Upbit: crypto exchanges rating breakdown

Custody of funds: 8/10

Proof-of-reserves: does it exist, who attests it, does it include liabilities (a PoR without liabilities is close to meaningless), how often. Insurance fund: size, is the address public, and has it ever actually paid out. Hack history — and above all whether users were made whole. Licences by jurisdiction, and the enforcement record behind them. Every claim here is sourced to a primary document: a regulator’s register, a court filing, or the venue’s own published proof.

Scored 8 of 10 against a category median of 5, which places it 3rd of 28 among centralised exchanges on this criterion. At a 40% weight that is 1.20 points above the median contribution of the weighted total. The best score in the category is 9, the worst 1.

A named third-party firm publishes a report every six months covering both sides — company holdings against user-entrusted balances, reconciled to the user registry. The most recent, dated 31 December 2025, showed 103.19% coverage of user assets. Two honest caveats: it is an agreed-upon-procedures engagement, and the firm expressly disclaims giving assurance; and there is no Merkle tree, so you cannot verify your own balance is inside it — you are trusting the accountant. Behind it sits Korean law, which forces at least 80% of customer crypto into cold storage and segregates customer cash at a bank. Regulation where others have a landing page. The only venue here whose compensation is not a promise. Upbit has been hacked twice — 342,000 ETH in 2019, and roughly $36m of Solana assets in November 2025, both attributed to North Korean actors, and both on 27 November, six years apart. Both times the company simply absorbed the loss onto its own balance sheet, and in December 2025 it was independently reported that ₩38.6bn of customer assets had been fully reimbursed. The catch worth naming: there is no ring-fenced fund and no external insurer. Compensation depends on the company staying solvent — it has, twice, but that is self-insurance, not a guarantee. Across thirty exchanges, this is still the one place where “users were made whole” is a fact rather than a press release.

True cost of trading: 10/10

Measured by us, not read off a fee page. We walk the live order book and fill $1,000 / $10,000 / $100,000 of BTC/USDT, then add the venue’s published taker fee. That sum — fee + spread + realised slippage — is the effective cost. Separately: the markup on network withdrawal fees, and the hidden spread inside “convert” / “buy in one click” flows.

Scored 10 of 10 against a category median of 6, which places it 1st of 28 among centralised exchanges on this criterion. At a 16% weight that is 0.64 points above the median contribution of the weighted total. The best score in the category is 10, the worst 1.

Liquidity and execution: 3/10

Order-book depth within ±0.1% and ±0.5% of mid, measured from the live book. Uptime over 12 months from the status page. Behaviour under stress: were there outages on days the market moved more than 5%.

Scored 3 of 10 against a category median of 6, which places it 24th of 28 among centralised exchanges on this criterion. At a 11% weight that is 0.33 points below the median contribution of the weighted total. The best score in the category is 10, the worst 1.

Assets and networks: 7/10

Number of pairs, adjusted for quality: the share of listings delisted within a year. Which networks are actually supported for deposit and withdrawal — not merely “supports USDT”.

Scored 7 of 10 against a category median of 6.5, which places it 11th of 28 among centralised exchanges on this criterion. At a 9% weight that is 0.04 points above the median contribution of the weighted total. The best score in the category is 10, the worst 1.

783 spot markets (269 KRW, 307 BTC, 207 USDT) — fetched live from its own API

Fiat on/off ramp: 3/10

Which methods are actually available per country, their fees, and their limits per verification tier — read from the venue’s published terms and cited. Where a venue does not publish this, that opacity is itself the finding, and it scores accordingly.

Scored 3 of 10 against a category median of 5.5, which places it 19th of 28 among centralised exchanges on this criterion. At a 11% weight that is 0.28 points below the median contribution of the weighted total. The best score in the category is 10, the worst 1.

KRW only, and only through a real-name verified account at a single partner bank. For anyone outside Korea, that is not a fiat rail — it is a wall.

KYC and access: 7/10

Verification tiers and their limits, what is genuinely usable without verification, and the country deny-list — from the venue’s published policy, cited. A venue that will not tell you your withdrawal ceiling before you sign up is marked down for it.

Scored 7 of 10 against a category median of 6, which places it 8th of 28 among centralised exchanges on this criterion. At a 8% weight that is 0.08 points above the median contribution of the weighted total. The best score in the category is 9, the worst 1.

Limits are published publicly, though the exact figures sit behind a Cloudflare wall we could not read. Full verification is mandatory before any deposit or trade. United States: Korea’s rules require a real-name verified account with a partner bank, which in practice confines the platform to Korean residents. There is no Upbit US entity. This is inferred from the sourced banking requirement, not quoted from Upbit’s terms. European Union: None. No EU retail platform.

Product, API and docs: 6/10

API documentation quality, whether rate limits are documented, whether a public status page with uptime history exists, and the API response latency we measured ourselves while pulling the order book.

Scored 6 of 10 against a category median of 5.5, which places it 10th of 28 among centralised exchanges on this criterion. At a 5% weight that is 0.03 points above the median contribution of the weighted total. The best score in the category is 9, the worst 4.

Documented API and rate limits. No status page with uptime history — only a per-asset wallet status board.