Bitso

Is Bitso safe?

Bitso has a cleaner record than most exchanges of its size and does more than most to show it is solvent, but the legal protection around your money is thinner than at a US or EU exchange. It has not reported losing customer funds, and every month it publishes a zero-knowledge proof that its reserves cover what it owes customers. Against that, its main crypto licence is from Gibraltar, Mexico does not license crypto exchanges as such, and it publishes no audited accounts. We score it 68/100, with low confidence because little about its custody is public.

For a Mexican or Argentine user who wants to buy crypto with local money, it is one of the better-documented options. For storing savings, the same rule applies as everywhere: an exchange balance is a claim on a company.

Who runs Bitso and where is it licensed?

Bitso was founded in Mexico City in 2014 and its group is run from Bitso S.A.P.I. de C.V. there, but your crypto is not held by the Mexican company. Bitso's terms say all crypto operations are carried out by The Badger Technology Company Limited, trading as Bitso International, a Gibraltar company (no. 117775) that holds the GFSC licence FSC1348B. Peso balances sit with the Mexican payment affiliate. It says it has more than 10 million users across Mexico, Argentina, Brazil and Colombia, and its business arm handles about 10% of US to Mexico remittance payments, according to the company.

Jurisdiction	Status
Gibraltar	Full DLT licence from the GFSC, granted October 2019
Mexico	No crypto exchange licence exists; affiliate Nvio Pagos México licensed as an electronic payment fund institution under the fintech law
Brazil	Retail customers moving to Mercado Bitcoin from October 2026; Bitso keeps institutional clients
Argentina, Colombia	Operates locally; we could not confirm its entry in Argentina's CNV register of virtual asset providers
US, EU, UK	No crypto licence

The Gibraltar licence is a real one. The GFSC framework covers risk management, governance and cyber controls. But Gibraltar is a small regulator, and the licence is not the same as answering to New York's financial regulator or an EU MiCAMiCAThe EU's Markets in Crypto-Assets Regulation, which requires crypto exchanges and other providers to be licensed and supervised.More in the glossary authority. In Mexico, the Bank of Mexico restricts how banks and fintechs can deal in crypto, so Bitso operates largely outside a crypto-specific regime.

What happened in Brazil?

On 1 September 2026, Valor Econômico reported that Bitso had agreed a commercial deal with Mercado Bitcoin, Brazil's largest exchange, with no shares changing hands. Bitso's individual customers in Brazil move to Mercado Bitcoin from October 2026, and Bitso keeps only its business clients there. The two companies presented it as a payments alliance.

The timing matters. Brazil's central bank now requires crypto firms to be authorised as virtual asset service providers, with a filing deadline of 30 October 2026. Two smaller Brazilian exchanges, Digitra and Coinext, closed trading in the same weeks. If you were a Bitso customer in Brazil, check that your balance arrived at Mercado Bitcoin and set up security on the new account.

Is Bitso's proof of solvency any good?

It is better than most. Many exchanges publish only proof of reservesProof of reservesA report in which a crypto exchange shows that it holds enough coins to cover all customer balances, ideally checked by an outside firm.More in the glossary, showing what they hold. Bitso's proof, built with the cryptography firm Proven, covers both sides: the assets it holds, which it proves by signing messages from its wallets, and what it owes customers. A zero-knowledge proof then shows assets are at least equal to liabilities without revealing wallet addresses or balances. The result is posted to a smart contract on Ethereum each month, and logged-in customers can see the reports in their profile.

The limits are the usual ones. No accounting firm signs the reports, so you are trusting the setup of the proof. It covers customer crypto, not the company's other debts. And Bitso is private, so there are no audited financial statements to check its overall position. That is why reserves scores 58, above Binance.US (35), which publishes no proof at all, but well below listed exchanges like Coinbase.

What about hacks?

On 5 July 2018 Bitso reported a cyberattack and switched off crypto deposits and withdrawals while it investigated. Its board chair said customer funds were safe, and Mexico's banking regulator, the CNBV, told financial institutions to raise their guard. Services came back within days. We found no other reported breach and no case of customers losing funds to an attack on Bitso.

What we could not find is just as relevant: Bitso does not publish how much of its crypto is in cold storageCold storageKeeping crypto keys on a device or medium that is not connected to the internet, which protects them from most online attacks.More in the glossary, whether it carries insurance, or how client assets are ring-fenced in law. That is the main reason for low confidence.

How to use Bitso more safely

1. Turn on two-factor authenticationTwo-factor authenticationSigning in with a second proof of identity on top of your password, such as a code from an app, a security key or a passkey.More in the glossary with an authenticator app, not SMS, and use a long unique password.
2. Set up the withdrawal address allowlist so coins can only leave to wallets you have approved.
3. Open the Proof of Solvency section once a month and check the latest report is marked solvent.
4. Remember that pesos on Bitso are not covered by IPAB, Mexico's bank deposit insuranceDeposit insuranceA government-backed scheme that repays bank customers up to a set limit if their bank fails, such as the FDIC in the US or the FSCS in the UK.More in the glossary. Keep savings in an insured bank account.
5. Keep long-term crypto holdings in a wallet you control, and move only what you need to trade.

How we scored it

Security history (85) is the strongest factor: one 2018 attack with no reported customer loss. Custody (50) is the weakest, because Bitso publishes little about cold storageCold storageKeeping crypto keys on a device or medium that is not connected to the internet, which protects them from most online attacks.More in the glossary, insurance or legal segregation. Licensing (55) reflects a Gibraltar licence and a home market with no crypto licence regime. For comparison, Kraken holds licences in the US, EU and UK and has its proof of reservesProof of reservesA report in which a crypto exchange shows that it holds enough coins to cover all customer balances, ideally checked by an outside firm.More in the glossary attested by an accounting firm.