Deposits, Withdrawals and Exchange Failure

Leaving an asset on an exchange means relying on a provider as well as the network. A confirmed deposit, an internal balance and an available withdrawal describe different stages. This lesson connects the transfer checklist to custody review and shows how to read reassuring phrases such as proof of reserves, audited and insured without stretching their meaning.

Education only. Crypto assets can lose substantial value or become worthless. No lesson requires buying an asset, depositing money or sharing real passwords, private keys or recovery words.

For a deposit, verify the exact asset, network, contract where relevant, address, memo, minimum and crediting policy. For a withdrawal, verify the destination and the provider's supported route, charges and limits. An exchange can support an asset for trading while offering only certain deposit or withdrawal networks. Read current instructions for the direction you intend to use.

Track the network transaction and account posting separately. A deposit can be confirmed but awaiting provider credit. An internal transfer between customers may update the provider's records without a corresponding public transaction for that exact event. A withdrawal request may be pending review before a transaction ID exists. These stages help distinguish a network delay from a service delay, and reduce the risk of sending duplicate deposits because the account screen has not updated.

The transfer checking lesson in Level 2 showed that the same token can exist on several networks, and that sender and receiver must use the same one. Stablecoins are the classic case: one dollar stablecoin may be offered on several networks, each with a different withdrawal fee. The cheapest is useless if the receiver does not support it. Check the receiver's deposit page, pick a network it lists, include any memo, and send a small test first.

With the coins, the rules and the routes in place, practise putting them together.

Ask what you are owed when coins sit on a platform

Leave your coat at a theatre cloakroom in Buenos Aires and you get a numbered ticket. Usually the ticket brings your coat back. But if the cloakroom attendant has lent coats out, or the theatre has gone bust, the ticket is only a claim, and you may be one of many people holding one.

The exchange and order lessons in Level 3 showed that an exchange balance works like that ticket. The coins sit in wallets the company controls, and you hold a promise. The risk that the other side of a promise fails to keep it is called counterparty risk. The SEC's December 2025 investor bulletin on custody puts it plainly: if a third-party custodian is hacked, shuts down or goes bankrupt, you may lose access to your crypto.

The cloakroom analogy stops working in one way. A theatre's cloakroom is rarely in the news. Crypto platforms have failed often enough, and with big enough losses, that their stories form a short history of what can go wrong. Before reading them, it helps to sort failures into types.

Tell hacks insolvency and fraud apart

A shop in Marseille can close for three different reasons: burglars empty it, it runs out of money, or the owner has been stealing from it. Customers suffer in each case, but the causes and the warning signs differ.

Crypto platforms fail in the same three ways, and often in a mixture. A hack is theft by outsiders, usually from hot wallets or through stolen keys. An insolvency means the company owes more than it holds, perhaps after bad loans or trading losses. Fraud means insiders lie about what they hold or misuse customers' assets.

The four cases below show each type, and how they overlap. The first is the oldest.

The provider may apply withdrawal limits, hold periods, compliance checks or temporary suspensions. Some restrictions are legitimate operational controls; others may indicate deeper problems. Do not infer the cause from one symptom alone. An account screen may become unavailable precisely when it is needed. Records help reconcile activity and support claims, though they cannot guarantee repayment.

A provider can fail because of losses, fraud, operational disruption or legal proceedings. Customer assets may be segregated, pooled, lent, pledged or managed by subcontractors depending on the arrangement. Insolvency rights depend on applicable law and terms, not merely on the word custody. A customer may become a claimant in a process rather than receive immediate on-chain withdrawal.

Trace outsourced custody and other parties where disclosed. Multiple service names can rely on one underlying custodian, creating concentration that is not obvious from the logos. Ask how the provider handles client assets, what claims customers have and which disclosures are independently verifiable. The course does not certify any exchange; it teaches questions that prevent a convenient interface from being mistaken for an unconditional ownership guarantee.

Interpret evidence within its boundary

Mt Gox 2014 a hack and a decade long wait

Mt. Gox was a Tokyo-based Bitcoin exchange. In February 2014 it suspended withdrawals and entered insolvency proceedings after a major loss of BTC. The case became a long-running rehabilitation and repayment process, with notices issued through the court-appointed trustee.

The lesson is about access and time. Even where some value is eventually recovered, it may be unavailable for years and paid under rules different from the holder's expectations. Deadlines and repayment status change; use the current official trustee notice for an actual case. Never infer present repayment instructions from an old course paragraph.

QuadrigaCX 2019 fraud behind a founder s death

QuadrigaCX was a Canadian trading platform that ceased operations in 2019. The public story initially focused on its founder's death and inaccessible keys. The Ontario Securities Commission staff's 2020 review found that much of the shortfall instead arose from fraudulent trading and misuse of customer assets.

The staff described accounts credited with fictitious balances, losses covered with other customers' deposits, and weak oversight. Its report is a staff assessment of reviewed evidence, rather than a finding tested by an OSC tribunal. That distinction belongs beside the case, not hidden in a footnote.

A customer could not see those underlying activities simply by reading a displayed account balance. Ask about custody, liabilities, internal controls and conflicts of interest. A convenient dashboard can accurately display the provider's own record while that provider lacks the assets needed to honour it.

FTX November 2022 customer money sent next door

FTX failed in November 2022. Its founder Sam Bankman-Fried was convicted of fraud in 2023 and sentenced in March 2024. The US Department of Justice described the misuse of customer funds, including transfers supporting Alameda Research and other purposes.

The practical lesson is to investigate customer rights and related-party access before relying on a custodian. Bankruptcy distributions follow their own case rules and valuation methods. A promise of repayment in national currency is not necessarily return of the same number of coins.

