Reserve adequacy measured by OI coverage ratio: on-chain reserves vs current open interest. No TVL or OI data available. Note: this measures the exchange's derivative commitment coverage, not a full PoR ratio. Customer deposits beyond open positions are not captured in this metric. Score: 40.0/100.

Loss-absorption capacity from absolute balance-sheet size: reserves not observable — neutral 50. Larger reserves mean a venue can credibly self-fund recovery from a hack or operational loss; the coverage ratio (reserve_adequacy) measures sufficiency vs commitments, this measures the cushion's absolute depth. Score: 50.0/100.

No DefiLlama reserve breakdown — own-token share unobservable. NO NATIVE TOKEN — FTT-style own-token risk structurally absent (composition unverified). High own-token concentration was the central failure mode in the FTX collapse. Score: 90.0/100. BTC flow stability is tracked separately under flow_stress.

Transparency assessed by verifiability of reserve data. PoR: not found (none). CoinGlass: tracked. CoinGecko: absent. Independent verifiability: partial — holdings independently reconstructed, but the venue publishes no wallet list of its own. Score: 95.0/100.

Flow stress assessed via CoinGlass on-chain BTC balance changes (30d: -1.0%, 7d: -0.5%) plus DefiLlama all-asset inflows and CoinGlass liquidation data. Sustained on-chain outflows are the earliest detectable signal of a bank-run. Score: 74.0/100.

Operational risk: 2 incident(s) from DefiLlama /hacks. Severity uses log10 scale (e.g. $1M=5pts, $10M=10pts, $100M=20pts, $1B=30pts) × time-decay, plus status-page incidents and an operating-longevity bonus. Regulatory enforcement is scored separately. Score: 86.9/100.

Regulatory risk (asset-safety lens — supervision is protective, unsupervised grey-zone is the real risk): Central Bank of Ireland fined Coinbase Europe EUR 21.46M (6 Nov 2025; High Court confirmed 12 Jan 2026) for AML transaction-monitoring failures Apr 2021-Mar 2025 (30M+ txns / ~EUR 176B unmonitored; 2,708 STRs filed late). UK FCA fined CB Payments GBP 3.5M (Jul 2024) for breaching a 2020 high-risk-onboarding agreement. NYDFS consent order Jan 2023: $50M fine + $50M compliance spend + independent monitor (current status unverified). Dutch DNB EUR 3.3M (Jan 2023) for pre-registration operation. SEC unregistered-exchange suit (Jun 2023) DISMISSED WITH PREJUDICE 28 Feb 2025, no penalty. Licences: Nasdaq-listed (SEC reporting), NYDFS-regulated, MiCA CASP via Luxembourg CSSF (20 Jun 2025, passported to all 27 EU states). No criminal action. Penalty 4 × factor 0.81 × 3. resolved 2025-11-06 (0.9y ago) — decay ×0.81 (5y linear, floor 0.25). Score: 90.2/100.

Insurance blends willingness-to-compensate (payout 'strong') with client insurability (can you hedge, and what does the market charge): 0.6×payout 90 + 0.4×insurability 95 = 92.0 → 92.0/100. Two customer-loss events, both made whole from corporate funds. 2021 (Mar-May): SMS account-recovery flaw let attackers drain ~6,000 accounts — Coinbase reimbursed everyone who lost crypto (CoinDesk 2021-10-01). May 2025: bribed overseas support contractors leaked data on 69,461 users; Coinbase refused a $20M ransom, reimbursed customers tricked by the resulting social-engineering scams, and booked up to ~$400M remediation (CNBC 2025-05-15, The Register). CAVEAT: on 2026-09-29 BlockTower's Ari Paul publicly alleged Coinbase lost $25M of the firm's funds ~2 years ago, has not repaid, and concealed losses at other institutions (>$1B claimed); Coinbase denies ('we certainly didn't lose $1B'); no filings or evidence verified (cryptotimes.io 2026-09-29). Re-rate if substantiated.

Derivatives market presence: 0.00% of tracked open interest, 0.00% of tracked 24h volume (22 exchanges). Score: 60.2/100. MONITORED-UNSCORED (weight 0) pending calibration.

Reserve adequacy measured by OI coverage ratio: on-chain reserves vs current open interest. coverage 5.11× (TVL $172.23B / OI $33.73B). Note: this measures the exchange's derivative commitment coverage, not a full PoR ratio. Customer deposits beyond open positions are not captured in this metric. Score: 100.0/100.

Loss-absorption capacity from absolute balance-sheet size: $145.63B (DefiLlama clean reserves, ex-own-token). Larger reserves mean a venue can credibly self-fund recovery from a hack or operational loss; the coverage ratio (reserve_adequacy) measures sufficiency vs commitments, this measures the cushion's absolute depth. Score: 94.1/100.

Own-token (BNB) share of reserves: 15.444%. CLEAN — own-token 15.4% (below 45% threshold). High own-token concentration was the central failure mode in the FTX collapse. Score: 100.0/100. BTC flow stability is tracked separately under flow_stress.

Transparency assessed by verifiability of reserve data. PoR: published (zk-proof). CoinGlass: tracked. CoinGecko: present. Independent verifiability: full — venue publishes a wallet list that a third party reconciles. Score: 100.0/100.

Flow stress assessed via CoinGlass on-chain BTC balance changes (30d: -4.0%, 7d: -2.7%) plus DefiLlama all-asset inflows and CoinGlass liquidation data. Sustained on-chain outflows are the earliest detectable signal of a bank-run. Score: 50.6/100.

Operational risk: 1 incident(s) from DefiLlama /hacks. Severity uses log10 scale (e.g. $1M=5pts, $10M=10pts, $100M=20pts, $1B=30pts) × time-decay, plus status-page incidents and an operating-longevity bonus. Regulatory enforcement is scored separately. Score: 86.8/100.

Regulatory risk (asset-safety lens — supervision is protective, unsupervised grey-zone is the real risk): Binance/CZ DOJ plea Nov 2023: BSA and AML violations; $4.3B settlement; 5-year compliance monitor. Penalty 12 × factor 0.50 × 3. resolved + under active supervision until 2028-11-21 — penalty softened ×0.5 (supervision lowers forward risk). Score: 82.0/100.

