Is Crypto.com Safe to Trade and Store Assets On?

Read our Crypto.com security review covering the 2022 incident, bank insurance limits, Mazars proof of reserves, and identity verification requirements.

Updated September 2026 · Reviewed by the PipeFlare team

Crypto.com is a legitimate custodial exchange with published 1:1 proof of reserves and strong security certifications, but its January 2022 security breach and custodial counterparty risk mean you should avoid storing your entire balance on the exchange.

Confusing custodial exchange disclosures with full deposit protection leaves your crypto assets exposed to exchange insolvency and credential compromise without statutory insurance.

About is crypto.com safe

Crypto.com is safe for active trading if you understand the boundary between exchange protections and your personal custody responsibilities. At PipeFlare, we reviewed this ourselves to evaluate how Crypto.com secures customer funds. Crypto.com maintains an audited 1:1 reserve structure and complies with established security frameworks. You must complete Know Your Customer (KYC) verification before you can deposit or trade. These institutional controls establish Crypto.com as a legitimate trading venue. They do not eliminate counterparty risk if you leave your assets on the exchange indefinitely. Crypto.com publishes a Proof of Reserves report verified by independent audit firm Mazars Group under International Standard on Related Services (ISRS) 4400 standards. This verification uses a Merkle tree structure that allows individual account holders to confirm their account balance is recorded within the aggregate reserves. Crypto.com also holds multiple independent certifications, including System and Organization Controls (SOC) 2 Type II compliance, Payment Card Industry Data Security Standard (PCI DSS) v4.0 Level 1 Service Provider status, and International Organization for Standardization and International Electrotechnical Commission (ISO/IEC) certifications including ISO/IEC 27001:2022. Crypto.com engages Kudelski Security to perform audits on its blockchain systems. For fiat currency, Crypto.com holds United States dollar (USD) customer balances in custodial accounts at Federal Deposit Insurance Corporation (FDIC) member institutions, including Community Federal Savings Bank. These deposits carry pass-through insurance up to $250,000 in the aggregate. Crypto.com states clearly in its security disclosures that this insurance protects against the failure of the partner bank only. This protection does not apply to cryptocurrency holdings. It does not cover the failure of Crypto.com itself, and it provides zero coverage against theft, fraud, or compromised account credentials. The exchange experienced a documented security incident on January 17, 2022, when attackers bypassed Two-Factor Authentication (2FA) controls across 483 user accounts. Crypto.com reimbursed all affected users in full and implemented security upgrades to prevent identical exploits. If you require absolute control over your private keys without third-party counterparty risk, Crypto.com is not for you. You should use a personal non-custodial hardware wallet instead. If you choose to trade on Crypto.com, verify current regional availability directly on the Crypto.com website before funding your account.

How it actually works

Crypto.com proves its reserve solvency by publishing an audited Merkle tree report verified by Mazars Group. Under the ISRS 4400 standard for agreed-upon procedures, the independent accounting firm inspects the exchange's cryptographic proof to compare on-chain assets against aggregate customer liabilities. Crypto.com asserts that all customer cryptocurrency balances are maintained on a strict 1:1 basis. The Merkle tree data structure provides cryptographic hashes of account records. This architecture enables you to locate your unique account identifier within the aggregate tree. You can confirm that Crypto.com accounted for your exact token balance without exposing personal financial details to other users.

Federal deposit insurance on Crypto.com applies exclusively to United States dollar fiat balances held at custodial partner banks. When you deposit fiat funds through Community Federal Savings Bank or other partner institutions, the Federal Deposit Insurance Corporation covers aggregate balances up to $250,000 per depositor. This insurance activates only if the partner bank itself becomes insolvent. Crypto.com explicitly notes in its security disclosures that FDIC insurance does not protect your account if Crypto.com becomes insolvent. Digital assets such as Bitcoin and Ethereum receive no government deposit insurance. If an attacker accesses your account credentials, federal insurance will not compensate the loss.

Crypto.com aligns its organizational security controls with international cybersecurity and business continuity frameworks. The exchange achieved compliance under ISO 22301:2019 for business continuity management, ISO/IEC 27701:2019 for privacy information management, and ISO/IEC 27001:2022 for information security management. In its payment processing environment, Crypto.com holds PCI DSS v4.0 Level 1 Service Provider validation. Crypto.com also completed a SOC 2 Type II examination, which audits operational controls over a sustained reporting period. Under the National Institute of Standards and Technology (NIST) Cybersecurity and Privacy Frameworks, Crypto.com achieved an assessment rating of Tier 4. The exchange also hires external security firm Kudelski Security to conduct continuous audits of its blockchain integrations.