Celsius 2022 safety and high yield both promised

Celsius was a crypto lending platform that marketed rewards on customer deposits. It paused withdrawals in June 2022 and filed for bankruptcy the following month. Official consumer-protection proceedings described misleading assurances about asset safety and access.

A lending platform is different from an ordinary spot exchange even when both show a wallet-shaped balance. To fund rewards, a business may lend, invest or otherwise expose deposited assets. Those activities can create credit, liquidity and custody risks.

See the common thread commingling

Commingling means combining assets rather than maintaining the separation promised or required by the arrangement. Pooling customer holdings, mixing them with company assets, and lending or pledging them are related issues that should be investigated separately.

A shared blockchain wallet does not by itself prove misuse: a custodian can use omnibus addresses while keeping an accurate customer ledger. Conversely, a separate-looking address does not by itself establish insolvency protection. Legal title, accounting, contractual permissions and actual controls matter.

Ask whether assets can be reused, who must consent, how customer entitlements are recorded, and which law governs a failure. Segregation can support protection under applicable rules, but a diagram showing a wall between assets cannot settle every creditor's rights.

Know what bankruptcy can mean for customers

In a failure, a court, administrator or trustee may collect assets, verify claims and distribute value according to applicable law. Claim priority, valuation date, currency and available recovery differ by case.

This is arithmetic under a supplied case rule, not a universal bankruptcy formula. Keep account records and obtain deadlines through the genuine court or trustee route. Be wary of unsolicited claim buyers, invented recovery charges and messages asking for signing secrets.

A proof-of-reserves exercise can provide evidence about specified assets, liabilities or customer inclusion at a point in time under a stated method. Read the date, asset coverage, liability coverage, verifier and exclusions. Evidence that selected addresses hold assets does not by itself establish every corporate liability, control over encumbered assets or future withdrawal liquidity.

Some systems let a customer check inclusion of a balance in a liability set. That is useful within its stated scope, but does not show all off-platform obligations or rule out later changes. A report's name should not be expanded into a complete solvency conclusion. Compare what the methodology actually tests with the claim being made in marketing.

Imagine a savings club in Bengaluru that lets each member check that their name and balance appear on the treasurer's list, and lets an outside accountant count the cash in the box on one particular day. That is reassuring, but it does not show whether the treasurer borrowed money to fill the box for that day, or owes money elsewhere.

Proof of reserves works in a similar way. Kraken describes its version as a procedure carried out by an independent accountant. Customer balances are anonymised and combined into a Merkle tree, a structure that produces one cryptographic fingerprint (using the hashing you met in Level 1) for all the balances at a snapshot time. Each customer can check that their balance was included, and the accountant checks the total against the assets the exchange holds.

The limits matter. The SEC's July 2023 investor bulletin warned that these reports are not full financial statements, may leave out liabilities, show only a moment in time, and may be produced by firms outside audit regulators' oversight and independence standards. Kraken itself lists limits: the process cannot prove exclusive control of keys, identify hidden claims on the assets, or show that assets were not borrowed temporarily for the review. Coverage may also be limited to a few listed assets.

Proof of reserves looks at the company. The next check looks at your own account.

An audit examines specified financial statements under a defined engagement. An attestation reports on a specified subject and criteria. Registration indicates a particular status with a particular authority. Insurance covers named risks, beneficiaries, limits and exclusions. These terms can matter, but they do not mean the same thing and none should be assumed to cover every customer loss.

Check the underlying document, date and jurisdiction. A proposal or consultation is not enacted law, and a registration focused on one activity is not approval of every token. Ask whether insurance covers customer account compromise, provider losses or only a narrow theft event, and who receives any payment. Keep exportable records and a plan for provider unavailability. Good custody review combines documented rights, operational access and financial evidence rather than relying on a single badge.

Watch for the warning signs

The FCA reminds people to be prepared to lose all their money in crypto, and the four cases show how that can happen. They also left clues. None proves a failure is coming, but each is a reason to look harder.

Watch for withdrawal pauses, limits or delays, especially when the explanation keeps changing or the "temporary" pause keeps being extended. Watch for unexplained high yields: if you cannot see where the return comes from, the risk may be yours. Watch for opacity: no audited accounts, vague custody terms, or proof of reserves presented as if it were an audit, which the SEC warned against in 2023. Watch for conflicts, such as a sister trading firm or a platform betting with customers' money. And watch for regulatory warnings about the firm, and for staff or leaders leaving suddenly.

That leads to the practical question: how much should sit with any one provider?

Reduce your exposure to any one provider

Families in Mumbai sometimes keep savings in more than one bank, some cash at home and some gold, so that one problem cannot take everything. The same idea applies here.

First, keep on any exchange only what you need for trading or near-term spending. Second, spread larger holdings so no single provider holds most of them. Third, consider moving long-term holdings to self-custody when appropriate, but only once you can manage keys and backups confidently, as Level 2 taught; self-custody removes exchange risk and adds your own responsibility. Fourth, make a small test withdrawal now and then, so you know the route works. Fifth, avoid leveraged products on any platform: as the exchange and order lessons in Level 3 explained, a derivatives position adds liquidation risk on top of the platform's own risk.

Keep records as you go: account statements, deposit and withdrawal confirmations, and your provider checklist from the provider checking lessons in Level 3. They also help if the worst happens.

Fire drills in offices in Seoul feel pointless until the alarm rings. Deciding in advance what you would do saves panic.

Write a short plan. If a platform freezes withdrawals, you would download or screenshot your balances and transaction history while you still can, read only the platform's official announcements, and watch your regulator's website. You would not send more money to "unlock" funds, and you would ignore anyone who contacts you offering recovery for a fee. If a bankruptcy follows, you would file a claim only through the official court or trustee site and keep every confirmation. Now practise the ideas in this lesson.

Everyday example

What to remember

Lesson completion check

References and further reading