Insurance blends willingness-to-compensate (payout 'strong') with client insurability (can you hedge, and what does the market charge): 0.6×payout 90 + 0.4×insurability 86.5 = 88.6 → 88.6/100. Made users whole from SAFU in the 2019 (~7,000 BTC) and 2022 BSC-bridge incidents. For the Oct-2025 ('10/10') depeg cascade Binance announced a ~$283M make-whole for USDe/BNSOL/WBETH-collateral liquidations — widely criticised as partial vs total cascade losses. SAFU covers hacks; it is discretionary, not contractual.

Derivatives market presence: 26.07% of tracked open interest, 34.32% of tracked 24h volume (22 exchanges). Score: 85.7/100. MONITORED-UNSCORED (weight 0) pending calibration.

Reserve adequacy measured by OI coverage ratio: on-chain reserves vs current open interest. BTC-only coverage 64.61× (CoinGlass 151,589 BTC ≈ $12.55B / BTC OI $0.19B); capped at 85 — non-BTC reserves unobserved. Note: this measures the exchange's derivative commitment coverage, not a full PoR ratio. Customer deposits beyond open positions are not captured in this metric. Score: 85.0/100.

Loss-absorption capacity from absolute balance-sheet size: $12.55B (BTC-only CoinGlass estimate). Larger reserves mean a venue can credibly self-fund recovery from a hack or operational loss; the coverage ratio (reserve_adequacy) measures sufficiency vs commitments, this measures the cushion's absolute depth. Score: 67.5/100.

No DefiLlama reserve breakdown — own-token share unobservable. NO NATIVE TOKEN + third-party-attested PoR — verified clean. High own-token concentration was the central failure mode in the FTX collapse. Score: 100.0/100. BTC flow stability is tracked separately under flow_stress.

Transparency assessed by verifiability of reserve data. PoR: published (third-party attested). CoinGlass: tracked. CoinGecko: absent. Independent verifiability: partial — holdings independently reconstructed, but the venue publishes no wallet list of its own. Score: 80.0/100.

Flow stress assessed via CoinGlass on-chain BTC balance changes (30d: +0.3%, 7d: +0.6%) plus DefiLlama all-asset inflows and CoinGlass liquidation data. Sustained on-chain outflows are the earliest detectable signal of a bank-run. Score: 74.0/100.

Operational risk: 1 incident(s) from DefiLlama /hacks. Severity uses log10 scale (e.g. $1M=5pts, $10M=10pts, $100M=20pts, $1B=30pts) × time-decay, plus status-page incidents and an operating-longevity bonus. Regulatory enforcement is scored separately. Score: 83.0/100.

Regulatory risk (asset-safety lens — supervision is protective, unsupervised grey-zone is the real risk): SEC staking settlement Feb 2023 ($30M, US staking shut); CFTC 2021 ($1.25M). Civil, settled, no monitor. SEC unregistered-exchange suit DISMISSED WITH PREJUDICE Mar 2025 (no penalty, no admission). Penalty 4 × factor 0.27 × 3. resolved 2023-02-09 (3.7y ago) — decay ×0.27 (5y linear, floor 0.25). Score: 96.8/100.

Insurance blends willingness-to-compensate (payout 'untested') with client insurability (can you hedge, and what does the market charge): 0.6×payout 65 + 0.4×insurability 95 = 77.0 → 77.0/100. No customer-fund-loss hack since 2011 founding, so make-whole generosity is unproven rather than demonstrated. The 2024 CertiK incident (~$3M) hit Kraken's own treasury, not customer balances, and was recovered. No socialised losses / ADL clawbacks on record.

Derivatives market presence: 0.39% of tracked open interest, 0.51% of tracked 24h volume (22 exchanges). Score: 57.8/100. MONITORED-UNSCORED (weight 0) pending calibration.

Reserve adequacy measured by OI coverage ratio: on-chain reserves vs current open interest. coverage 3.97× (TVL $31.25B / OI $7.86B). Note: this measures the exchange's derivative commitment coverage, not a full PoR ratio. Customer deposits beyond open positions are not captured in this metric. Score: 100.0/100.

Loss-absorption capacity from absolute balance-sheet size: $29.70B (DefiLlama clean reserves, ex-own-token). Larger reserves mean a venue can credibly self-fund recovery from a hack or operational loss; the coverage ratio (reserve_adequacy) measures sufficiency vs commitments, this measures the cushion's absolute depth. Score: 76.8/100.

Own-token (OKB) share of reserves: 4.953%. CLEAN — own-token 5.0% (below 45% threshold). High own-token concentration was the central failure mode in the FTX collapse. Score: 100.0/100. BTC flow stability is tracked separately under flow_stress.

Transparency assessed by verifiability of reserve data. PoR: published (zk-proof). CoinGlass: tracked. CoinGecko: present. Independent verifiability: full — venue publishes a wallet list that a third party reconciles. Score: 100.0/100.

Flow stress assessed via CoinGlass on-chain BTC balance changes (30d: +3.6%, 7d: +0.7%) plus DefiLlama all-asset inflows and CoinGlass liquidation data. Sustained on-chain outflows are the earliest detectable signal of a bank-run. Score: 80.0/100.

Operational risk: 0 incident(s) from DefiLlama /hacks. Severity uses log10 scale (e.g. $1M=5pts, $10M=10pts, $100M=20pts, $1B=30pts) × time-decay, plus status-page incidents and an operating-longevity bonus. Regulatory enforcement is scored separately. Score: 90.0/100.

Regulatory risk (asset-safety lens — supervision is protective, unsupervised grey-zone is the real risk): Aux Cayes (d/b/a OKX) pleaded guilty Feb 2025 to AML violations (2017-2022); $504M penalty ($420.3M forfeiture + $84.4M fine). Self-retained compliance consultant through ~Feb 2027 (no government monitor). Penalty 15 × factor 0.50 × 3. resolved + under active supervision until 2027-02-28 — penalty softened ×0.5 (supervision lowers forward risk). Score: 77.5/100.