The security controls on Crypto.com failed on January 17, 2022, when unauthorized transactions drained $35 million from 483 user accounts. The attackers bypassed the exchange's two-factor authentication controls to authorize transfers without the users entering valid verification codes. The attackers stole approximately 4,836.26 Ethereum (ETH) valued at roughly $15.2 million and approximately 443.93 Bitcoin (BTC) valued at roughly $18.6 million at the time of the incident. Crypto.com responded by suspending customer withdrawals, invalidating all existing two-factor authentication tokens, and reimbursing the total $35 million loss to affected depositors. On January 18, 2022, Crypto.com introduced a mandatory 24-hour delay on withdrawals to newly registered destination addresses to stop rapid account drain exploits.

Crypto.com enforces mandatory identity verification for every user before allowing trading, deposit, or withdrawal privileges. This Know Your Customer process requires you to submit government-issued identification documents to comply with international anti-money laundering standards. While identity verification prevents unverified accounts from transacting, it centralizes personal user data on exchange infrastructure. Our positive assessment of Crypto.com would change if the exchange abandoned its independent proof of reserves audits, failed to maintain 1:1 backing, or experienced an uncompensated security incident. To protect your assets against unexpected exchange disruptions, transfer your long-term cryptocurrency investments to a self-custody hardware wallet immediately after your trades settle.

Start here

1Enable Two-Factor Authentication (2FA) immediately using a dedicated mobile authenticator application rather than text message verification. Authenticator apps generate time-based codes locally on your mobile device. This reduces your exposure to SIM-swapping attacks and mobile network interception.
2Configure your withdrawal settings and register your private wallet addresses well before initiating any time-sensitive transfers. Crypto.com enforces a mandatory 24-hour security delay on any newly added withdrawal address. You cannot move funds to a new address until this lock window expires.
3Recognize the precise legal boundaries of the $250,000 FDIC pass-through deposit insurance on your fiat cash balance. This coverage protects United States dollar deposits held at Community Federal Savings Bank if that bank fails. It does not protect your account if Crypto.com fails, and it never covers cryptocurrency assets.
4Verify the legal availability and regulatory permissions of Crypto.com in your state or country directly on the official Crypto.com website. Regulatory permissions evolve frequently across international jurisdictions. Confirm that your jurisdiction allows unhindered fiat deposits and cryptocurrency withdrawals before transferring capital.
5Complete your Know Your Customer identity verification before depositing any fiat currency or digital assets. Crypto.com restricts account functionality until you provide government-issued identification documents. Completing verification early prevents unexpected account restrictions when you want to execute a trade.
6Audit your account balance against the latest Merkle tree cryptographic proof on the Crypto.com proof of reserves portal. Download your unique account hash from the exchange dashboard. Compare it against the published Mazars verification to ensure your holdings are included in the 1:1 reserve report.
7Move all assets designated for long-term storage off Crypto.com and into a non-custodial hardware wallet. Centralized custodial exchanges carry inherent counterparty risk and account vulnerability risks. Retaining your private keys in offline storage removes your exposure to exchange insolvency.

Strengths

Crypto.com publishes an audited Proof of Reserves report verified by independent firm Mazars Group under ISRS 4400 standards. This allows individual users to cryptographically verify 1:1 reserve backing of their balances using a Merkle tree data structure.
The exchange holds extensive third-party compliance credentials, including SOC 2 Type II certification, PCI DSS v4.0 Level 1 Service Provider status, and ISO/IEC 27001:2022 information security certification. These certifications verify that operational processes meet rigorous institutional standards.
Crypto.com attained a Tier 4 rating under the NIST Cybersecurity and Privacy Frameworks and retains Kudelski Security to conduct continuous external audits on its blockchain architecture. This testing identifies code vulnerabilities before hostile actors can exploit them.
Fiat balances denominated in United States dollars receive FDIC pass-through insurance up to $250,000 in the aggregate through custodial partner banks, including Community Federal Savings Bank. This protects cash holdings if the partner bank becomes insolvent.
Crypto.com demonstrated financial resilience and customer reimbursement following the January 17, 2022 security breach. The exchange absorbed the entire $35 million loss without passing damages to depositors, and introduced a 24-hour address lock to prevent unauthorized transfers.

Common misunderstandings

Attackers compromised 483 accounts on January 17, 2022 by circumventing two-factor authentication controls, resulting in the unauthorized withdrawal of 4,836.26 ETH and 443.93 BTC valued at approximately $35 million. This historical incident demonstrates that exchange-level security features can experience critical implementation failures.
FDIC pass-through insurance offers zero protection for cryptocurrency assets held on the exchange. If digital tokens are lost to an exploit or exchange distress, federal deposit insurance provides no legal reimbursement mechanism.
Crypto.com's own disclosures specify that FDIC coverage protects only against the failure of partner banks like Community Federal Savings Bank. The policy does not cover the bankruptcy of Crypto.com, corporate insolvency, fraudulent activity, or stolen account credentials.
Mandatory Know Your Customer verification requires users to submit government-issued identification documents before trading. Individuals seeking non-custodial or pseudonymous trading cannot access the exchange.
Assets stored on Crypto.com remain under centralized custody, exposing your capital to operational freezes, exchange delays, and counterparty risks that do not apply to self-custodied hardware wallets.

