Phemex: crypto exchanges rating breakdown
Crypto exchange · reviewed against our published rubric, no affiliate links
Its “insurance fund” is a liquidation backstop whose balance page reads “No Data”, and there is no theft cover. After the January 2025 hack of $70m or more, its own incident timeline does not contain the word compensation.
How the score is built
Each criterion is scored 0–10 and weighted. The median column is the middle score across every entry in this ranking, so a row reads as a position rather than a number.
| Criterion | What we measured | Weight | Score | Category median | Rank | Weighted gap |
|---|---|---|---|---|---|---|
| Custody of funds | — | 40% | 3 | 5 | 19 of 28 | -0.80 |
| True cost of trading | 0.1001 % effective cost on a $10,000 buy · computed · 2026-07-14 · source0.1 % published taker fee · published · 2026-07-14 · source0.1185 % effective cost on a $100,000 buy · computed · 2026-07-14 | 16% | 10 | 6 | 1 of 28 | +0.64 |
| Liquidity and execution | 0.0263 % BTC spread · measured · 2026-07-1428.5216 BTC depth within 0.1% of best ask · measured · 2026-07-14138.7902 BTC depth within 0.5% of best ask · measured · 2026-07-14 | 11% | 6 | 6 | 12 of 28 | 0.00 |
| Assets and networks | — | 9% | 5 | 6.5 | 22 of 28 | -0.14 |
| Fiat on/off ramp | — | 11% | 6 | 5.5 | 12 of 28 | +0.06 |
| KYC and access | — | 8% | 8 | 6 | 2 of 28 | +0.16 |
| Product, API and docs | 911 ms API response latency · measured · 2026-07-14 | 5% | 5 | 5.5 | 15 of 28 | -0.03 |
Measured 14 July 2026 · weights and method · decided by custody of funds, worth -0.80 points against the median
Custody of funds: 3/10
Proof-of-reserves: does it exist, who attests it, does it include liabilities (a PoR without liabilities is close to meaningless), how often. Insurance fund: size, is the address public, and has it ever actually paid out. Hack history — and above all whether users were made whole. Licences by jurisdiction, and the enforcement record behind them. Every claim here is sourced to a primary document: a regulator’s register, a court filing, or the venue’s own published proof.
Scored 3 of 10 against a category median of 5, which places it 19th of 28 among centralised exchanges on this criterion. At a 40% weight that is 0.80 points below the median contribution of the weighted total. The best score in the category is 9, the worst 1.
Monthly Merkle proof covering liabilities, with a self-verification tool — and no independent attestor. Custody sits with Fireblocks, but a custodian is not an auditor, and the reserve ratios are Phemex’s own arithmetic. Nothing that would pay you back after a theft. The “insurance fund” is explicitly a derivatives liquidation backstop, and its public balance page renders “No Data”.
True cost of trading: 10/10
Measured by us, not read off a fee page. We walk the live order book and fill $1,000 / $10,000 / $100,000 of BTC/USDT, then add the venue’s published taker fee. That sum — fee + spread + realised slippage — is the effective cost. Separately: the markup on network withdrawal fees, and the hidden spread inside “convert” / “buy in one click” flows.
Scored 10 of 10 against a category median of 6, which places it 1st of 28 among centralised exchanges on this criterion. At a 16% weight that is 0.64 points above the median contribution of the weighted total. The best score in the category is 10, the worst 1.
Liquidity and execution: 6/10
Order-book depth within ±0.1% and ±0.5% of mid, measured from the live book. Uptime over 12 months from the status page. Behaviour under stress: were there outages on days the market moved more than 5%.
Scored 6 of 10 against a category median of 6, which places it 12th of 28 among centralised exchanges on this criterion. At a 11% weight that is exactly level with the median of the weighted total. The best score in the category is 10, the worst 1.
Assets and networks: 5/10
Number of pairs, adjusted for quality: the share of listings delisted within a year. Which networks are actually supported for deposit and withdrawal — not merely “supports USDT”.