Insurance blends willingness-to-compensate (payout 'mixed') with client insurability (can you hedge, and what does the market charge): 0.6×payout 60 + 0.4×insurability 59.5 = 59.8 → 59.8/100. 2018 OKEx futures blow-up triggered a socialised-loss CLAWBACK (~18% of profitable traders' gains, ~1,200 BTC). 2020: 42-day withdrawal freeze (founder detained) resolved with no losses + goodwill rebates. Did NOT compensate for the Oct-2025 ('10/10') cascade — the CEO publicly criticised Binance instead. Modern design uses ADL, not clawbacks.

Derivatives market presence: 6.08% of tracked open interest, 12.13% of tracked 24h volume (22 exchanges). Score: 76.7/100. MONITORED-UNSCORED (weight 0) pending calibration.

Reserve adequacy measured by OI coverage ratio: on-chain reserves vs current open interest. No TVL or OI data available. Note: this measures the exchange's derivative commitment coverage, not a full PoR ratio. Customer deposits beyond open positions are not captured in this metric. Score: 40.0/100.

Loss-absorption capacity from absolute balance-sheet size: reserves not observable — neutral 50. Larger reserves mean a venue can credibly self-fund recovery from a hack or operational loss; the coverage ratio (reserve_adequacy) measures sufficiency vs commitments, this measures the cushion's absolute depth. Score: 50.0/100.

No DefiLlama reserve breakdown — own-token share unobservable. NO NATIVE TOKEN — FTT-style own-token risk structurally absent (composition unverified). High own-token concentration was the central failure mode in the FTX collapse. Score: 90.0/100. BTC flow stability is tracked separately under flow_stress.

Transparency assessed by verifiability of reserve data. PoR: not found (none). CoinGlass: not tracked. CoinGecko: absent. Independent verifiability: none — no independent reconstruction of reserves available. Score: 95.0/100.

Flow stress assessed via CoinGlass on-chain BTC balance changes (30d: N/A, 7d: N/A) plus DefiLlama all-asset inflows and CoinGlass liquidation data. Sustained on-chain outflows are the earliest detectable signal of a bank-run. Score: 68.0/100.

Operational risk: 0 incident(s) from DefiLlama /hacks. Severity uses log10 scale (e.g. $1M=5pts, $10M=10pts, $100M=20pts, $1B=30pts) × time-decay, plus status-page incidents and an operating-longevity bonus. Regulatory enforcement is scored separately. Score: 89.7/100.

No enforcement actions, fines or consent orders against Bullish found as of 2026-10-01. Licensed: NYDFS BitLicense + NY money-transmission licence (Bullish US Operations LLC, 2025-09-17; NYDFS 0000046), FinCEN MSB, money-transmitter licences in select states (US launch live in 20 states); BaFin crypto custody/proprietary-trading/principal-brokerage licences uplifted to a MiCAR CASP licence for Bullish Europe GmbH (EU passport; BaFin ID 10162355); Hong Kong SFC VATP licence (CE BUQ956); Gibraltar GFSC DLT licence since 2021-11-09 (GFSC 119714). Filed CFTC DCM + DCO applications 2026-05-07 (pending). NYSE-listed (BLSH) since 2025-08-13 with SEC reporting; Deloitte-audited IFRS financials. Affiliate history: Block.one SEC EOS-ICO settlement Sep 2019 ($24M, civil) — not Bullish. Score: 100/100.

Insurance blends willingness-to-compensate (payout 'untested') with client insurability (can you hedge, and what does the market charge): payout 65 (insurability not assessed) → 65.0/100. No exchange hack or customer-fund loss since Nov 2021 launch, so make-whole behaviour is undemonstrated rather than proven. Only notable incident found: a full market-data outage in Jul 2026 (status.bullish.com), resolved with no reported customer losses.

Spot market presence only (not in the derivatives ranking): 0.88% of spot volume. Score: 53.9/100.

Reserve adequacy measured by OI coverage ratio: on-chain reserves vs current open interest. coverage 1.42× (TVL $2.59B / OI $1.83B). Note: this measures the exchange's derivative commitment coverage, not a full PoR ratio. Customer deposits beyond open positions are not captured in this metric. Score: 70.9/100.

Loss-absorption capacity from absolute balance-sheet size: $2.58B (DefiLlama clean reserves, ex-own-token). Larger reserves mean a venue can credibly self-fund recovery from a hack or operational loss; the coverage ratio (reserve_adequacy) measures sufficiency vs commitments, this measures the cushion's absolute depth. Score: 50.3/100.

Own-token (CRO) share of reserves: 0.230%. CLEAN — own-token 0.2% (below 45% threshold). High own-token concentration was the central failure mode in the FTX collapse. Score: 100.0/100. BTC flow stability is tracked separately under flow_stress.

Transparency assessed by verifiability of reserve data. PoR: published (self). CoinGlass: tracked. CoinGecko: present. Independent verifiability: full — venue publishes a wallet list that a third party reconciles. Score: 85/100.

Flow stress assessed via CoinGlass on-chain BTC balance changes (30d: N/A, 7d: N/A) plus DefiLlama all-asset inflows and CoinGlass liquidation data. Sustained on-chain outflows are the earliest detectable signal of a bank-run. Score: 67.5/100.

Operational risk: 1 incident(s) from DefiLlama /hacks. Severity uses log10 scale (e.g. $1M=5pts, $10M=10pts, $100M=20pts, $1B=30pts) × time-decay, plus status-page incidents and an operating-longevity bonus. Regulatory enforcement is scored separately. Score: 86.9/100.