Common questions

Is Crypto.com legit?

Crypto.com is a legitimate cryptocurrency exchange that publishes third-party verified reserves and maintains formal regulatory and security certifications. The exchange holds ISO/IEC 27001:2022, ISO 22301:2019, and ISO/IEC 27701:2019 certifications, alongside SOC 2 Type II compliance and PCI DSS v4.0 Level 1 status. Crypto.com also publishes a Proof of Reserves audited by Mazars Group under ISRS 4400 standards, confirming that all customer cryptocurrency assets are held on a 1:1 basis. While Crypto.com is a legitimate custodial business, retaining assets on any centralized exchange entails counterparty risks that differ fundamentally from private cold storage.

Has Crypto.com been hacked?

Yes, Crypto.com experienced a confirmed security breach on January 17, 2022, which resulted in the theft of approximately $35 million. Attackers bypassed two-factor authentication controls on 483 accounts to initiate unauthorized withdrawals of 4,836.26 ETH and 443.93 BTC. Crypto.com halted withdrawals, invalidated all user two-factor authentication tokens, and reimbursed every affected customer in full out of corporate funds. Following the incident, the exchange instituted an obligatory 24-hour delay between registering a new withdrawal address and sending funds to that address, substantially raising the difficulty for attackers attempting rapid unauthorized withdrawals.

Is Crypto.com regulated?

Crypto.com enforces strict Know Your Customer identity verification before permitting users to trade or withdraw assets, and its Proof of Reserves audit is independently verified by Mazars Group. In the United States, fiat dollar deposits are held with FDIC member banking partners like Community Federal Savings Bank, providing FDIC pass-through coverage up to $250,000 for cash. Beyond those specific disclosures, this page does not have a sourced, current list of Crypto.com's licenses by country or state. Because licensing and operational permissions change across global jurisdictions, review current operating authorizations directly on the official Crypto.com website before funding an account.

Is my money insured on Crypto.com?

Your money receives insurance coverage only when held as United States dollar fiat cash in custodial partner bank accounts. Cryptocurrency holdings receive no insurance coverage. Crypto.com places customer dollar balances with FDIC-member financial institutions, including Community Federal Savings Bank, which provide pass-through insurance up to $250,000 in the aggregate. However, Crypto.com clearly discloses that this insurance covers only the insolvency of the banking partner. It does not protect your funds if Crypto.com becomes insolvent, nor does it cover losses from credential theft, fraud, or cybersecurity breaches.

Does Crypto.com require KYC?

Yes, Crypto.com requires mandatory Know Your Customer (KYC) identification verification for all account holders before they can trade, deposit, or withdraw funds. To satisfy regulatory anti-money laundering requirements, you must supply government-issued identification documents during the onboarding process. Unverified users cannot execute trades or move balances out of the exchange. This policy aligns Crypto.com with standard financial regulatory practices, but privacy-minded individuals who prefer pseudonymous transactions must use non-custodial decentralized protocols instead.

Is the Crypto.com app safe?

The Crypto.com mobile application is safe for buying, selling, and managing crypto assets if you follow recommended operational security practices. The app enforces strong authentication options and a mandatory 24-hour security delay on newly registered withdrawal addresses. It also benefits from Crypto.com's broader organizational standards, including Tier 4 NIST framework assessments and continuous Kudelski Security system audits. However, the mobile app remains a custodial gateway. If someone compromises your mobile device or account credentials, your assets could be vulnerable. For substantial long-term holdings, use an offline hardware wallet.

What happened in the Crypto.com 2022 hack?

On January 17, 2022, unauthorized actors compromised 483 Crypto.com user accounts by bypassing the exchange's two-factor authentication safeguards. The attackers withdrew approximately 4,836.26 ETH worth $15.2 million and 443.93 BTC worth $18.6 million, totaling roughly $35 million in stolen assets. Crypto.com quickly detected the unauthorized transactions, shut down withdrawal infrastructure, and restored account security by revoking all existing customer two-factor authentication tokens. The exchange fully reimbursed all 483 affected users, preventing any personal depositor losses. On January 18, 2022, Crypto.com implemented a mandatory 24-hour delay on all newly whitelisted withdrawal destinations to mitigate future account takeover risks.

Sources

Ready to put this into practice?

Exchange sign-up bonuses pay both you and a referrer after a qualifying trade.

See bonuses →