Poloniex

Is Poloniex safe?

Poloniex has one of the weaker records among exchanges still operating. It lost about $114 million from its hot walletsHot walletA crypto wallet connected to the internet, such as an app or an exchange's online wallet. It is convenient, but more exposed to hacking.More in the glossary in November 2023, it was hacked once before in 2014, and it holds no licence in any strict jurisdiction. Its owners promised to cover the 2023 loss and it publishes monthly reserve reports, which keeps it off the very bottom. We score it 36/100, next to HTX, the other Justin Sun-linked exchange, and below KuCoin.

The practical risk is less a repeat hack than a platform with no outside supervisor holding your coins. If it froze withdrawals, you would have an arbitration clause and an unnamed offshore company to deal with.

What happened in the November 2023 hack

On 10 November 2023 attackers emptied Poloniex hot walletsHot walletA crypto wallet connected to the internet, such as an app or an exchange's online wallet. It is convenient, but more exposed to hacking.More in the glossary in hundreds of transactions. On-chain data from Arkham, reported by CoinDesk, showed about $114 million leaving an Ethereum wallet and about $42 million more on Tron. Security firms counted differently: PeckShield put the total near $125 million and SlowMist near $130 million. CertiK called it a likely private-key compromise.

Justin Sun said Poloniex "maintains a healthy financial position and will fully reimburse the affected funds", and that part of the stolen assets had been frozen. Poloniex offered the attacker a 5% bounty, which was not taken. On 15 November it said restoration was "mostly completed", and deposits and withdrawals came back coin by coin over the following weeks.

We found no report of customers left short, but also no published account of the reimbursement. That is why security history scores 48, below the 60–79 band for a hack fully made good.

The 2014 hack still matters

On 4 March 2014 an attacker found that withdrawals placed at almost the same instant could push a balance below zero, and took about 12.3% of the bitcoin on the exchange. The founder deducted 12.3% from every user's BTC balance and promised to repay it from fees. It was a small exchange then, but it set a pattern: twice, an attacker reached the funds that pay withdrawals.

Who runs Poloniex and where is it licensed?

Circle, the USDC issuer, bought Poloniex in February 2018 and sold the platform in November 2019 to a group backed by Justin Sun. The user agreement revised in April 2026 says services come from "the relevant Polo group entity" chosen by your country of residence, without naming it or its regulator.

The exclusions are a sign of caution about strict regulators rather than a licence anywhere. That gives Poloniex a licensing score of 10.

Reserves: published, but not audited

Poloniex posts a Merkle-treeMerkle treeA way to combine many records into one short code, so that each person can check their own record is included without seeing anyone else's.More in the glossary proof of reservesProof of reservesA report in which a crypto exchange shows that it holds enough coins to cover all customer balances, ideally checked by an outside firm.More in the glossary each month. The snapshot for 1 October 2026 showed platform holdings of 100.47% of user balances overall, for example 432.5 million USDT against 431.1 million owed to users and 12,535 BTC against 12,522 BTC. Counting liabilities is the right method, and you can check that your own balance was included.

The limits are the same as at HTX: Poloniex prepares the report itself, no accounting firm signs it, and with no audited accounts you cannot see the company's other debts. Reserve ratios a fraction above 100% leave little room if anything goes wrong.

The legal record before Sun

Both large US penalties date from before the 2019 sale. In August 2021 the SEC said Poloniex LLC ran an unregistered securities exchange from July 2017 to November 2019 and had chosen to be "aggressive" in listing tokens; it paid $10,388,309 without admitting or denying the findings. In May 2023 OFAC settled with the same company for $7,591,630 over 65,942 transactions between July 2015 and September 2019, worth about $15.3 million, by 232 customers apparently in Crimea, Cuba, Iran, Sudan and Syria. OFAC says the founders' controls cut the rate of violations from late 2017 and Circle's, after its February 2018 purchase, cut it further, but some Crimea accounts kept trading in 2018 and 2019. OFAC found the violations were not voluntarily disclosed but not egregious.

Neither case names the current operator, which has no enforcement record we could find. The SEC's 2023 case against Sun over TRX trading ended in a settlement: on 9 March 2026 the court entered a final judgment under which Rainberry, a company he controls, pays $10 million and the claims against Sun were dismissed.

How to limit your risk on Poloniex

1. Keep only what you are trading on the platform and withdraw to your own wallet afterwards.
2. Use an authenticator app or security key, and turn on withdrawal address allowlisting.
3. Check the Polo entity named in your account and the restricted list before you deposit; accounts from barred countries can be frozen.
4. Read the monthly reserve report: a ratio falling below 100% for a coin you hold is a reason to move it.
5. If you want a licensed alternative, compare Kraken or an exchange regulated in your country.

How we scored it

Licensing (10) is the weakest factor: no licence in a strict market and no named operating company. Security history (48) reflects two hacks, the second large and only promised, not shown, to be repaid. Reserves (40) get credit for monthly reports that count liabilities but no outside check, and the legal record (45) weighs heavy US penalties against the fact that they hit the previous owner.