FTX Collapse: Security and Custody Lessons for Users

The FTX collapse in November 2022 was primarily a custody failure: customer deposits held on the exchange were commingled with and lent to an affiliated trading firm, Alameda Research, leaving FTX unable to honor withdrawals once depositors tried to pull funds simultaneously.

FTX was, at the time, one of the largest centralized cryptocurrency exchanges in the world. Its failure is often discussed alongside trading and leverage issues, but the part most relevant to everyday users is simpler and more universal: money you deposit on a custodial platform is only as safe as that platform's internal controls over where your funds actually sit.

What went wrong with custody

On a well-run custodial exchange, customer deposits are supposed to be segregated from the company's own operating capital and from any affiliated trading entity. Segregation means that if the exchange's business or a related firm loses money, customer deposits remain untouched and can still be withdrawn on demand.

Reporting and subsequent legal proceedings established that FTX had allowed customer funds to be transferred to Alameda Research, a sister trading firm, which used them for trading, investments, and loans. This meant customer balances shown on FTX's platform did not correspond to actual, segregated reserves sitting untouched. When a wave of withdrawal requests hit the exchange after concerns became public, FTX did not have the liquid assets to cover them, and the exchange halted withdrawals and later filed for bankruptcy.

This is fundamentally different from a hack. No external attacker broke in and stole a private key. The funds were moved by insiders through internal decisions about how customer deposits could be used — which is precisely why this type of failure is so hard for an outside user to detect in advance.

Why "not your keys, not your coins" applies here

The phrase describes a basic reality of custodial platforms: when you deposit crypto to an exchange, you receive an IOU-like claim recorded in that platform's internal database, not direct on-chain control of the asset. As long as the exchange is solvent and honest, that claim is redeemable at any time. If it isn't, your claim is only as good as the bankruptcy process that follows.

Holding assets in a self-custody wallet where you control the seed phrase removes this counterparty risk entirely, at the cost of taking on personal responsibility for key management. Our guide to DeFi wallet security covers the basics of self-custody, and what is DeFi explains how non-custodial protocols differ structurally from custodial exchanges.

Signs of custody risk to watch for

• Frequent promotion of in-house yield products offering unusually high, guaranteed-sounding returns on deposited assets
• Lack of independently audited, verifiable proof-of-reserves
• Opacity about the corporate structure, especially ties to affiliated trading arms
• Regulatory uncertainty about which jurisdiction actually governs customer asset protections
• Resistance to large withdrawals or unusual delays processing them

None of these signs alone prove a platform is unsafe, but together they describe exactly the conditions that preceded FTX's failure.

Custodial vs. self-custody: where the risk sits

Factor	Custodial exchange	Self-custody wallet
Who controls the private key	The platform	You
Risk if platform is insolvent	You may lose funds or wait years in bankruptcy	Not applicable
Risk if you lose access	Platform can often help recover account	Permanent loss if seed phrase is lost
Convenience for trading	High	Lower, requires manual transfers
Exposure to commingling/misuse	Possible, as FTX showed	None

Practical takeaways for users

Keep only the funds you need for active trading on any centralized exchange, and move the rest to self-custody or into on-chain DeFi positions you can verify directly, such as by checking TVL and protocol data on our defi dashboard. Spread exposure across more than one exchange rather than concentrating everything in one. Treat marketing claims of proof-of-reserves skeptically unless backed by a real, independent audit methodology, not just a self-reported balance snapshot. If you're using an exchange for DEX access or as an on-ramp only, consider withdrawing to your own wallet promptly after each transaction rather than leaving balances parked. See DEX vs CEX for a deeper comparison of the tradeoffs.

Bottom line

FTX's failure wasn't caused by a technical exploit — it was caused by customer funds being used in ways depositors never agreed to, with no meaningful segregation to stop it. The lesson isn't that all exchanges are unsafe, but that any custodial platform carries counterparty risk that no amount of marketing can eliminate. Minimizing the balance you keep on any single custodial platform, and using self-custody or transparent on-chain alternatives for the bulk of your holdings, remains the most reliable protection against a repeat of this kind of collapse.