How to read these grades: each is derived from published, checkable disclosures — proof-of-reserves attestations, public regulatory registers, disclosed insurance funds and the documented incident record — using the weighted rubric below. Where an exchange does not disclose something, we mark it unverified rather than assume it. These are not audits and not investment advice; they reflect what was published as of our last review.
Bitfinex
Bitfinex is BVI-registered with no public licence register found and publishes no proof of reserves; it lost about 119,756 BTC in the August 2016 hack, and roughly $850m in commingled customer and corporate funds was seized or lost at its payment processor in 2018–19.
BySafety DeskSenior Exchange Safety Editor
Our Bitfinex review
Bitfinex is the lowest grade we publish, a D, and it is the only exchange here that fails both proof of reserves and regulation outright. Those two factors are the ones that answer whether your money is where it is supposed to be, and who you can complain to if it is not.
What checks out
Very little that a reader can verify. Both of our sources record no proof-of-reserves programme, and neither identified an independent reserve attestation of any kind. Beyond a British Virgin Islands incorporation, we found no public licence register entry at all, and Bitfinex blocks U.S. and California residents outright. No named insurance fund was identified; as with the other undisclosed items in this corpus, that is a gap in what we can see rather than confirmation the cover is zero.
Where the evidence stops
The incident record is the heaviest in this corpus. About 119,756 BTC — roughly $72m at the time — was stolen in August 2016; U.S. authorities recovered $3.6bn from the perpetrators in 2022, long after the loss was socialised. Separately, roughly $850m in commingled customer and corporate funds was seized or lost at payment processor Crypto Capital in 2018–19 and made good from the balance sheet of affiliate Tether. The regulatory file carries CFTC settlements of $75,000 in 2016 and $1.5m in October 2021, and an $18.5m settlement with the New York Attorney General in February 2021, alongside Tether.
How to read the grade
A D is not a prediction that Bitfinex will fail. It is a statement that if it did, almost nothing published in advance would have told you, and there is no licensed entity standing behind the balance. Everything you would use to check this venue is missing, and that is the finding.
Grade breakdown
Every KripZen grade comes from the same five weighted checks. Here is how Bitfinex scores on each.
- Proof of reservesWeight 30%
No proof-of-reserves programme was found; both of our sources record none, and neither identified an independent reserve attestation of any kind.
What this means → does not meet this factor - CustodyWeight 25%
Cold/hot storage split is not disclosed; we could not confirm it from a primary source.
What this means → partial or unverified - RegulationWeight 20%
No public licence register was found beyond its British Virgin Islands incorporation, and it blocks U.S. and California residents outright. Settled with the CFTC for $75,000 in 2016 and $1.5m in October 2021, and with the New York Attorney General for $18.5m in February 2021 alongside affiliate Tether.
What this means → does not meet this factor - InsuranceWeight 15%
No named insurance fund was identified in our research. That is a disclosure gap rather than confirmation the cover is zero.
partial or unverified - Incident historyWeight 10%
About 119,756 BTC (roughly $72m at the time) stolen in August 2016, with U.S. authorities recovering $3.6bn from the perpetrators in 2022; separately, roughly $850m in commingled customer and corporate funds was seized or lost at payment processor Crypto Capital in 2018–19 and made good from affiliate Tether's balance sheet.
does not meet this factor