Scored 5 of 10 against a category median of 6.5, which places it 22nd of 28 among centralised exchanges on this criterion. At a 9% weight that is 0.14 points below the median contribution of the weighted total. The best score in the category is 10, the worst 1.
~511 spot pairs across ~489 coins
Fiat on/off ramp: 6/10
Which methods are actually available per country, their fees, and their limits per verification tier — read from the venue’s published terms and cited. Where a venue does not publish this, that opacity is itself the finding, and it scores accordingly.
Scored 6 of 10 against a category median of 5.5, which places it 12th of 28 among centralised exchanges on this criterion. At a 11% weight that is 0.06 points above the median contribution of the weighted total. The best score in the category is 10, the worst 1.
USD, GBP, CHF, EUR, JPY and AUD by bank transfer both ways — but routed through a third-party partner, not Phemex’s own banking rails.
KYC and access: 8/10
Verification tiers and their limits, what is genuinely usable without verification, and the country deny-list — from the venue’s published policy, cited. A venue that will not tell you your withdrawal ceiling before you sign up is marked down for it.
Scored 8 of 10 against a category median of 6, which places it 2nd of 28 among centralised exchanges on this criterion. At a 8% weight that is 0.16 points above the median contribution of the weighted total. The best score in the category is 9, the worst 1.
Published: unverified accounts can no longer withdraw at all (0 USDT), verified accounts get 2,000,000 USDT/24h. United States: The US is a Restricted Territory; US citizens, green-card holders and tax residents are excluded. European Union: None — absent from the ESMA register. Holds no CASP authorisation, yet does not self-restrict EU users — it serves the EU unlicensed after the transition closed on 1 July 2026.
Product, API and docs: 5/10
API documentation quality, whether rate limits are documented, whether a public status page with uptime history exists, and the API response latency we measured ourselves while pulling the order book.
Scored 5 of 10 against a category median of 5.5, which places it 15th of 28 among centralised exchanges on this criterion. At a 5% weight that is 0.03 points below the median contribution of the weighted total. The best score in the category is 9, the worst 4.
Documented API and rate limits. No live status page — the “system status” page is a stale table from 2020.
Incidents priced into this score
January 2025: a hot-wallet hack initially reported at $29m and later put at $70m or more, with researchers suspecting North Korean actors. Phemex said it would cover balances; its own incident page discloses no amount and makes no explicit compensation commitment. [source]
Its nearest neighbours in this ranking
| # | Entry | Custody of funds | How it differs |
|---|---|---|---|
| 13 | BingX | 4 | Ahead by 1 on custody of funds. |
| 14 | Crypto.com | 6 | Ahead by 3 on custody of funds. |
| 16 | KuCoin | 3 | Level on custody of funds; the gap is elsewhere. |
| 17 | Bitso | 7 | Ahead by 4 on custody of funds. |
Sources
Questions about this score
How much did Phemex lose in the 2025 hack?
+
The reported figure moved from about $29m to $70m or more as analysis continued, with researchers suspecting North Korean actors. The number that matters more is what Phemex itself has said: its own incident page discloses no amount and makes no explicit commitment to compensate users. It stated that balances would be covered; we found no confirmation that they were.
Is Phemex legal in the EU?
+
It has no CASP authorisation and does not restrict EU users, so it has been serving them without a licence since the MiCA transition closed on 1 July 2026. That is a different position from the venues that withdrew — HTX barred the EU outright, Binance suspended services — and it leaves European customers with no supervisor and no recourse.
Does Phemex have proof of reserves?
+
It publishes a monthly Merkle-tree proof that does cover liabilities, with an open-source verification tool — genuinely better machinery than several larger venues offer. What it lacks is an independent attestor: nobody outside Phemex signs the snapshots. Its custody sits with Fireblocks, which is a reputable arrangement and not an audit.