Phemex

Is Phemex safe?

Phemex is an offshore derivatives exchange with a large hack and a regulator's ban on its record, and a few things in its favour. Attackers drained an estimated $70 million to $85 million from its hot walletsHot walletA crypto wallet connected to the internet, such as an app or an exchange's online wallet. It is convenient, but more exposed to hacking.More in the glossary in January 2025; Phemex said it would cover users and kept running. It publishes monthly reserves, though nobody outside checks them. It has no licence in a strict market, and Ontario banned it in 2025 for serving local investors without registration. We score it 45/100, level with MEXC and below BingX (51).

What happened in the January 2025 hack?

On 23 January 2025 the security firm Cyvers flagged unusual transfers from Phemex hot walletsHot walletA crypto wallet connected to the internet, such as an app or an exchange's online wallet. It is convenient, but more exposed to hacking.More in the glossary. The estimate grew over several days as more chains were found: about $29 million at first, $69 million according to PeckShield, $73 million in Halborn's count and at least $85 million in a tally reported by BleepingComputer. Halborn found that hot wallets on 16 blockchains, including Ethereum, Solana, XRP and Bitcoin, were emptied one after another, which points to compromised private keys kept in one place rather than a single wallet bug.

Phemex paused withdrawals, said its cold walletsCold storageKeeping crypto keys on a device or medium that is not connected to the internet, which protects them from most online attacks.More in the glossary were untouched and promised a compensation plan. Halborn noted that Phemex pointed users to its proof of reservesProof of reservesA report in which a crypto exchange shows that it holds enough coins to cover all customer balances, ideally checked by an outside firm.More in the glossary to show it could absorb the loss. Some researchers told The Block the attack resembled TraderTraitor, a North Korea-linked group the FBI blamed for the 2024 DMM Bitcoin theft. That is their view; no government has named the attacker.

We found no reports of customers left unpaid, which keeps security near the bottom of the rubric's "hack with full reimbursement" band. Sixteen hot wallets falling at once is still a serious failure of key management.

Ontario's ban and other regulator action

Ontario's Capital Markets Tribunal found in December 2024 that Phemex Limited, a BVI company, and its Singapore affiliate Phemex Technology Pte. Ltd. had traded securities with Ontario investors without registration between November 2019 and January 2023. At least 117 Ontario investors traded more than 74 million USDT on the platform. Phemex conceded the breaches. In June 2025 the tribunal permanently banned both companies from Ontario's capital markets, imposed a $300,000 administrative penalty, ordered $134,975 in costs and took back US$39,712 in fees.

Regulator	Date	Action
Capital Markets Tribunal (Ontario)	December 2024, June 2025	Breach of securities law; permanent ban, penalty and costs
FCA (UK)	23 January 2025	Warning: not authorised in the UK
SEC (Philippines)	1 August 2025	Named as unregistered; local internet providers blocked the site

The tribunal decision is a real enforcement record, not just a warning, which is why Phemex's legal record scores lower than BingX's.

Who runs Phemex now?

The tribunal says Phemex Limited began voluntary liquidation in August 2023 and Phemex Technology was struck off the Singapore register. The current terms of use, updated July 2025, name Phemex Poland sp. z o.o., with an address in Katowice, as the contracting company, apply Singapore law and send disputes to the Singapore International Arbitration Centre. Phemex is not on ESMA's MiCAMiCAThe EU's Markets in Crypto-Assets Regulation, which requires crypto exchanges and other providers to be licensed and supervised.More in the glossary register, and its terms exclude the US, UK, Australia, China, the UAE and several Canadian provinces.

On paper the terms are better than many offshore rivals': they say Phemex does not own users' crypto and holds it in a segregated trust or client account. No regulator checks that, and the terms also say Phemex is not liable if a custodian it picked in good faith goes bust.

Does Phemex prove its reserves?

Phemex publishes a monthly snapshot of wallet assets against customer assets, with a Merkle treeMerkle treeA way to combine many records into one short code, so that each person can check their own record is included without seeing anyone else's.More in the glossary you can use to check your own balance. On 1 October 2026 it reported 1,305.6 BTC against 1,265.9 BTC owed to users (103.13%), ETH at 123.79% and USD stablecoins at 100.60%. That is close to Bybit (109% for BTC in April 2026) and well below BingX (142.82% in July 2026). Unlike Bybit, which uses Hacken, Phemex names no auditor or security firm on the page, and it publishes no audited accounts.

How to use Phemex more carefully

1. Keep only trading money on Phemex. Futures losses and exchange risk add up.
2. Set up a passkeyPasskeyA way to sign in without a password. Your device holds a key tied to one website or app and unlocks it with your fingerprint, face or PIN.More in the glossary or authenticator app and a withdrawal allowlist; Phemex supports passkeys on the web.
3. Check your balance in the monthly Merkle treeMerkle treeA way to combine many records into one short code, so that each person can check their own record is included without seeing anyone else's.More in the glossary, and watch whether the stablecoin ratio drops below 100%.
4. If you live in Ontario, the UK, the Philippines or another restricted market, do not use VPN workarounds; you would have no complaint route at all.

How we scored it

Security history (60) is Phemex's strongest factor: a large hack, but customers were promised full cover and we found no unpaid claims. Licensing (15) is the weakest, with no strict licence and action by Ontario, the FCA and the Philippines SEC. Legal record (55) reflects the Ontario ban and penalty, and reserves (50) monthly self-published figures with thin margins and no outside check.