Bullish

Is Bullish safe?

By the measures that matter for counterparty risk, Bullish is one of the safest crypto exchanges we have scored. It is a public company listed on the New York Stock Exchange, Deloitte audits its accounts, it holds licences in New York, Germany, Hong Kong and Gibraltar, and its annual report says it has never lost customer crypto. We score it 89/100, level with Swissquote and above Kraken and Coinbase.

Two caveats. Bullish has only run since November 2021, so its clean record is short. And it is built for professional traders, not for someone buying their first bitcoin in an app.

What Bullish is

Bullish was created by Block.one, the company that raised billions selling the EOS token, and launched its exchange in 2021. In August 2025 it listed on the NYSE under the ticker BLSH. It also owns CoinDesk, the crypto news site, and CoinDesk Indices, whose benchmarks underpin some exchange-traded funds.

Its clients are fund managers, market makers, proprietary traders, brokers and "retail aggregators", the apps that pass their customers' orders to a deep order book. The 2025 annual report says retail trading "has historically been secondary" to that institutional focus. In September 2026 the exchange handled $42.2 billion of spot trading, according to its monthly 6-K filing.

Licences

Jurisdiction	Entity and licence
United States	Bullish US Operations LLC: NYDFS BitLicenseBitLicenseNew York's licence for crypto businesses, issued by the state's financial regulator (NYDFS). It is one of the strictest crypto licences in the US.More in the glossary and New York money transmitter licence; licences or no-action letters in most other states; FinCEN registration
European Union	Bullish Europe GmbH: MiCAMiCAThe EU's Markets in Crypto-Assets Regulation, which requires crypto exchanges and other providers to be licensed and supervised.More in the glossary licence from BaFin, 4 September 2025, passported across the EEA
Hong Kong	Bullish HK Markets Limited: SFC licence to run a virtual asset trading platform, 18 February 2025, plus Type 1 and Type 7 licences
Gibraltar	Distributed ledger technology licence from the GFSC for the main exchange

Few exchanges hold all of New York, a MiCA licence and Hong Kong at once. Each comes with capital, custody and audit rules, and each regulator can inspect the business.

Audited accounts instead of proof of reserves

Bullish does not publish the Merkle-treeMerkle treeA way to combine many records into one short code, so that each person can check their own record is included without seeing anyone else's.More in the glossary proof of reservesProof of reservesA report in which a crypto exchange shows that it holds enough coins to cover all customer balances, ideally checked by an outside firm.More in the glossary that lets a customer check their own balance. What it has instead is stronger in one way: full annual accounts audited by Deloitte and filed with the SEC, with quarterly results and monthly trading figures in between. An audit covers liabilities and debts outside customer balances, which a reserve snapshot cannot.

The accounts also show the risk of holding a company with a large crypto treasury. Bullish reports under IFRS and marks its own bitcoin to market, so falling prices turn into large reported losses. That affects shareholders first, but it is worth knowing if you hold big balances there.

How customer assets are held

The annual report says Bullish holds customer assets in the US, Germany, Hong Kong and Gibraltar "on trust or otherwise for customers' benefit and segregated from our own assets". It uses multi-signatureMultisigA crypto wallet that needs approval from several keys to move funds, for example any 2 of 3, rather than from a single key.More in the glossary cold storageCold storageKeeping crypto keys on a device or medium that is not connected to the internet, which protects them from most online attacks.More in the glossary and third-party custody providers, naming BitGo and Fireblocks.

The same report is frank about the limits. Some assets sit in omnibus accounts at sub-custodians, so a custodian's failure could leave Bullish with an unsecured claim. Insurance, for example $250 million per cold wallet, is shared and "would not be sufficient to cover a large-scale loss". This is normal for a large exchange, and better disclosed than at most.

Legal record

We found no fine or enforcement action against Bullish in the US, EU or Hong Kong. The one notable case concerns its former parent: in 2019 the SEC ordered Block.one to pay a $24 million penalty for selling EOS tokens without registering the offering. Bullish was not a party to that order.

Owning CoinDesk creates a conflict the company itself flags in its filings: a news outlet and an index provider sit in the same group as an exchange that lists tokens. Bullish says it uses information barriers between them.

How to use Bullish more safely

1. Check which Bullish entity you deal with. A US account sits with Bullish US Operations, an EU account with Bullish Europe GmbH, and the protections differ.
2. If you trade through a broker or app that routes orders to Bullish, your coins are held by that broker, not by Bullish. Score the broker, not the exchange.
3. Use withdrawal allowlists and hardware security keys on institutional accounts.
4. Remember that no licence turns crypto into insured deposits. Keep what you do not trade in self-custodySelf-custodyHolding crypto in a wallet where you alone control the private keys, rather than leaving it with an exchange or another company.More in the glossary or with a qualified custodian.

How we scored it

Licensing (95) is Bullish's strongest factor, with three strict regulators plus Gibraltar. Security history (90) reflects a clean but short record since 2021. Custody (82) is its weakest factor because of omnibus sub-custody and limited insurance. Confidence is high because the key facts come from the audited 20-F and regulator registers.