Can you trust crypto exchanges after the collapse of FTX?

What happened afterward is history. With the abrupt downfall of FTX, customers suddenly discovered that despite all previous guarantees, their assets had been locked as the defunct exchange filed for bankruptcy amid an $8 billion shortfall — the consequence of senior executives siphoning customer assets to trade in related hedge fund Alameda Research. Even though the new management claims they have recovered some customer assets, clients’ funds still remain frozen in bankruptcy proceedings, with no end in sight and heavy legal fees to follow. 

In the aftermath, the crypto community has raised serious concerns regarding the state of CEXs. Demands such as proof of assets and liabilities, segregation of customer funds, and voluntary registration as broker-dealers have echoed in the industry. That said, haven’t CEXs come this far by making an effort to legitimize their operations? Here’s why the issue is more complicated than meets the eye. 

Why not just get regulated?

The problem isn’t unique to the United States. Lennix Lai, managing director at Singaporean crypto exchange OKX, explains to Magazine that crypto exchanges cannot, as of now, be registered as broker-dealers due to a fundamental difference in their business model: 

“By definition, a crypto exchange is actually a matching engine that matches orders from buyers and sellers. A broker-dealer license only governs the relationships that you, as the firm, have the capability to handle client orders and route them to a stock exchange. However, in the crypto world, most of the business models running are not the broker-dealer model but actually a ‘stock exchange’ model. So, that gives governments regulatory difficulty in that we don’t have an exchange license to apply for.”

After registration, crypto exchanges in Canada become broker-dealers just like their stock-trading counterparts, even though regulators ruled that the assets facilitated by the exchanges are not securities. As Katrina Prokopy, chief legal officer at Canadian exchange Coinsquare, explains to Magazine: 

“Customers have access to our regulators, they have access to our legal and compliance department to help resolve matters, and they have ultimate recourse to the Canadian judicial system if that’s what they want to pursue. And you know, as a corporation registered in Ontario, we have a registered address for service.”

Are user funds protected by law?

“Assuming everybody’s doing the best, they try to make money, and it just doesn’t work, and the exchange goes bankrupt, you still don’t have any protection as the customer.”

For example, Coinbase’s terms of use state that the firm carries crime insurance that protects digital assets from theft and cybersecurity breaches. However, the policy does not cover “unauthorized access” to Coinbase accounts due to a breach of credentials. In addition, while U.S. customers’ fiat deposits are covered up to $250,000 by the Federal Deposit Insurance Corporation in the event of a default in the custodial bank, the same protection does not extend to their digital asset holdings. 

Another exchange, OKX, explicitly states in its terms of service that “Digital assets of users are not protected by deposit protection or deposit insurance scheme. In the case of an irreconcilable shortfall, you may not receive some or any of your deposited assets or funds.”

OKX’s Lai explains that this is because the insurance industry does not have the full capability to underwrite risks within the cryptocurrency realm: 

“Most of the insurance policies right now only cover a relatively restricted amount because they want to cap their appetite for risk, and also, they will cover a specific area of risk — for example, insider jobs.”

Coinsquare’s Prokopy confirms the limitations of insurance policies covering crypto firms. Coinsquare clients currently have insurance policies covering $1 million of their fiat Canadian dollar deposits, but Prokopy says the coverage does not extend to digital assets. She elaborates that the firm has been advocating for an expansion of coverage, as it is currently paying the same fees as other IIROC members for asset insurance:    

“There is the Canadian Investor Protection Fund, which is the insurance coverage that IIROC member firms have for customer assets in the crypto space. It is available for the cash component in the trading accounts. But the CIPF is not at this point covering crypto. So, in the event that the IIROC dealer went bankrupt, there would be insurance protection to the cash component, not the crypto component.”

Are proof of reserves legitimate?

As told by Lai, one way customers can receive assurance that their funds are secure is through a proof-of-reserves audit. 

“The proof of reserves we publish encompasses proof of liability,” says Lai. “For every OKX customer that owns their deposit, OKX records a liability to them.” 

The executive explains that by allowing users to self-verify the exchange’s disclosures using open-source methods, OKX demonstrates to its customers that its asset coverage to liability “is greater than one-to-one.” The exchange updates its proof of reserves monthly. 

Other stakeholders, such as former Kraken CEO Jesse Powell, disagree. For Powell, a proof of reserves featuring Merkle tree verification is “hand wavey bullshit” and cannot be used in lieu of a full traditional account. “The statement of assets is pointless without liabilities,” he tweeted in November 2022.

Graves also noted the difficulty of finding auditors to work in the first place. “The problem right now, as I understand it, is the auditors don’t know how to audit,” he says.

“They have no idea how to deal with this stuff. You can audit how many assets a crypto exchange has on-chain, but how much of it is pledged as collateral? That’s a lot harder to figure out unless you have access to their financial services, books, and records. […] We saw this with FTX. Yeah, FTX has some money, but a whole lot of it was transferred to Alameda, and Alameda is investing in leveraged swaps. And so just looking at assets on-chain, you can verify that, but it really tells you nothing in terms of liabilities and leverage.”

Currently, Coinbase is one of the few crypto exchanges to have an auditor — Deloitte — though much of it can be attributed to the fact that it’s a publicly traded company. Previously, South African auditor Mazars claimed that Binance users’ Bitcoin was “fully collateralized” on the platform but then removed its proof-of-reserve verification for Binance, along with other crypto exchanges, from its website approximately one week later. Binance says it has reached out to multiple large auditing firms, but they are “currently unwilling to conduct a PoR for a private crypto company.”

Can we still trust CEXs? 

While crypto users have largely agreed on the need for CEXs to become regulated in the aftermath of FTX’s collapse, it may not be currently possible due to the lack of regulatory pathways. Coinsquare’s Prokopy certainly illustrated the trust brought to CEXs when there is a clear pathway forward. However, both Lai and Graves raised the issue of chaotic regulatory frameworks in the U.S., Singapore and other parts of the world, making obtaining a broker-dealer license impossible.

That said, regulators have been ramping up efforts in this new field. In a White House briefing on Jan. 27, lawmakers stated that they were working on “safeguards” to supplement the development of new digital asset technologies and unveil priorities for blockchain research. For now, CEXs face an uphill battle to demonstrate legitimacy to their users. But as Graves puts it, some essential corporate safeguards remain in place aside from the contractual obligation to customers.

“I don’t think the current structure with offshore exchanges is an issue. If exchanges like Binance.US and Binance International don’t keep them independent, the U.S. regulators will go after Binance International and say we have jurisdiction because you’re acting through the U.S. entity. If they were commingling funds, local creditors could also go after Binance International to pay off all those debts.”