Crypto Exchanges Explained: How They Work, What They Charge, and What Proof of Reserves Does Not Prove

A crypto exchange is the piece of infrastructure almost everyone touches first and almost nobody examines. This is our standing reference on how these venues are built, what they charge, what their safety claims are worth and what to check before you trust one with money. It is maintained rather than published: figures carry a pull date, and the revision history at the foot records what changed and when.

One thing to establish before anything else, because it shapes the rest of the page. We cannot tell you how large any exchange is, and neither can anyone else outside it. We tried, using the best public dataset available, and the attempt failed for reasons worth understanding rather than skipping. That failure is set out in full in Exchange Data Says Binance Has 18% of the Market. That Number Is Not Usable, and the short version is below.

Why nobody can tell you which exchange is biggest

Across the 61 centralized venues reporting spot volume to DefiLlama on 4 August 2026, $33.3 billion changed hands in twenty-four hours, and Binance accounted for 17.9% of it.¹ The concentration index across those venues read 641, which would imply a market less concentrated than ten identical exchanges splitting it evenly.² Read the ranking underneath and the problem is obvious: second and third place went to BTCC at 10.5% and Pionex at 7.5%, while Coinbase — a listed company that reports audited transaction revenue every quarter — ranked twelfth at 2.8%.¹

We are not alleging that any venue misreported. The point is narrower and worse. The dataset is assembled from figures exchanges publish about themselves, there is no independent settlement layer to check them against, and so it cannot distinguish a large venue from a venue that says it is large. Thirty of the ninety-one exchanges tracked reported no spot volume at all, so every share is a share of those that chose to answer. We withdrew the statistic rather than publish a decimal point we could not defend.

This matters for you practically, not just editorially. Market-share tables are the most commonly cited reason for choosing a venue and they are the least reliable input available. Depth in the specific pair you trade, which you can see in a live order book, tells you more in ten seconds than any league table. The criteria that survive scrutiny are set out further down this page.

What a crypto exchange actually is

An exchange is two businesses wearing one brand. The first is a matching engine: an order book that pairs buyers with sellers and records the result. The second is a custodian: it holds the assets that back those orders. Almost everything that has ever gone wrong at an exchange went wrong in the second business while everyone was watching the first.

The part that surprises people is that trades on a centralized venue do not touch a blockchain at all. When you buy bitcoin on an exchange, no bitcoin moves. A row in the venue’s internal database is amended to say you are owed more of it and someone else is owed less. The chain is involved exactly twice: when you deposit and when you withdraw. Everything in between is a private ledger you cannot audit, run by a company whose solvency you are taking on faith. That is not a scandal, it is how every clearing venue in every asset class works. It is simply worth saying out loud, because it explains both why exchange trading is fast and cheap and why exchange failures wipe out balances that customers believed were theirs.

It also explains the measurement problem at the top of this page. Volume that never settles anywhere public cannot be counted by anyone except the venue reporting it. Stablecoin supply can be counted because it settles on a ledger you can read; we did exactly that in our stablecoin measurement. Exchange volume has no such backstop, which is why the honest answer to how big any venue is remains: nobody outside it knows.

Centralized, on-chain, and the brokers pretending to be both

A centralized exchange takes custody, runs an order book and gives you an account. An on-chain venue does not take custody at all: you trade against a pool of assets governed by a contract, your wallet signs the swap, and settlement is the swap. The trade-offs are almost exact opposites. Centralized venues give you speed, deep books, fiat rails and someone to sue, at the cost of counterparty risk. On-chain venues give you self-custody and public settlement, at the cost of gas fees, slippage on thin pools, front-running and no recourse whatsoever when you approve the wrong contract. We measured the split: on-chain venues handled 16.4% of spot volume in the period we examined, which is both more than most people assume and far from a takeover.³ The full method and caveats are in that measurement.

Then there is the third category, which is where most retail money actually sits: brokers and apps that look like exchanges and are not. You place an order, the app fills it from its own inventory or routes it to a market maker, and you hold a balance you may not be able to withdraw to an address. If an app does not let you move the asset off the platform, you do not own the asset, you own exposure to its price. That can be a perfectly rational thing to hold. It is not the same thing, and the marketing works hard to keep the distinction blurred.

