BtcTurk

Is BtcTurk safe?

BtcTurk is a mixed bet. It has been hacked twice in 14 months, losing about $55 million in June 2024 and about $48 million in August 2025, both times because attackers got hold of the private keys to its hot walletsHot walletA crypto wallet connected to the internet, such as an app or an exchange's online wallet. It is convenient, but more exposed to hacking.More in the glossary. Each time it said customer balances were untouched and that it would carry the loss. We found nothing to contradict that, but we also found nothing that proves it, because BtcTurk publishes no proof of reservesProof of reservesA report in which a crypto exchange shows that it holds enough coins to cover all customer balances, ideally checked by an outside firm.More in the glossary.

We score it 53/100. That is below Bithumb, another twice-hacked exchange whose home market now requires audited accounts and bank-held customer cash, and well above WazirX, whose 2024 hack was passed on to its users.

What happened in the two hacks

June 2024. On 22 June BtcTurk said it had detected "uncontrolled withdrawals" caused by a cyber attack. Hot-walletHot walletA crypto wallet connected to the internet, such as an app or an exchange's online wallet. It is convenient, but more exposed to hacking.More in the glossary balances of 10 coins were partly drained; Halborn put the loss at about $55 million. The company stopped crypto deposits and withdrawals, said its financial strength was well above the amount affected, and reopened transfers after updating its systems. Binance froze about $5.3 million of the stolen funds. A month later long-time chief executive Özgür Güneri stepped down, and founder Kerem Tibuk took over.

August 2025. On 14 August BtcTurk first reported a "technical issue" with its hot wallets, then said it had found unusual activity and suspended crypto transfers. Security firms traced about $48 million leaving across several blockchains; CertiK estimated closer to $50 million. Trading and lira deposits and withdrawals kept running. Halborn called it a "less expensive mirror" of the 2024 attack: again, compromised hot-wallet keys.

A first hack can happen to any exchange. A second one with the same cause, a year later, says the fix after the first was not enough. Halborn's advice after the 2025 attack was basic: multi-signatureMultisigA crypto wallet that needs approval from several keys to move funds, for example any 2 of 3, rather than from a single key.More in the glossary or MPC walletsMPC walletA crypto wallet that splits the private key into several shares held in different places, so no single device or company holds the whole key.More in the glossary, caps on how much any one hot wallet holds, and keys stored apart so one breach cannot reach every chain. BtcTurk has not published a post-mortem saying which of these it has since adopted.

Licensing under Turkey's 2024 crypto law

Turkey brought crypto platforms under the Capital Markets Board (SPK) in 2024. Firms already operating had to declare themselves and apply, and the SPK publishes a provisional list of those allowed to continue. In October 2026 it lists Btcturk Kripto Varlık Alım Satım Platformu AŞ (formerly Eliptik Yazılım Ticaret AŞ) as a trading platform and Btcturk Dijital Saklama Yönetim AŞ as a custody applicant.

The SPK is explicit that the list "does not mean that the institutions on it have been authorised". It also uses its powers: in September 2026 it barred another exchange on the list, Bitexen, from taking new customers. Until BtcTurk receives a full operating licence, its licensing score stays in the middle.

What we cannot check

Most large exchanges started publishing proof of reservesProof of reservesA report in which a crypto exchange shows that it holds enough coins to cover all customer balances, ideally checked by an outside firm.More in the glossary after FTX failed in 2022. BtcTurk has not, as far as we could find, and it does not publish its audited accounts. Its claim that it could absorb about $100 million of hack losses over two years is plausible for a large exchange but rests on its word.

The legal record is otherwise light. In 2022 MASAK, Turkey's financial crimes board, fined the operator 2.45 million lira for anti-money-launderingAnti-money launderingThe rules and checks that stop criminals from moving illegal money through banks, payment firms and crypto exchanges.More in the glossary breaches in 2021, in the same round as Paribu, Bitci and Icrypex. We found no case against the company or its managers since.

How to use BtcTurk more safely

1. Keep only what you trade on the exchange. Both hacks hit hot walletsHot walletA crypto wallet connected to the internet, such as an app or an exchange's online wallet. It is convenient, but more exposed to hacking.More in the glossary, and crypto transfers were frozen afterwards.
2. Turn on app-based two-factor authenticationTwo-factor authenticationSigning in with a second proof of identity on top of your password, such as a code from an app, a security key or a passkey.More in the glossary and the withdrawal address allowlist.
3. Move long-term crypto to a wallet you control, and test with a small amount first.
4. Expect transfer freezes after any incident. Both times crypto withdrawals stopped while lira kept moving, so do not rely on BtcTurk for coins you may need at short notice.
5. Watch the SPK list. A full licence would bring custody and capital rules that should lower the risk; a restriction like Bitexen's would be a warning sign.

How we scored it

Legal record (78) is BtcTurk's strongest factor, with one small anti-money-launderingAnti-money launderingThe rules and checks that stop criminals from moving illegal money through banks, payment firms and crypto exchanges.More in the glossary fine. Reserves (35) is its weakest, because there is no public proof of reservesProof of reservesA report in which a crypto exchange shows that it holds enough coins to cover all customer balances, ideally checked by an outside firm.More in the glossary or audited accounts. Security history (55) reflects two large hacks covered by the company. Confidence is medium because the hacks and licence status come from primary or well-documented sources, but BtcTurk's own site blocked our review.