Regulatory risk (asset-safety lens — supervision is protective, unsupervised grey-zone is the real risk): Dutch DNB fined Foris DAX MT EUR 2.85M (imposed Oct 2023, published 2024) for serving NL users ~2 years before registering (base fine raised for severity; Crypto.com said it would appeal). SEC investigation (Wells notice 2024) CLOSED with no action or settlement 27 Mar 2025. Licences: MiCA CASP via Malta MFSA (Jan 2025) + MFSA financial-institution licence for EMT/stablecoin services (Feb 2026); UK FCA MLR registration + authorised EMI; Singapore MAS Major Payment Institution (DPT); Hong Kong deemed-licensed (Jun 2024); South Korea VASP; Australia AFSL (via Card Group); US FinCEN MSB, state MTLs, CFTC DCM/DCO, OCC preliminary conditional approval for a national trust bank (20 Feb 2026). App unavailable in New York. No compliance monitor. Penalty 1 × factor 0.39 × 3. resolved 2023-10-01 (3.0y ago) — decay ×0.39 (5y linear, floor 0.25). Score: 98.8/100.

Insurance blends willingness-to-compensate (payout 'strong') with client insurability (can you hedge, and what does the market charge): 0.6×payout 90 + 0.4×insurability 63 = 79.2 → 79.2/100. Jan 2022: 2FA-bypass attack drained 483 accounts (~$33.7M: 4,836 ETH + 444 BTC); withdrawals paused, all 2FA tokens revoked, and every affected customer reimbursed in full from company funds ('in all other cases customers were fully reimbursed' — TechCrunch/BleepingComputer, Jan 2022; DefiLlama /hacks lists it as 'Crypto.com', no alias needed). 2023 employee-account phishing incident exposed limited personal data; no customer funds taken. No socialised losses or rollbacks found.

Derivatives market presence: 1.41% of tracked open interest, 0.31% of tracked 24h volume (22 exchanges). Score: 58.0/100. MONITORED-UNSCORED (weight 0) pending calibration.

Reserve adequacy measured by OI coverage ratio: on-chain reserves vs current open interest. coverage 0.39× (TVL $5.39B / OI $13.72B); reserves are a LOWER BOUND (venue publishes no wallet list to DefiLlama) so the true ratio is higher by an unknown margin — floored at 50, the unknown-data neutral. Note: this measures the exchange's derivative commitment coverage, not a full PoR ratio. Customer deposits beyond open positions are not captured in this metric. Score: 50.0/100.

Loss-absorption capacity from absolute balance-sheet size: $4.76B (DefiLlama clean reserves, ex-own-token). Larger reserves mean a venue can credibly self-fund recovery from a hack or operational loss; the coverage ratio (reserve_adequacy) measures sufficiency vs commitments, this measures the cushion's absolute depth. Score: 56.9/100.

Own-token (MX) share of reserves: 11.644%. CLEAN — own-token 11.6% (below 45% threshold). High own-token concentration was the central failure mode in the FTX collapse. Score: 100.0/100. BTC flow stability is tracked separately under flow_stress.

Transparency assessed by verifiability of reserve data. PoR: published (third-party attested). CoinGlass: tracked. CoinGecko: present. Independent verifiability: partial — holdings independently reconstructed, but the venue publishes no wallet list of its own. Score: 80.0/100.

Flow stress assessed via CoinGlass on-chain BTC balance changes (30d: N/A, 7d: N/A) plus DefiLlama all-asset inflows and CoinGlass liquidation data. Sustained on-chain outflows are the earliest detectable signal of a bank-run. Score: 66.1/100.

Operational risk: 0 incident(s) from DefiLlama /hacks. Severity uses log10 scale (e.g. $1M=5pts, $10M=10pts, $100M=20pts, $1B=30pts) × time-decay, plus status-page incidents and an operating-longevity bonus. Regulatory enforcement is scored separately. Score: 90.0/100.

Regulatory risk (asset-safety lens — supervision is protective, unsupervised grey-zone is the real risk): Dubai VARA notice of fines + cease-and-desist (2026-06-23) against MX Global LTD for unlicensed VA broker-dealer/exchange services 2022-Apr 2026 and onboarding users without meeting UAE KYC obligations (fine quantum not itemised). Seychelles FSA — MEXC's own nominal domicile — stated (2026-05-26) that MX Global Ltd (IBC 238047) has never held any VASP licence and is initiating enforcement plus referral for legal action. Estonian VASP licence revoked late 2023 for AML shortcomings. Forced exits: India (FIU-IND, services suspended 2026-02-28), Japan (FSA warning, delisted from JP app stores). On AMF/BaFin/FCA/Malaysia SC warning lists. No active compliance monitor. Penalty 8 × factor 0.94 × 3. resolved 2026-06-23 (0.3y ago) — decay ×0.94 (5y linear, floor 0.25). Score: 77.4/100.

Insurance blends willingness-to-compensate (payout 'mixed') with client insurability (can you hedge, and what does the market charge): payout 60 (insurability not assessed) → 60.0/100. No direct exchange hack in eight years, so the Guardian Fund is untested against a breach — but MEXC is NOT 'untested' on willingness: it has a real customer-loss record via freezes and rollbacks. Mar 2025: froze 1,500+ accounts over alleged manipulation rings and explicitly 'rolled back suspicious transactions' — a clawback/socialised-loss precedent with no disclosed restitution. Jul-Nov 2025 ('The White Whale'): $3M frozen for two orders in the same second, returned IN FULL only after a four-month public campaign, with the CSO conceding the risk team 'has not kept up'; the trader cited hundreds of unresolved freezes. Further freeze wave reported Feb 2026 (one disputed allegation of a 40% off-platform haircut demand, denied by MEXC). Guardian Fund compensation is explicitly DISCRETIONARY — committee-set, no published formula or appeals process. Borderline mixed/poor: restitution is pressure-dependent rather than process-driven, and empirically correlates with the user's social-media leverage. Do NOT credit the Futures Insurance Fund's ~$559M of payouts here — that is automated liquidation-shortfall absorption, not customer restitution.

Derivatives market presence: 10.60% of tracked open interest, 7.47% of tracked 24h volume (22 exchanges). Score: 75.5/100. MONITORED-UNSCORED (weight 0) pending calibration.

Reserve adequacy measured by OI coverage ratio: on-chain reserves vs current open interest. coverage 1.04× (TVL $13.79B / OI $13.31B). Note: this measures the exchange's derivative commitment coverage, not a full PoR ratio. Customer deposits beyond open positions are not captured in this metric. Score: 51.8/100.

