bitFlyer

Is bitFlyer safe?

bitFlyer has one of the better records in a country with a long history of exchange hacks. It says no coins have left its wallets through outside attacks since 2014, and it is licensed by three demanding regulators: Japan's Financial Services Agency, New York's NYDFS and, since June 2026, Luxembourg's CSSF under the EU's MiCAMiCAThe EU's Markets in Crypto-Assets Regulation, which requires crypto exchanges and other providers to be licensed and supervised.More in the glossary rules.

We score it 80/100, level with Coinbase and just ahead of its Japanese rival Coincheck. What keeps it from a higher score is how little it shows the public: it is private, publishes no proof of reservesProof of reservesA report in which a crypto exchange shows that it holds enough coins to cover all customer balances, ideally checked by an outside firm.More in the glossary, and in 2018 Japan's regulator found its management badly wanting.

A clean security record in a country of hacks

Japan has seen some of the worst exchange losses in crypto: Mt. Gox in 2014, Coincheck's ¥46.6 billion of NEM in 2018, and DMM Bitcoin's ¥48.2 billion of bitcoin in 2024. bitFlyer, which says it has been Japan's largest exchange by bitcoin volume for ten years running, is not on that list.

Its own wording is precise: no outflows caused by external unauthorised access since its founding. That is a company claim and leaves room for other kinds of loss, but we found no reported case of customers losing coins on bitFlyer. Under our rubric that puts it in the 90+ band in principle; we give 88 because the record rests largely on bitFlyer's word rather than published audits.

What the 2018 order found

On 22 June 2018 the Kanto Local Finance Bureau, acting for the FSA, issued bitFlyer a business improvement order. The findings were blunt. Management had put cost savings ahead of internal controls, including internal audit; the board and audit committee were not acting as a check; and the company had a culture of giving regulators explanations that differed from the facts during its registration review. Inspectors also found weaknesses in anti-money-launderingAnti-money launderingThe rules and checks that stop criminals from moving illegal money through banks, payment firms and crypto exchanges.More in the glossary checks, segregation of customer assets, record keeping and protection against unauthorised outflows.

bitFlyer stopped opening new Japanese accounts the same day and made existing customers re-verify their identity, in some cases by post. It reopened to new customers on 3 July 2019. We found no further orders or fines since, and the score of 70 reflects a serious but old case.

Licences on three continents

Entity	Regulator	Since
bitFlyer, Inc. (Japan)	FSA registration No. 00003	September 2017
bitFlyer USA	NYDFS BitLicenseBitLicenseNew York's licence for crypto businesses, issued by the state's financial regulator (NYDFS). It is one of the strictest crypto licences in the US.More in the glossary plus state licences, 49 states and DC	2017 (New York)
bitFlyer EUROPE S.A.	Luxembourg CSSF, MiCAMiCAThe EU's Markets in Crypto-Assets Regulation, which requires crypto exchanges and other providers to be licensed and supervised.More in the glossary licence	June 2026

Few exchanges hold both a New York BitLicense and a MiCA licence. Each customer is served by the entity for their region, and its rules apply.

How customer assets are held

Japanese law sets the floor for bitFlyer's main business. At least 95% of customer crypto, by value, must be in cold walletsCold storageKeeping crypto keys on a device or medium that is not connected to the internet, which protects them from most online attacks.More in the glossary, and any coins in hot walletsHot walletA crypto wallet connected to the internet, such as an app or an exchange's online wallet. It is convenient, but more exposed to hacking.More in the glossary must be matched by the exchange's own coins in cold storage, so a hot-wallet theft can be covered. Customer cash must be kept apart from company money.

What bitFlyer does not do is show this publicly. There is no proof of reservesProof of reservesA report in which a crypto exchange shows that it holds enough coins to cover all customer balances, ideally checked by an outside firm.More in the glossary, no Merkle treeMerkle treeA way to combine many records into one short code, so that each person can check their own record is included without seeing anyone else's.More in the glossary, and no public audited annual report like the 20-F that Coincheck's parent files with the SEC. You have to trust that Japan's supervisors are checking, which in 2018 they found reason to doubt.

How to use bitFlyer safely

1. Turn on two-factor authenticationTwo-factor authenticationSigning in with a second proof of identity on top of your password, such as a code from an app, a security key or a passkey.More in the glossary with an authenticator app and register withdrawal addresses ahead of time.
2. Be careful with leveraged trading on its Lightning platform; leverage losses are a bigger risk than hacks.
3. If you live outside Japan, make sure you sign up with the entity for your country, not the Japanese one.
4. Move long-term holdings to your own wallet. No exchange record is a guarantee.

How we scored it

Security history (88) and licensing (88) are bitFlyer's strongest factors: no reported customer losses in 12 years and licences in Japan, New York and the EU. Reserves (65) is the weakest because it publishes neither a proof of reservesProof of reservesA report in which a crypto exchange shows that it holds enough coins to cover all customer balances, ideally checked by an outside firm.More in the glossary nor public audited accounts. For another private exchange with a long clean record, compare Kraken, which does publish an audited proof of reserves.