Reading a fee schedule without being fooled

The advertised trading fee is rarely the largest cost. Maker and taker fees are visible, tiered by volume, and typically the smallest line. The spread is invisible and usually larger: on a thin pair you can pay more crossing the book than you pay in commission. Then come conversion spreads on fiat deposits, withdrawal fees that bear no relation to network fees, and, on derivatives, funding payments that accrue every few hours whether or not the position moves.

Zero-commission retail apps are the clearest case. There is no such thing as a venue that does not charge; there is only a venue that charges somewhere you are not looking. If the commission is zero, the revenue is in the spread, in payment for order flow, or in a conversion rate quoted a fraction below the market. Our view is blunt: treat any exchange that will not show you the executed price against a reference rate as charging you an amount it does not want to disclose, and price that uncertainty into your decision.

Proof of reserves, and what it does not prove

After 2022, most large venues began publishing proof-of-reserves attestations. The mechanism is real: the venue publishes a Merkle tree of customer balances and a set of wallet addresses, and you can verify that your own balance was included in the total. It is a genuine improvement on nothing at all. It is also routinely oversold.

Three limits matter. First, reserves are one side of a balance sheet; solvency requires knowing liabilities, and an attestation that omits borrowings, off-balance-sheet obligations or intercompany loans tells you very little. Second, wallet ownership is proved by signing a message, and assets borrowed for the duration of the snapshot sign just as convincingly as assets owned. Third, an attestation is not an audit: it carries no opinion, no going-concern assessment and usually a disclaimer that the accounting firm verified arithmetic rather than truth. A venue with a current proof of reserves is better than one without. It is not the same as a venue you can be confident is solvent.

The account is a contract, and you should read it

Whether your coins are yours in an insolvency is decided by the terms you accepted and the jurisdiction the entity sits in, not by the balance on the screen. Some venues hold assets in segregated accounts as bailee; some pool them; some reserve the right to lend them and disclose it in a clause most users never open. In several recent failures the deciding question was whether customer assets formed part of the bankruptcy estate, and the answer came from the terms of service. That document is the actual product. Read the custody clause, the rehypothecation clause and the clause naming the contracting entity, which is frequently registered somewhere other than where the brand is marketed.

This is the same problem set out in self-custody versus third-party custody, and the resolution is unglamorous: use exchanges for what they are good at, which is converting between assets and rails, and hold long-term positions somewhere you control the keys. The mechanics of doing that are in the wallets pillar.

Account security, in order of how often it fails

Phishing first. Almost every retail account loss we have looked at began with a convincing email, a sponsored search result or a support agent who contacted the victim rather than the other way round. No exchange calls you. Second, SMS two-factor authentication, which fails to a SIM swap performed at a phone shop; use an authenticator app or a hardware key instead. Third, API keys: a read-only key cannot drain an account, a trading key can be used to wash your balance into an illiquid pair, and a withdrawal-enabled key is a bearer instrument. Fourth, withdrawal address allowlists with a time delay, which turn a total loss into a phone call. None of this is exotic and all of it is skipped, usually at the moment someone is in a hurry.

Jurisdiction and licensing

There is no single crypto exchange license. A venue may be registered as a money services business in one country, licensed for virtual asset services in another, and operating with no permission at all in a third while still accepting its residents. Registers are public: check the entity name from the terms of service against the regulator’s own list rather than against the exchange’s claim. A license is not a guarantee of solvency, but an unlicensed venue in your jurisdiction means no recourse, no ombudsman and, in an insolvency, no queue to stand in. The wider picture is in our regulation pillar.

What actually matters when you choose one

We do not recommend exchanges and we do not accept payment to rank them. What we will do is state the criteria that survive contact with reality. Can you legally use it where you live, under the entity that actually contracts with you. Can you withdraw the asset to an address you control, and have you tested that with a small amount before it matters. What is the all-in cost of a round trip including spread and withdrawal, measured on the pair you actually trade rather than the headline pair. Is there real depth in that pair at the size you trade. What do the custody terms say. Does it support hardware two-factor authentication and withdrawal allowlists. And what is the documented record when things break: outages during volatility, withdrawal suspensions, support response times that can be verified from public complaints rather than from testimonials.

