Paribu

Is Paribu safe?

Paribu has a cleaner security record than its main Turkish rival. We found no reported theft of customer funds in its history, while BtcTurk lost about $55 million in 2024 and about $48 million in 2025. The catch is transparency. Paribu publishes no proof of reservesProof of reservesA report in which a crypto exchange shows that it holds enough coins to cover all customer balances, ideally checked by an outside firm.More in the glossary and no audited accounts, so the claim that every customer balance is fully backed rests on the company's word and on a regulator that has not yet finished licensing it.

We score it 61/100. That puts it above BtcTurk (53), Indodax (57) and Bithumb (58), all of which have lost coins to hackers, and well below exchanges with audited accounts such as Bitstamp (83).

Is Paribu licensed in Turkey?

Turkey put crypto platforms under the Capital Markets Board (SPK) in 2024. Firms already operating had to declare themselves and apply for a licence, and the SPK publishes a provisional list of those allowed to continue in the meantime. The list dated 1 October 2026 includes two Paribu companies:

• Paribu Kripto Varlık Alım Satım Platformu AŞ, the trading platform, formerly Paribu Teknoloji AŞ.
• Paribu Kripto Varlık Saklama Kuruluşu AŞ, a separate custody company with an application pending.

The SPK states plainly that being on the list "does not mean" a firm has been authorised. It also acts on the list: on 23 September 2026 it barred another listed platform, Bitexen, from taking new customers or listing new coins. So Paribu's licensing score sits in the middle until it has a full licence.

Outside Turkey Paribu now owns CoinMENA, a Bahrain-based exchange it bought in December 2025. In September 2026 CoinMENA began operating in Jordan inside the central bank's regulatory sandbox, JoRegBox, which is a supervised trial rather than a full licence. Turkish customers of Paribu are not served by CoinMENA, so those arrangements do not change the protection of a Paribu account.

The company page on Paribu's own site gives paid-in capital of 500 million lira, held by a single shareholder, chief executive Yasin Oral, and names Yeditepe Bağımsız Denetim as its statutory auditor. Paribu raised its capital to that level in 2023 and said at the time it wanted to set the standard for the coming rules. Capital helps absorb losses, but it is not the same as showing that customer coins are all there.

New products in the same app

Since July 2026 the Paribu app also shows Borsa Istanbul and US shares, through Paribu Yatırım Menkul Değerler AŞ, a brokerage the company was allowed to set up in 2025. It also added a DeFi tab: a self-custodySelf-custodyHolding crypto in a wallet where you alone control the private keys, rather than leaving it with an exchange or another company.More in the glossary wallet secured by a passkeyPasskeyA way to sign in without a password. Your device holds a key tied to one website or app and unlocks it with your fingerprint, face or PIN.More in the glossary instead of a seed phraseSeed phraseA list of 12 to 24 words that can restore a crypto wallet and all its funds. Anyone who has it controls the wallet.More in the glossary, through which users can buy on-chain tokens. Coins in that wallet are not held by Paribu, so neither the exchange's custody nor the SPK regime applies to them. Futures (via Hyperliquid) and options (via Polymarket) added to the same tab were switched off when we checked in October 2026.

Has Paribu been hacked?

Not in a way that cost customers money, as far as we could find. Paribu has had outages and repeated rumours of hacks on social media, which it has denied. In one statement, reported in 2021, it said it had detected a security breach on an evening of 19 February and had paused wallet activity as a precaution to protect customer assets. We found no report that any user lost funds from that event, and no on-chain analysis of a Paribu theft by a named security firm.

That matters because the two biggest Turkish exchange hacks of recent years, both at BtcTurk, came from stolen hot-walletHot walletA crypto wallet connected to the internet, such as an app or an exchange's online wallet. It is convenient, but more exposed to hacking.More in the glossary keys. Paribu says customer crypto is kept in cold walletsCold storageKeeping crypto keys on a device or medium that is not connected to the internet, which protects them from most online attacks.More in the glossary, a claim it repeated in 2021 when the collapse of Thodex left Turkish users with heavy losses.

Why there is no proof of reserves

After Thodex failed in April 2021, Paribu said that all customer lira and crypto was secured "through internal audit procedures", and that it was working with an independent audit firm on user assets and capital adequacy, with reports to be published when the work ended. We could not find those reports. There is no Merkle-treeMerkle treeA way to combine many records into one short code, so that each person can check their own record is included without seeing anyone else's.More in the glossary proof that would let a customer check their own balance, CoinMarketCap shows no reserve data for Paribu, and the audited accounts are not on its site.

This is the main reason Paribu does not score higher. Most large global exchanges started publishing reserves after FTX failed in 2022, and the best of them include liabilities and an outside attestation. A Turkish customer at Paribu cannot check either.

Legal record

In February 2022 MASAK, Turkey's financial crimes board, fined four exchanges a combined 18.8 million lira for failing anti-money-launderingAnti-money launderingThe rules and checks that stop criminals from moving illegal money through banks, payment firms and crypto exchanges.More in the glossary duties that applied from May 2021. Paribu's fine, 8 million lira, was the largest; BtcTurk paid 2.45 million.

In October 2025 Istanbul prosecutors detained 15 people over about 3.6 billion lira of illegal betting payments, and press reports said accounts at Paribu, Papara and Binance were among the payment channels reviewed using MASAK reports. Paribu said no operation was aimed at the company or its affiliates and that it would take legal action over false reports. We found no charge or penalty against Paribu itself from that case, but we will check again.

How to use Paribu more safely

1. Keep only trading money on the exchange. With no proof of reservesProof of reservesA report in which a crypto exchange shows that it holds enough coins to cover all customer balances, ideally checked by an outside firm.More in the glossary, you cannot verify that your balance is backed.
2. Use app-based two-factor authenticationTwo-factor authenticationSigning in with a second proof of identity on top of your password, such as a code from an app, a security key or a passkey.More in the glossary and add withdrawal addresses to an allowlist.
3. Expect extra checks on large or unusual withdrawals under Turkey's anti-money-launderingAnti-money launderingThe rules and checks that stop criminals from moving illegal money through banks, payment firms and crypto exchanges.More in the glossary rules, and do not rely on Paribu for money you may need the same day.
4. Move long-term holdings to a wallet you control, and send a small test amount first.
5. Watch the SPK list. A full licence would bring custody and capital rules; a restriction would be a reason to withdraw.

How we scored it

Security history (82) is Paribu's strongest factor, because we found no theft of customer funds. Reserves (35) is the weakest: there is no proof of reservesProof of reservesA report in which a crypto exchange shows that it holds enough coins to cover all customer balances, ideally checked by an outside firm.More in the glossary or published audit. Licensing (50) reflects a place on the SPK's provisional list, not a full licence, and legal record (72) reflects the 2022 MASAK fine. Confidence is medium because licence and fine data come from primary or well-sourced reports, while the security record rests on the absence of reports rather than an audit.