Loss-absorption capacity from absolute balance-sheet size: $13.28B (DefiLlama clean reserves, ex-own-token). Larger reserves mean a venue can credibly self-fund recovery from a hack or operational loss; the coverage ratio (reserve_adequacy) measures sufficiency vs commitments, this measures the cushion's absolute depth. Score: 68.1/100.

Own-token (MNT) share of reserves: 3.727%. CLEAN — own-token 3.7% (below 45% threshold). High own-token concentration was the central failure mode in the FTX collapse. Score: 100.0/100. BTC flow stability is tracked separately under flow_stress.

Transparency assessed by verifiability of reserve data. PoR: published (third-party attested). CoinGlass: tracked. CoinGecko: present. Independent verifiability: full — venue publishes a wallet list that a third party reconciles. Score: 100.0/100.

Flow stress assessed via CoinGlass on-chain BTC balance changes (30d: -0.6%, 7d: -0.7%) plus DefiLlama all-asset inflows and CoinGlass liquidation data. Sustained on-chain outflows are the earliest detectable signal of a bank-run. Score: 77.6/100.

Operational risk: 1 incident(s) from DefiLlama /hacks. Severity uses log10 scale (e.g. $1M=5pts, $10M=10pts, $100M=20pts, $1B=30pts) × time-decay, plus status-page incidents and an operating-longevity bonus. Regulatory enforcement is scored separately. Score: 84.0/100.

Regulatory risk (asset-safety lens — supervision is protective, unsupervised grey-zone is the real risk): India FIU-IND PMLA penalty Rs 9.27 crore (~$1.1M, 2025-01-31) for operating unregistered; paid in full, FIU-IND registration completed, services resumed. Earlier: De Nederlandsche Bank EUR 2.25M (2024-10-22, unregistered Wwft services 2020-2023, reduced for remediation) and an Ontario Securities Commission settlement (Jun 2022, $2.47M disgorgement + undertaking). All settled, no monitor. Now materially MORE licensed than offshore peers: MiCAR CASP (Austria FMA, passported EEA-wide), UAE SCA full VASP licence (first issued, Oct 2025), Dubai VARA. Japan: unregistered — orderly service wind-down for JP residents from Jan 2026. Penalty 4 × factor 0.66 × 3. resolved 2025-01-31 (1.7y ago) — decay ×0.66 (5y linear, floor 0.25). Score: 92.1/100.

Insurance blends willingness-to-compensate (payout 'strong') with client insurability (can you hedge, and what does the market charge): 0.6×payout 90 + 0.4×insurability 35 = 68.0 → 68.0/100. The strongest real-world willingness evidence in this dataset. On 2025-02-21 Lazarus/DPRK drained ~401,000 ETH (~$1.4-1.5B) from a Bybit cold wallet via malicious JavaScript injected into the Safe{Wallet} signing UI — the largest crypto theft ever, and NOT a compromise of Bybit key material. Bybit disclosed within hours, NEVER gated withdrawals (350,000+ requests in ~12h, ~$5.5-6.1B of net outflows over the weekend bank run), and closed the ETH gap in UNDER 72 HOURS from corporate capital plus OTC purchases and short-term institutional loans — repaying Bitget's 40,000 ETH bridge loan within three days. Hacken's 2025-02-26 PoR snapshot re-confirmed >100% 1:1 client backing. Zero customer haircut, zero clawback, zero discretionary partial compensation. TWO CAVEATS: (1) 'strong' applies to CUSTODY losses — derivatives ADL is a genuine socialised-loss channel and Bybit used it in the 2025-10-10 flash crash, auto-deleveraging 50,000+ BTC-perp shorts (~$1.1B) once the fund was exhausted, with no compensation programme (Binance compensated some users after the same event); an insurance-fund redesign claiming >200% more loss-absorption capacity has since been announced. (2) On 2026-02-06 Bybit briefly halted withdrawals during a sharp sell-off, citing trading-spike system stress rather than liquidity; short-lived, deposits exceeded withdrawals throughout — log as an operational-resilience flag, not a solvency or willingness event.

Derivatives market presence: 10.29% of tracked open interest, 7.57% of tracked 24h volume (22 exchanges). Score: 75.2/100. MONITORED-UNSCORED (weight 0) pending calibration.

Reserve adequacy measured by OI coverage ratio: on-chain reserves vs current open interest. coverage 2.63× (TVL $5.09B / OI $1.94B). Note: this measures the exchange's derivative commitment coverage, not a full PoR ratio. Customer deposits beyond open positions are not captured in this metric. Score: 100.0/100.

Loss-absorption capacity from absolute balance-sheet size: $5.09B (DefiLlama clean reserves, ex-own-token). Larger reserves mean a venue can credibly self-fund recovery from a hack or operational loss; the coverage ratio (reserve_adequacy) measures sufficiency vs commitments, this measures the cushion's absolute depth. Score: 57.7/100.

Own-token (?) share of reserves: 0.000%. CLEAN — own-token 0.0% (below 45% threshold). High own-token concentration was the central failure mode in the FTX collapse. Score: 100.0/100. BTC flow stability is tracked separately under flow_stress.

Transparency assessed by verifiability of reserve data. PoR: published (none). CoinGlass: tracked. CoinGecko: present. Independent verifiability: full — venue publishes a wallet list that a third party reconciles. Score: 90.0/100.

Flow stress assessed via CoinGlass on-chain BTC balance changes (30d: N/A, 7d: N/A) plus DefiLlama all-asset inflows and CoinGlass liquidation data. Sustained on-chain outflows are the earliest detectable signal of a bank-run. Score: 50.0/100.

Operational risk: 1 incident(s) from DefiLlama /hacks. Severity uses log10 scale (e.g. $1M=5pts, $10M=10pts, $100M=20pts, $1B=30pts) × time-decay, plus status-page incidents and an operating-longevity bonus. Regulatory enforcement is scored separately. Score: 87.1/100.

No US (DOJ/SEC/CFTC) enforcement — Deribit restricts US users. VARA-licensed (Dubai, Jan 2025). Acquired by Coinbase Aug 2025 (~$2.9B). No active monitor. Score: 100/100.