How to verify a venue yourself

Test the withdrawal path with a small amount on the day you open the account, not the day you need it. Look up the contracting entity in the regulator’s register. For listed operators, read the quarterly filings on SEC EDGAR, where transaction revenue is audited and can be compared against the volume the venue reports to data aggregators; the gap between those two figures is the single most useful sanity check available. Where a venue publishes proof of reserves, verify your own leaf in the Merkle tree rather than trusting the summary. And treat every self-reported volume figure, including the ones at the top of this page, as a claim by an interested party until something outside the venue corroborates it.

Order types, and the one that quietly costs the most

A market order says fill me now at whatever price exists. A limit order says fill me at this price or leave me alone. On a deep pair in calm conditions the difference is a rounding error. On a thin pair, or during the sixty seconds after a headline, a market order walks up the book and executes across every resting offer until it is filled, and the average price you receive can sit a long way from the one you saw. Stop orders inherit the same flaw: a stop is not a price, it is a trigger that becomes a market order, which is why stops cluster and then fill badly in exactly the conditions they were set for. If you take one habit from this section, make it the habit of using limit orders by default and treating market orders as a decision rather than a shortcut.

Slippage is therefore a function of the venue and the pair, not of the asset. The same trade can be free on one book and expensive on another an hour later. This is also why exchange volume figures matter to traders even when they cannot be verified: depth is what you are actually shopping for, and depth is visible in the live order book even when the twenty-four-hour headline number is not trustworthy. Look at the book, not at the league table.

Liquidity is per pair, not per exchange

A venue can be enormous in one market and empty in another. The same exchange that quotes a two-basis-point spread on bitcoin against a dollar stablecoin may show a two-per-cent spread on a mid-cap token against the same stablecoin, and something far worse against a local currency. Quoting an asset in a fiat pair with no depth, then converting through a stablecoin leg, is often cheaper even after two sets of fees. The general rule holds across venues: stablecoin pairs carry the depth, fiat pairs carry the convenience, and the price of convenience is quoted in a spread nobody itemises. This is one of several reasons stablecoins matter more to market structure than their share of headlines suggests, which we set out in how stablecoins hold their peg.

Derivatives, leverage and the liquidation engine

Most reported crypto volume is not spot at all. Perpetual futures dominate activity on the largest venues, and they behave differently in ways that catch people out. A perpetual has no expiry and is tethered to spot by a funding payment exchanged between longs and shorts every few hours; hold a crowded position long enough and funding alone can exceed the move you were trading. Leverage is offered at multiples that make liquidation a near certainty rather than a risk, and liquidation is not a margin call from a human, it is an automatic engine closing your position at whatever the book offers.

The structural point is that the liquidation engine is a participant. Cascades happen because forced selling meets thinning bids and triggers more forced selling, and the venue’s insurance fund and auto-deleveraging rules decide who absorbs the shortfall. Those rules are documented and almost nobody reads them before opening a position. We do not offer trading advice and we will not tell anyone what leverage to use; we will say that the mechanics above are not incidental details, and that anyone using a product without reading its liquidation policy is trading a contract they have not read.

Records, tax and the exit

Every trade on an exchange is potentially a taxable event in the jurisdiction where you are resident, including crypto-to-crypto swaps that never touch cash. Exchanges vary enormously in what they will export and how far back, and several have closed with customers unable to retrieve their own histories. Export the full trade and transfer history on a schedule rather than at year end, keep the raw files rather than a summary, and record the withdrawal transaction identifiers so on-chain movements can be matched to exchange entries later. The tax treatment itself differs by country and changes; the record-keeping obligation does not. We cover the general shape of it in the tax and regulation pillar, and nothing here is tax advice.

Where this sits in the rest of our coverage

Exchanges is one of seven subjects we maintain as standing reference pages. The adjacent ones are Bitcoin, stablecoins, Ethereum and Layer 2 scaling, decentralized finance, self-custody and wallets and tax and regulation. We do not rank exchanges, we do not accept payment for placement, and nothing on this page is investment advice.

Revision history

• 6 August 2026. Established as the standing exchanges reference. The evergreen material was moved here from the 4 August measurement note, which now carries the finding alone and links up to this page. Measurement figures are the 4 August 2026 pull and are unchanged.