Phemex

Phemex lost $70m or more in January 2025. What makes this entry unusual is not the amount but the documentation: the company published an incident timeline, and the word compensation does not appear in it. That is not a refusal to pay, which would at least be a position. It is an absence, and eighteen months later the absence is the record.

There is also nothing that could have paid. The "insurance fund" Phemex advertises is explicitly a derivatives liquidation backstop — it exists to absorb losses from bankrupt leveraged positions, not to reimburse a user whose assets were stolen. Its public balance page renders "No Data", so even the backstop’s size is unknown.

On reserves, Phemex publishes a monthly Merkle proof covering liabilities with a self-verification tool, which is real machinery. No independent attestor signs it. Custody is with Fireblocks, and that is worth something and is frequently misrepresented: a custodian holds keys, it does not verify that the exchange’s stated reserves match its liabilities. The ratios are Phemex’s own arithmetic.

We score custody 3 out of 10. A venue that has already been hacked, has no theft fund, and has never stated what happened to the people affected is at the bottom of this rating for reasons that need no further interpretation.

A $10,000 bitcoin buy cost 0.1001% on 14 July 2026, in the cheapest tier, though the curve steepens faster than its peers: 0.1185% at $100,000 against 0.1005% at OKX and 0.10% at Binance. Depth measured 28.5 BTC within 0.1% of best ask, on the thin side.

API response latency measured 911 ms, the second slowest venue in the run behind Gate.io’s 3,028 ms and roughly five times Coinbase’s 183 ms.

KYC scores 8 out of 10, with clearly published tiers, which is the strongest part of the card.

The pricing is competitive and nothing else here is, and the section above is the reason the pricing should not be the deciding factor.