Insurance blends willingness-to-compensate (payout 'strong') with client insurability (can you hedge, and what does the market charge): 0.6×payout 90 + 0.4×insurability 59.5 = 77.8 → 77.8/100. Nov-2022 hot-wallet hack (~$28M) was absorbed by the company's own reserves — client funds untouched (99% cold storage), users made whole, NOT socialised. The clawback mechanism exists but has never fired.

Derivatives market presence: 1.50% of tracked open interest, 1.25% of tracked 24h volume (22 exchanges). Score: 58.5/100. MONITORED-UNSCORED (weight 0) pending calibration.

Reserve adequacy measured by OI coverage ratio: on-chain reserves vs current open interest. No TVL or OI data available. Note: this measures the exchange's derivative commitment coverage, not a full PoR ratio. Customer deposits beyond open positions are not captured in this metric. Score: 40.0/100.

Loss-absorption capacity from absolute balance-sheet size: reserves not observable — neutral 50. Larger reserves mean a venue can credibly self-fund recovery from a hack or operational loss; the coverage ratio (reserve_adequacy) measures sufficiency vs commitments, this measures the cushion's absolute depth. Score: 50.0/100.

No DefiLlama reserve breakdown — own-token share unobservable. NO NATIVE TOKEN — FTT-style own-token risk structurally absent (composition unverified). High own-token concentration was the central failure mode in the FTX collapse. Score: 90.0/100. BTC flow stability is tracked separately under flow_stress.

Transparency assessed by verifiability of reserve data. PoR: not found (none). CoinGlass: not tracked. CoinGecko: absent. Independent verifiability: none — no independent reconstruction of reserves available. Score: 70.0/100.

Flow stress assessed via CoinGlass on-chain BTC balance changes (30d: N/A, 7d: N/A) plus DefiLlama all-asset inflows and CoinGlass liquidation data. Sustained on-chain outflows are the earliest detectable signal of a bank-run. Score: 68.0/100.

Operational risk: 0 incident(s) from DefiLlama /hacks. Severity uses log10 scale (e.g. $1M=5pts, $10M=10pts, $100M=20pts, $1B=30pts) × time-decay, plus status-page incidents and an operating-longevity bonus. Regulatory enforcement is scored separately. Score: 90.0/100.

No fines or enforcement actions found against LMAX Digital or LMAX Group as of 2026-10-01. LMAX Digital Broker Ltd is authorised by the Gibraltar FSC as a DLT provider for execution and custody (licence FSC1342B, granted Apr 2019). Institutional-only venue; group FX venues are FCA-regulated MTFs (LMAX Exchange) and the group is also CySEC-regulated. Sister entities served by Standard Chartered MiCA-compliant custody (Luxembourg, DIFC) from 2026. UNVERIFIED: whether LMAX Digital itself holds a MiCA CASP authorisation (transitional period ended 2026-07-01) — none found. Score: 100/100.

Insurance blends willingness-to-compensate (payout 'untested') with client insurability (can you hedge, and what does the market charge): payout 65 (insurability not assessed) → 65.0/100. No hack or customer-fund loss in 8+ years of operation (since May 2018), so restitution behaviour is undemonstrated rather than proven.

Reserve adequacy measured by OI coverage ratio: on-chain reserves vs current open interest. coverage 0.57× (TVL $7.41B / OI $13.00B). Note: this measures the exchange's derivative commitment coverage, not a full PoR ratio. Customer deposits beyond open positions are not captured in this metric. Score: 28.5/100.

Loss-absorption capacity from absolute balance-sheet size: $6.22B (DefiLlama clean reserves, ex-own-token). Larger reserves mean a venue can credibly self-fund recovery from a hack or operational loss; the coverage ratio (reserve_adequacy) measures sufficiency vs commitments, this measures the cushion's absolute depth. Score: 59.8/100.

Own-token (GT) share of reserves: 16.080%. CLEAN — own-token 16.1% (below 45% threshold). High own-token concentration was the central failure mode in the FTX collapse. Score: 100.0/100. BTC flow stability is tracked separately under flow_stress.

Transparency assessed by verifiability of reserve data. PoR: published (zk-proof). CoinGlass: tracked. CoinGecko: present. Independent verifiability: full — venue publishes a wallet list that a third party reconciles. Score: 100.0/100.

Flow stress assessed via CoinGlass on-chain BTC balance changes (30d: +0.7%, 7d: +0.1%) plus DefiLlama all-asset inflows and CoinGlass liquidation data. Sustained on-chain outflows are the earliest detectable signal of a bank-run. Score: 80.0/100.

Operational risk: 2 incident(s) from DefiLlama /hacks. Severity uses log10 scale (e.g. $1M=5pts, $10M=10pts, $100M=20pts, $1B=30pts) × time-decay, plus status-page incidents and an operating-longevity bonus. Regulatory enforcement is scored separately. Score: 83.3/100.

Regulatory risk (asset-safety lens — supervision is protective, unsupervised grey-zone is the real risk): No fines, consent orders or criminal actions found. Licences (gate.com licence guide, Aug 2026; casptracker.eu): MiCA CASP via Malta MFSA (Gate Technology Ltd, 29 Sep 2025) + MFSA financial-institution licence; Dubai VARA full VASP licence (Gate Technology FZE, 25 Apr 2025); CySEC CIF (Gate Securities Cyprus); AUSTRAC DCE registration; Gate US state MTLs (company claims 36). Exits: Hong Kong VATP application withdrawn and HK trading ceased May 2024 (SCMP); Japan — new accounts halted 22 Jul 2024 and exit announced, CoinDesk noting Gate was not FSA-registered (UNVERIFIED/CONFLICTING: Gate's own 2026 guide lists 'Gate Japan K.K.' FSA reg #00018 — not cross-checked against the FSA register). Appears on regulator warning lists (FinTelegram). The global platform itself is offshore and not under any prudential supervisor; no compliance monitor. Penalty 3 × factor 1.00 × 3. unsupervised / grey-zone posture (no resolution, no monitor) — full penalty. Score: 91.0/100.

