Crypto.com: crypto exchanges rating breakdown

Custody of funds: 6/10

Proof-of-reserves: does it exist, who attests it, does it include liabilities (a PoR without liabilities is close to meaningless), how often. Insurance fund: size, is the address public, and has it ever actually paid out. Hack history — and above all whether users were made whole. Licences by jurisdiction, and the enforcement record behind them. Every claim here is sourced to a primary document: a regulator’s register, a court filing, or the venue’s own published proof.

Scored 6 of 10 against a category median of 5, which places it 10th of 28 among centralised exchanges on this criterion. At a 40% weight that is 0.40 points above the median contribution of the weighted total. The best score in the category is 9, the worst 1.

Its live proof-of-reserves page still names Mazars as attestor and still cites 7 December 2022 as the attestation date — an auditor that publicly quit all crypto proof-of-reserves work that same month, over three years ago. The methodology underneath is decent (a Merkle tree over client balances, so liabilities are covered), and there is a self-verification tool. But who attests it today is unknown, the cadence is unstated, and the last dated snapshot on a primary page is from 2022. The famous “$750m insurance” is a 2021 press release about cold storage at Ledger Vault. The only currently dated policy is $120m, arranged in 2025 — and it is scoped to the US institutional custody entity, not to retail app or exchange users. The retail security page now carries no dollar figure at all. There is no user protection fund and no on-chain address.

True cost of trading: 6/10

Measured by us, not read off a fee page. We walk the live order book and fill $1,000 / $10,000 / $100,000 of BTC/USDT, then add the venue’s published taker fee. That sum — fee + spread + realised slippage — is the effective cost. Separately: the markup on network withdrawal fees, and the hidden spread inside “convert” / “buy in one click” flows.

Scored 6 of 10 against a category median of 6, which places it 14th of 28 among centralised exchanges on this criterion. At a 16% weight that is exactly level with the median of the weighted total. The best score in the category is 10, the worst 1.

Liquidity and execution: 6/10

Order-book depth within ±0.1% and ±0.5% of mid, measured from the live book. Uptime over 12 months from the status page. Behaviour under stress: were there outages on days the market moved more than 5%.

Scored 6 of 10 against a category median of 6, which places it 12th of 28 among centralised exchanges on this criterion. At a 11% weight that is exactly level with the median of the weighted total. The best score in the category is 10, the worst 1.

Assets and networks: 6/10

Number of pairs, adjusted for quality: the share of listings delisted within a year. Which networks are actually supported for deposit and withdrawal — not merely “supports USDT”.

Scored 6 of 10 against a category median of 6.5, which places it 15th of 28 among centralised exchanges on this criterion. At a 9% weight that is 0.04 points below the median contribution of the weighted total. The best score in the category is 10, the worst 1.

~536 spot pairs across ~387 coins

Fiat on/off ramp: 7/10

Which methods are actually available per country, their fees, and their limits per verification tier — read from the venue’s published terms and cited. Where a venue does not publish this, that opacity is itself the finding, and it scores accordingly.

Scored 7 of 10 against a category median of 5.5, which places it 8th of 28 among centralised exchanges on this criterion. At a 11% weight that is 0.17 points above the median contribution of the weighted total. The best score in the category is 10, the worst 1.

Narrow but real: USD (ACH and SWIFT), EUR (SEPA, €1 withdrawal) and GBP (Faster Payments, £1.90) for UK retail. No direct AUD, CAD, JPY or SGD rails on the exchange.

KYC and access: 3/10

Verification tiers and their limits, what is genuinely usable without verification, and the country deny-list — from the venue’s published policy, cited. A venue that will not tell you your withdrawal ceiling before you sign up is marked down for it.

Scored 3 of 10 against a category median of 6, which places it 25th of 28 among centralised exchanges on this criterion. At a 8% weight that is 0.24 points below the median contribution of the weighted total. The best score in the category is 9, the worst 1.

No published tier-and-limit table before sign-up. Only per-rail fiat caps are public ($100k/day USD, £100k/day GBP); crypto withdrawal ceilings depend on “verification level, region and security settings” and are shown only once you are inside. United States: Available in 49 states plus DC and the US territories. New York is the only excluded state. US operations run through Foris DAX, Inc. under state money-transmitter licences and FinCEN registration. European Union: MiCA CASP — MFSA (Malta). Foris DAX MT Limited, licensed January 2025, passported across the EEA.

Product, API and docs: 7/10

API documentation quality, whether rate limits are documented, whether a public status page with uptime history exists, and the API response latency we measured ourselves while pulling the order book.

Scored 7 of 10 against a category median of 5.5, which places it 9th of 28 among centralised exchanges on this criterion. At a 5% weight that is 0.07 points above the median contribution of the weighted total. The best score in the category is 9, the worst 4.

Public REST/WebSocket/FIX docs with documented rate limits, and a real status page — though it publishes incident history only, with no uptime percentages.