Luno

Is Luno safe?

Luno is one of the safer exchanges in the markets it serves. It has no reported platform hack in 13 years, publishes a monthly proof of reservesProof of reservesA report in which a crypto exchange shows that it holds enough coins to cover all customer balances, ideally checked by an outside firm.More in the glossary prepared with an accounting firm, and holds real licences in South Africa and Malaysia. The main limits are that it is not licensed in the US, UK or EU, and that its owner, Digital Currency Group, has had serious trouble elsewhere in its group.

We score Luno 75/100, close to Bitstamp and above CoinSpot, which publishes no reserves at all.

Where is Luno licensed?

Luno started in South Africa in 2013 as BitX and now runs separate companies in several countries. Which one you deal with depends on where you live, and so does your protection.

Country	Luno entity	Status
South Africa	Luno (Pty) Ltd	FSCA licence, FSP No. 53314
Malaysia	Luno Malaysia Sdn Bhd	Securities Commission exchange licence
Indonesia	PT Luno Indonesia	OJK licence
Bermuda	Luno International Ltd	BMA Class F digital asset business
Nigeria	Luno Fintech Nigeria	SEC approval-in-principle, incubation programme
Kenya	GTXN Investments Limited (bought September 2026)	Capital Markets Authority fund manager licence; cross-border business payments, not retail crypto
Australia	Luno Australia (Pty) Ltd	AUSTRAC registration only
United Kingdom	Luno Money Ltd	UK Financial Intelligence UnitFinancial intelligence unitA national government agency that receives reports of suspicious transactions from banks and crypto firms and analyses them for money laundering.More in the glossary reporting entity only

South Africa's regulator declared crypto assets a financial product in 2022, and in April 2024 Luno became the first dedicated crypto platform to get a financial services licence under the new rules. Malaysia's Securities Commission licensed Luno as a digital asset exchange, with an independent trustee holding customer money. Those two are genuine conduct regimes with complaints routes.

Proof of reserves: monthly and checkable

Luno published quarterly reserve reports with Mazars from 2021 until Mazars dropped its crypto clients in late 2022. Since February 2024 it has published monthly reports prepared with the accounting firm Moore. Each report compares the coins Luno holds with what it owes customers, and a Merkle treeMerkle treeA way to combine many records into one short code, so that each person can check their own record is included without seeing anyone else's.More in the glossary lets you confirm that your own balance was counted (on the website, not the app).

That is better than most exchanges outside the US and EU. Two limits: the work is done under agreed-upon procedures, which is narrower than an audit, and Luno does not publish audited group accounts, so you cannot see its other debts.

The DCG question

Digital Currency Group bought Luno in September 2020. DCG's lending arm, Genesis, collapsed in 2023 owing customers billions, and in January 2025 DCG paid the US SEC $38 million to settle claims that it misled investors about Genesis's losses after the Three Arrows Capital default. DCG neither admitted nor denied the findings.

None of this touched Luno, which runs as a separate subsidiary, and we found no sign that Luno customer assets were lent to Genesis. But an owner under financial and legal pressure is a risk worth knowing about. In July 2026 Luno said it would cut about 20% of its staff as it shifted towards business and institutional clients. In September it bought GTXN, a Kenyan fund manager licensed by the Capital Markets Authority, to run cross-border payments for companies; retail customers still deal with the national Luno companies above.

What protects your money

Luno says customer assets are ring-fenced from its own corporate funds, mostly kept in offline multisignatureMultisigA crypto wallet that needs approval from several keys to move funds, for example any 2 of 3, rather than from a single key.More in the glossary storage, and that its customer bank accounts are used only for customer money. In Malaysia an independent trustee, MTrustee Berhad, oversees customer funds. We found no published insurance policy for customer crypto, and no deposit guaranteeDeposit insuranceA government-backed scheme that repays bank customers up to a set limit if their bank fails, such as the FDIC in the US or the FSCS in the UK.More in the glossary applies.

The risk Luno customers actually meet is account takeover. In 2023 a Malaysian court awarded an investor almost RM700,000 after bitcoin was bought and withdrawn from his account without his consent. Luno said the investor's email and phone had been compromised and that it would appeal; we could not confirm the final outcome.

How to use Luno more carefully

1. Use an authenticator app rather than SMS codes, and secure the email account linked to Luno, since that is how most takeovers start.
2. Turn on Luno's withdrawal confirmations and address allowlist where available.
3. Check which Luno entity you are signed up with; protection in South Africa or Malaysia is stronger than in a market where Luno is only registered.
4. Keep long-term holdings in a wallet you control if you are comfortable managing keys.

How we scored it

Security history (88) is Luno's strongest factor, with no known platform hack since 2013. Licensing (65) is the weakest, because its licences are in South Africa, Malaysia and smaller markets, not in the US, UK or EU. Legal record (70) reflects a clean record for Luno itself but a parent company that settled with the SEC.