Insurance blends willingness-to-compensate (payout 'mixed') with client insurability (can you hedge, and what does the market charge): payout 60 (insurability not assessed) → 60.0/100. No acknowledged customer-loss hack, but that is NOT a clean record: DefiLlama /hacks lists 'Gate' 2018-04 at ~$235M (private-key compromise, attributed to North Korea) plus a 2018-11 supply-chain incident; on-chain investigators (ZachXBT) tie the 2018 theft to Gate wallets and say Gate never disclosed it — Gate has never confirmed the loss. If real, it was absorbed silently (no user haircut visible), which shows balance-sheet capacity but zero transparency, so make-whole behaviour cannot be credited as process-driven. Separate user complaints of account locks / futures disputes exist but are unverified allegations.

Derivatives market presence: 10.04% of tracked open interest, 6.74% of tracked 24h volume (22 exchanges). Score: 75.0/100. MONITORED-UNSCORED (weight 0) pending calibration.

Reserve adequacy measured by OI coverage ratio: on-chain reserves vs current open interest. No TVL or OI data available. Note: this measures the exchange's derivative commitment coverage, not a full PoR ratio. Customer deposits beyond open positions are not captured in this metric. Score: 40.0/100.

Loss-absorption capacity from absolute balance-sheet size: reserves not observable — neutral 50. Larger reserves mean a venue can credibly self-fund recovery from a hack or operational loss; the coverage ratio (reserve_adequacy) measures sufficiency vs commitments, this measures the cushion's absolute depth. Score: 50.0/100.

No DefiLlama reserve breakdown — own-token share unobservable. NO NATIVE TOKEN — FTT-style own-token risk structurally absent (composition unverified). High own-token concentration was the central failure mode in the FTX collapse. Score: 90.0/100. BTC flow stability is tracked separately under flow_stress.

Transparency assessed by verifiability of reserve data. PoR: not found (none). CoinGlass: not tracked. CoinGecko: absent. Independent verifiability: none — no independent reconstruction of reserves available. Score: 90.0/100.

Flow stress assessed via CoinGlass on-chain BTC balance changes (30d: N/A, 7d: N/A) plus DefiLlama all-asset inflows and CoinGlass liquidation data. Sustained on-chain outflows are the earliest detectable signal of a bank-run. Score: 68.0/100.

Operational risk: 0 incident(s) from DefiLlama /hacks. Severity uses log10 scale (e.g. $1M=5pts, $10M=10pts, $100M=20pts, $1B=30pts) × time-decay, plus status-page incidents and an operating-longevity bonus. Regulatory enforcement is scored separately. Score: 90.0/100.

No enforcement actions found (ASIC, AUSTRAC, MAS). AUSTRAC-registered DCE (DCE-100461150-001; Independent Reserve Pty Ltd, ABN 46 164 257 069). Singapore: Independent Reserve SG Pte Ltd holds MAS Major Payment Institution licence PS20200517 for DPT services, the first crypto exchange licensed by MAS (exchange About page). Historically took legal advice that it did not need an AFSL (ASIC CP343 submission); under the Digital Assets Framework Act 2026 (commences 2027-04-09) it is in ASIC's no-action/transition window. Acquired by IG Group (LSE: IGG): 70% for A$178M with an option on the remaining 30%, completed 2026-01-30 after MAS and FIRB approval. UNVERIFIED: NZ FSP number and current AFSL/DAP application status. Score: 100/100.

Insurance blends willingness-to-compensate (payout 'untested') with client insurability (can you hedge, and what does the market charge): payout 65 (insurability not assessed) → 65.0/100. No incident has lost customer funds since operations began in 2014, so neither the insurance nor willingness to make customers whole has been tested. Parent IG Group (listed, FCA-regulated) is a plausible backstop but has made no commitment to act as one.

Spot market presence only (not in the derivatives ranking): 0.00% of spot volume. Score: 7.0/100.

Reserve adequacy measured by OI coverage ratio: on-chain reserves vs current open interest. coverage 0.75× (TVL $5.66B / OI $7.56B). Note: this measures the exchange's derivative commitment coverage, not a full PoR ratio. Customer deposits beyond open positions are not captured in this metric. Score: 37.5/100.

Loss-absorption capacity from absolute balance-sheet size: $5.22B (DefiLlama clean reserves, ex-own-token). Larger reserves mean a venue can credibly self-fund recovery from a hack or operational loss; the coverage ratio (reserve_adequacy) measures sufficiency vs commitments, this measures the cushion's absolute depth. Score: 57.9/100.

Own-token (BGB) share of reserves: 7.831%. CLEAN — own-token 7.8% (below 45% threshold). High own-token concentration was the central failure mode in the FTX collapse. Score: 100.0/100. BTC flow stability is tracked separately under flow_stress.

Transparency assessed by verifiability of reserve data. PoR: published (self). CoinGlass: tracked. CoinGecko: present. Independent verifiability: full — venue publishes a wallet list that a third party reconciles. Score: 90/100.

Flow stress assessed via CoinGlass on-chain BTC balance changes (30d: -18.8%, 7d: +0.0%) plus DefiLlama all-asset inflows and CoinGlass liquidation data. Sustained on-chain outflows are the earliest detectable signal of a bank-run. Score: 50.0/100.

Operational risk: 2 incident(s) from DefiLlama /hacks. Severity uses log10 scale (e.g. $1M=5pts, $10M=10pts, $100M=20pts, $1B=30pts) × time-decay, plus status-page incidents and an operating-longevity bonus. Regulatory enforcement is scored separately. Score: 35.0/100.

