 0.1% of the best ask. Promotions change the rates on some pairs, and Phemex says the fees on actual transaction records are final.

Phemex's terms, last updated on 10 July 2025, list 45 restricted territories where its services may not be used. The list covers the United Arab Emirates, the United States, the United Kingdom, Ontario, Québec, Alberta and Saskatchewan in Canada, Australia, China, Hong Kong, India, South Africa, the Republic of Seychelles and a group of sanctioned or high-risk countries including Cuba, Iran, North Korea, Crimea, Syria and Venezuela.

Phemex also cannot be reached from Korean exchanges: Upbit names Phemex on its 31 August 2026 list of unregistered overseas operators, so transfers between the two are blocked.

On KYC, the terms say that a user who cannot satisfy Phemex's KYC and anti-money-laundering requirements may not be able to open or use an account, and that Phemex may close or suspend accounts that have not completed identity verification. Using a VPN to reach Phemex from a restricted territory breaches the terms and puts the account at risk of being frozen.

On 23 January 2025 at 11:30 UTC Phemex detected unusual activity in its hot wallets. Funds were drained across 16 chains, including Ethereum, Solana, XRP Ledger and Bitcoin, according to Halborn, which put the loss at about $73 million and said the likely cause was compromised private keys; BleepingComputer reported more than $85 million. Phemex suspended deposits and withdrawals, released a proof of reserves the same day and reopened withdrawals chain by chain between 24 and 26 January, with a February 2025 note on its timeline that all withdrawal services had been restored.

Phemex has never published its own figure for the loss. Its timeline says user funds are always safe, which implies customer balances were not reduced, and an early statement said a compensation plan was being prepared. The published timeline does not mention compensation, and we found no later announcement of one. Outside reports linked the attack to North Korea's Lazarus Group; that is an attribution by analysts, not by Phemex or a government.

Phemex publishes monthly proof-of-reserves reports. Its April 2026 report gave a total reserve ratio of 131% across major assets, and its releases describe a Merkle tree that lets users check their own balance is included. The ratios are Phemex's own calculation: no auditor or attestor is named in the reports we found. Its security page lists a cold, warm and hot wallet system, multi-signature controls and continuous monitoring. Our article on how to check that an exchange holds your money explains what a self-published Merkle proof can and cannot show.

After sign-up and identity verification, crypto can be deposited on-chain, bought by Visa or Mastercard card, or, where available, funded by bank transfer through the fiat partner. Phemex's incident timeline tells users to stop using deposit addresses issued before the January 2025 theft: deposits sent to old addresses need manual review and take longer to credit.

Withdrawals go on-chain at the network fee shown on the withdrawal screen. Before moving a larger balance, check that the destination network matches the deposit address.

• API users: Phemex API keys can be bound to IP addresses. A 401 error reading request IP mismatch means the request came from an IP not on the key's whitelist; add the server's address in the API key settings.
• Bots and copy trading run with your funds on Phemex; they do not need your API key, but a third-party bot does, and should get trading permission only.

Phemex offers live chat and tickets through its help center, with email at [email protected], and says support runs 24/7. We found no phone line on its site, so a caller presenting a Phemex support number is not using a channel Phemex lists. Phemex runs an official verification page for checking whether a link, account or contact belongs to it, and links to its channels on X, Telegram, Discord, Facebook, LinkedIn and YouTube.

Phemex is a young exchange, and most of its public history is product launches and the 2025 incident.

• 2019: Phemex launches as a derivatives exchange.
• 23 January 2025: hot wallets drained across 16 chains; withdrawals restored in stages.
• July 2025: terms of use updated with the current restricted-territory list.
• November 2025: brand refresh at the exchange's sixth anniversary.
• 2026: monthly proof-of-reserves reports continue; April report shows a 131% total ratio.

People comparing Phemex with Bybit, MEXC, BingX or BitMEX are usually choosing a derivatives venue on leverage, fees and copy-trading tools. Those exchanges differ more on custody evidence and incident history than on headline fees. We compare them with measured costs in our separate review of how Phemex compares with other exchanges.