Crypto.com

Is Crypto.com safe?

Mostly, for a platform of its size. Crypto.com holds a MiCAMiCAThe EU's Markets in Crypto-Assets Regulation, which requires crypto exchanges and other providers to be licensed and supervised.More in the glossary licence in the EU, an e-moneyE-moneyMoney held as a stored balance with a payment firm rather than as a bank deposit. It is safeguarded, not covered by deposit insurance.More in the glossary licence in the UK and money transmitter licences across the US, and when hackers drained 483 accounts in 2022 it repaid every one. We score it 68/100.

The gap is transparency. Crypto.com is private, publishes no audited accounts, and its last proof of reservesProof of reservesA report in which a crypto exchange shows that it holds enough coins to cover all customer balances, ideally checked by an outside firm.More in the glossary signed off by an accounting firm dates from December 2022. You are trusting its word that the coins are there.

The January 2022 account hack

On 17 January 2022 Crypto.com paused withdrawals after spotting unauthorised transactions. Attackers had found a way to approve withdrawals without the users' two-factorTwo-factor authenticationSigning in with a second proof of identity on top of your password, such as a code from an app, a security key or a passkey.More in the glossary codes. Its post-mortem said 483 accounts lost 4,836 ETH, about 444 BTC and around $66,000 in other coins, roughly $34 million at the time.

Crypto.com reimbursed every affected customer, moved to a new multi-factor authentication system and added a 24-hour delay before new withdrawal addresses can be used. Those were the right fixes, and the delay is still one of the most useful protections the app offers.

A separate claim surfaced in 2025, when Bloomberg reported that a member of the Scattered Spider group said they had phished a Crypto.com employee in 2023 and accessed personal data of a small number of users. Chief executive Kris Marszalek called the suggestion that the incident was hidden "completely unfounded", and the company said it had reported it to US state regulators.

Reserves: one snapshot, then silence

After FTX collapsed, Crypto.com published a proof of reservesProof of reservesA report in which a crypto exchange shows that it holds enough coins to cover all customer balances, ideally checked by an outside firm.More in the glossary in December 2022. The accounting firm Mazars compared customer balances in Crypto.com's database with assets in its on-chain wallets and found client assets fully backed.

Mazars stopped doing such work for crypto firms within weeks. We could not find a newer report from an accountant. Without audited financial statements or a regular attested proof of reserves, there is no outside check on whether customer coins are fully backed or on the company's other debts. That is why reserves is Crypto.com's lowest score.

Licences

Region	Status
EU	MiCAMiCAThe EU's Markets in Crypto-Assets Regulation, which requires crypto exchanges and other providers to be licensed and supervised.More in the glossary licence for Foris DAX MT Limited from Malta's MFSA (27 January 2025)
UK	FCA e-money institutionE-moneyMoney held as a stored balance with a payment firm rather than as a bank deposit. It is safeguarded, not covered by deposit insurance.More in the glossary and cryptoasset registration
US	Money transmitter licences in most states; OCC conditional trust bank approval (February 2026)
UAE	Dubai VARA licence for Foris DAX Middle East FZE (exchange, broker-dealer, lending)
Singapore	Major payment institution licence

The OCC approval, for an entity called Foris Dax National Trust Bank, would put Crypto.com's US custody business under a federal bank supervisor if it meets the conditions to open. It would not take deposits or make loans.

Fines and investigations

Crypto.com's legal record is cleaner than most offshore rivals. On 2 October 2023 the Dutch central bank fined it €2.85 million, made public in March 2024, for serving customers in the Netherlands without registration until 2 August 2023. Crypto.com objected to the decision. The SEC sent it a Wells notice in 2024; Crypto.com sued the agency, and the SEC closed the investigation in 2025 without bringing a case.

Who should be careful

Crypto.com is built around an all-in-one app: trading, a Visa card, staking rewards tied to its CRO token and, in some markets, prediction contracts. The more of those you use, the more of your money depends on one company. Card rewards and higher staking rates often require locking CRO for months, which exposes you to that token's price and makes it harder to leave quickly.

How to stay safe on Crypto.com

• Keep the withdrawal whitelist on and leave the 24-hour hold on new addresses in place. It gives you a day to spot a theft.
• Use a passkeyPasskeyA way to sign in without a password. Your device holds a key tied to one website or app and unlocks it with your fingerprint, face or PIN.More in the glossary or authenticator app; Crypto.com's 2022 hack started with a 2FATwo-factor authenticationSigning in with a second proof of identity on top of your password, such as a code from an app, a security key or a passkey.More in the glossary weakness.
• Read the terms before locking coins for higher rewards or staking. Locked assets cannot be moved quickly if something goes wrong.
• Be wary of "Crypto.com support" contacts on social media or Telegram. Real support works through the app chat.

How we scored it

Licensing (80) is Crypto.com's strongest factor, with legal record (72) and security history (70) close behind. Reserves (52) is the weakest, because there has been no accountant-attested proof of reservesProof of reservesA report in which a crypto exchange shows that it holds enough coins to cover all customer balances, ideally checked by an outside firm.More in the glossary since 2022 and no audited accounts. Compare Coinbase, which publishes audited accounts as a listed company.