Regulatory risk (asset-safety lens — supervision is protective, unsupervised grey-zone is the real risk): No fines, consent orders or criminal actions found. EU: Italy/Poland/Lithuania/Bulgaria/Czech registrations lapsed under MiCA; Bitget EU (Vienna) applied to Austria FMA Jun 2026 — NOT on ESMA's CASP register; MiCA transition ended 1 Jul 2026 (casptracker.eu, coinlaw.io). France: AMF blacklisted Nov 2023; Bitget withdrew all French services by 31 Mar 2026 (AMF de-listed the site 9 Jul 2026 after exit). Japan FSA unregistered-operation warnings Mar 2023 + Nov 2024; Japan exit announced. Singapore operations suspended 2021 over BTS-token promotion; HK BitgetX licence bid withdrawn 2023; Turkey subsidiary liquidated 2024. Licences held: AUSTRAC DCE registration (spot only), El Salvador BCR BSP + CNAD DASP, Georgia Tbilisi Free Zone, Argentina, DIFC innovation licence (not a VARA licence). Philippines: operating unlicensed per local reporting. Penalty 5 × factor 1.00 × 3. unsupervised / grey-zone posture (no resolution, no monitor) — full penalty. Score: 85.0/100.

Insurance blends willingness-to-compensate (payout 'strong') with client insurability (can you hedge, and what does the market charge): payout 90 (insurability not assessed) → 90.0/100. Sep 2026 is a real, large-scale test and Bitget passed it: ~$388M stolen from hot/warm wallets via a third-party security-product zero-day (DPRK-linked) was absorbed in full by the ~$464M Protection Fund — user balances stated 'accurate and unaffected', no haircut or socialised loss, withdrawals restored in phases 28 Sep-2 Oct 2026 (~8 days frozen), fund refilled to $309M with company capital by 30 Sep. Withdrawals reopening is still completing on 2 Oct — re-check before relying on this. CAVEAT: Apr 2025 VOXEL-USDT perp incident — Bitget ROLLED BACK suspected-manipulation accounts and clawed back gains (a precedent for reversing trades), while promising compensation for residual losses from the fund (Cointelegraph, The Block). Strong on hack restitution; trade-reversal risk exists.

Derivatives market presence: 5.84% of tracked open interest, 4.37% of tracked 24h volume (22 exchanges). Score: 70.3/100. MONITORED-UNSCORED (weight 0) pending calibration.

Reserve adequacy measured by OI coverage ratio: on-chain reserves vs current open interest. No TVL or OI data available. Note: this measures the exchange's derivative commitment coverage, not a full PoR ratio. Customer deposits beyond open positions are not captured in this metric. Score: 40.0/100.

Loss-absorption capacity from absolute balance-sheet size: reserves not observable — neutral 50. Larger reserves mean a venue can credibly self-fund recovery from a hack or operational loss; the coverage ratio (reserve_adequacy) measures sufficiency vs commitments, this measures the cushion's absolute depth. Score: 50.0/100.

No DefiLlama reserve breakdown — own-token share unobservable. NO NATIVE TOKEN — FTT-style own-token risk structurally absent (composition unverified). High own-token concentration was the central failure mode in the FTX collapse. Score: 90.0/100. BTC flow stability is tracked separately under flow_stress.

Transparency assessed by verifiability of reserve data. PoR: not found (none). CoinGlass: not tracked. CoinGecko: absent. Independent verifiability: none — no independent reconstruction of reserves available. Score: 60.0/100.

Flow stress assessed via CoinGlass on-chain BTC balance changes (30d: N/A, 7d: N/A) plus DefiLlama all-asset inflows and CoinGlass liquidation data. Sustained on-chain outflows are the earliest detectable signal of a bank-run. Score: 68.0/100.

Operational risk: 0 incident(s) from DefiLlama /hacks. Severity uses log10 scale (e.g. $1M=5pts, $10M=10pts, $100M=20pts, $1B=30pts) × time-decay, plus status-page incidents and an operating-longevity bonus. Regulatory enforcement is scored separately. Score: 90.0/100.

No enforcement actions found (ASIC, AUSTRAC, FCA, CBI). Australia: CoinJar Australia Pty Ltd (ACN 648 570 807) is an AUSTRAC-registered DCE (DCE100749118-001) and authorised representative (AR 1290193) of EML Payment Solutions Ltd's AFSL for its card/payment products; it holds no AFSL of its own and is in ASIC's Digital Assets Framework transition (Act commences 2027-04-09). UK: CoinJar UK Ltd FCA-registered cryptoasset exchange + custodian wallet provider since Oct 2021. EU: CoinJar Europe Ltd (C496731) authorised as a MiCA CASP by the Central Bank of Ireland effective 2025-12-09 (custody, crypto-fiat exchange, transfers; not EMT transfers). US: launched 2025-07-28 in ~20 states; FinCEN MSB, Illinois and Mississippi money transmitter licences (NMLS 2492913). Score: 100/100.

Insurance blends willingness-to-compensate (payout 'untested') with client insurability (can you hedge, and what does the market charge): payout 65 (insurability not assessed) → 65.0/100. No incident has lost customer funds since 2013, so whether CoinJar would make customers whole is unproven.

Spot market presence only (not in the derivatives ranking): 0.00% of spot volume. Score: 0.0/100.

Reserve adequacy measured by OI coverage ratio: on-chain reserves vs current open interest. No TVL or OI data available. Note: this measures the exchange's derivative commitment coverage, not a full PoR ratio. Customer deposits beyond open positions are not captured in this metric. Score: 40.0/100.

Loss-absorption capacity from absolute balance-sheet size: reserves not observable — neutral 50. Larger reserves mean a venue can credibly self-fund recovery from a hack or operational loss; the coverage ratio (reserve_adequacy) measures sufficiency vs commitments, this measures the cushion's absolute depth. Score: 50.0/100.

No DefiLlama reserve breakdown — own-token share unobservable. NO NATIVE TOKEN — FTT-style own-token risk structurally absent (composition unverified). High own-token concentration was the central failure mode in the FTX collapse. Score: 90.0/100. BTC flow stability is tracked separately under flow_stress.

Transparency assessed by verifiability of reserve data. PoR: not found (none). CoinGlass: not tracked. CoinGecko: absent. Independent verifiability: none — no independent reconstruction of reserves available. Score: 50.0/100.

Flow stress assessed via CoinGlass on-chain BTC balance changes (30d: N/A, 7d: N/A) plus DefiLlama all-asset inflows and CoinGlass liquidation data. Sustained on-chain outflows are the earliest detectable signal of a bank-run. Score: 68.0/100.