HostNexFlow › Library › Is the exchange legit?
How to tell if a crypto exchange is legit — the eight checks that actually work
The legitimacy check that matters is not “does it look real” — every scam exchange looks real — the clone economy exists precisely because the front-end is the cheapest thing to fake. It’s the verifiable layer underneath: the entity, the licenses, the reserves attestations, and the withdrawal behavior. Here is the checklist, ordered by what it rules out.
Every collapsed or fake exchange looked legitimate from the front page. The checks that actually discriminate are the ones that can’t be designed away — corporate paper, regulatory license, third-party-verifiable reserves, and the withdrawal test. This is the checklist, in the order that rules things out fastest — the cheap checks first, the decisive ones at the end.
Every claim below names its source and date. The checklist is the operation of that principle — each check is a thing you can verify yourself.
Check 1–2: the entity and the URL
The corporate entity. A real exchange has a named legal entity, a jurisdiction, and a leadership team you can identify — and the entity name appears in enforceable documents: terms of service, regulatory filings, license registers. “The exchange is registered in…” is checkable; a company with no findable registration, no named officers, and a website that answers with marketing copy is telling you what it is.
The URL and the clones. The dominant exchange-scam shape isn’t a fake exchange that fools you with features — it’s a pixel-perfect clone at a lookalike domain. Check the exact URL, the domain age (a “ten-year exchange” on a domain registered last quarter is the tell), and reach it by typed URL or a verified app-store listing — never a DM’d or ad link.
Check 3–4: the license and the reserves
The license, by name. Real licenses are checkable in public registers: NYDFS BitLicense, Dubai VARA, EU MiCA authorization, FCA registration. “Regulated” as an adjective means nothing; “licensed as X in register Y” can be verified in two minutes. The major venues have the paper — Coinbase’s NASDAQ listing + audited 10-Ks, Kraken’s Wyoming SPDI bank charter, Bybit’s VARA license — and the pattern of a legit venue is that its regulatory filings are findable.
Proof of reserves, read correctly. Monthly PoR attestations are a positive signal — they demonstrate the venue can produce the assets — with the standing caveat that they’re a point-in-time liability-side approximation, not an audit. An exchange with recurring attestations plus an auditor’s report is the strongest available public signal short of a listing. Neither substitutes for the withdrawal test — reserves paper says what it holds; the withdrawal says what it does. And a venue can only pass it once per test — run it. The fake fails it immediately; the thin one fails it slowly. Either failure is the answer — walk away from the venue entirely.
Check 5–6: the history and the withdrawal test
The incident file. Search the venue’s name + “hack,” “fine,” “settlement,” “withdrawal halt.” Every major exchange has entries — the question isn’t whether they exist (they all do) but what the response was: made whole (Bybit’s $1.5B theft absorbed without user loss) — the response to the worst day is the file entry that matters most vs. the tell of a real problem (withdrawal freezes that don’t reopen, unexplained “maintenance” that stretches).
The withdrawal test. Deposit a small amount, trade it, withdraw it. A legitimate exchange processes a small withdrawal in minutes to hours, every time, without contact. Any friction — “verification needed,” “deposit more to unlock,” “tax must be paid before release” — is the scam signature. The test costs a few dollars and answers the question definitively.
Check 7–8: the red flags that end it
Seven: promised returns. A venue that guarantees yield, advertises fixed returns, or shows a dashboard where your balance only goes up is not an exchange — it’s a pig-butchering or Ponzi front. Real exchanges charge fees on activity; they don’t promise outcomes.
Eight: the release-fee tell. The single most reliable signal in the category: a platform that asks for a deposit to unlock your withdrawal — a “tax,” a “verification fee,” a “gas fee to release funds” — is stealing money, full stop — and it is the shared signature of the pig-butchering fronts, the dashboard venues that were never exchanges at all. No legitimate exchange in the world does this.
The twenty-minute run-through
Run it once and the whole checklist takes twenty minutes: find the legal entity name in the terms page, look it up in the jurisdiction’s public register (the NYDFS list, the VARA register, the national company register), open the reserves page and check who signed the last attestation and when, then run the withdrawal test. The time investment is the point — a venue that survives twenty minutes of this is categorically more likely to be real.
The shortcut most people want — “is it on the app store, is it on the rankings site” — is necessary but not sufficient: listings are distribution, not audit. The signals that actually discriminate are the ones that cost the venue something: a named entity answerable to a regulator, recurring third-party attestations, and a withdrawal that lands without theatre.
The edge case the checklist handles cleanly: a real exchange with an ugly incident file is usually still safer than a spotless unknown — the incident is disclosed, priced, and survived — while a new venue with no file at all is the one this checklist exists for. Absence of a track record is not a clean file; it’s no file.
Calibrating on the known files
Calibrate on the known quantities: the real-file shape is a named entity + a license-register entry + a public incident record + an attested reserves cadence. Coinbase is the extreme case — a public-company 10-K is the maximal disclosure artifact — and the graded exchange files in this library show the whole spectrum from “audited and convicted” to “survived its worst day.”
The comparison is the tell: once you’ve seen what a real file contains, a fake one reads thin instantly — no enforceable entity, no register hit, no history because it’s three months old, and a withdrawal flow designed to extract rather than process.
The ordered checklist
Entity findable? URL exact and aged? License in a public register? Attestations or audit? Incident history with a survive-it response? Small withdrawal cleared clean? No promised returns? No release fees? The answers take twenty minutes and they catch every fake and most bad ones — the checklist works because it tests the layer that can’t be faked. Front-ends, logos, and dashboards are free; enforceable entities, public licenses, and withdrawals that land are not.
Frequently asked
What is the fastest way to check if an exchange is legit?
The withdrawal test — deposit a small amount, trade, withdraw. Any friction or “release fee” request is the definitive no.
Is proof of reserves proof an exchange is safe?
Partially — it’s a real signal but a point-in-time approximation, not an audit. Combine it with the license check and withdrawal test.
What is the biggest scam-exchange tell?
The release-fee demand — a platform asking you to deposit to unlock a withdrawal. No legitimate exchange does this.
Do legit exchanges have licenses?
Yes, findable in public registers — NYDFS BitLicense, Dubai VARA, EU MiCA. “Regulated” unverified means nothing.
Are the big names immune?
Legit doesn’t mean riskless — Coinbase, Kraken, Bybit are real and carry ordinary counterparty/regulatory risk. The checklist is for unknown venues, where it’s decisive.
What if an exchange looks and works exactly like a big one?
Check the domain — clone exchanges at lookalike domains are the most common execution. The URL is where the scam lives.