How to read these grades: each is derived from published, checkable disclosures — proof-of-reserves attestations, public regulatory registers, disclosed insurance funds and the documented incident record — using the weighted rubric below. Where an exchange does not disclose something, we mark it unverified rather than assume it. These are not audits and not investment advice; they reflect what was published as of our last review.
Crypto.com
Crypto.com discloses more than $870m of insurance cover, had its SEC investigation closed with no action in March 2025 and holds a Malta MiCA authorisation; its proof-of-reserves position is contested between our sources, and it reimbursed all users after a January 2022 incident that drained about $34–35m from 483 accounts.
BySafety DeskSenior Exchange Safety Editor
Our Crypto.com review
Crypto.com discloses more insurance cover than any other venue in this corpus and cannot tell us, clearly, whether it publishes proof of reserves. A B- is the arithmetic of a strong insurance factor against four unresolved ones.
What checks out
Insurance is the standout. More than $870m of cover is disclosed: $750m on cold-storage assets through custodial partner Ledger Vault, expanded in September 2021, plus $120m of institutional custody insurance arranged through Aon and announced on 25 June 2025. U.S. fiat balances sit at FDIC-insured Community Federal Savings Bank. On the regulatory side, the Malta MFSA granted a MiCA CASP authorisation on 27 January 2025 covering 6 of the 10 service categories, followed by an EU Limited Financial Institution licence from 27 February 2026 for stablecoin services, and the SEC closed its investigation with no enforcement action on 27 March 2025.
Where the evidence stops
Our two sources contradict each other on proof of reserves — one records a published portal, the other found no exchange-wide programme, and no methodology, auditor or reserve figure was confirmed either way. That is the heaviest factor on the rubric and we cannot resolve it, so we do not score it as passed. Cold-storage assets sit with Ledger Vault, but the cold/hot split itself is undisclosed. The licences listed across Singapore, Canada, the UK, Australia, Hong Kong, Brazil and the U.S. come without registration numbers we could check against public registers. In January 2022 roughly $34–35m was taken from 483 accounts through a 2FA compromise; Crypto.com disclosed the breach publicly and fully reimbursed everyone affected.
How to read the grade
This is a venue that has shown it will pay a loss and has not shown what it holds. The insurance is real and specific; the reserves are the part you would want to check first, and it is the part you cannot.
Grade breakdown
Every KripZen grade comes from the same five weighted checks. Here is how Crypto.com scores on each.
- Proof of reservesWeight 30%
Our two sources conflict: one records a published proof-of-reserves portal, the other found no exchange-wide programme. No methodology, auditor or reserve figure was confirmed either way.
What this means → partial or unverified - CustodyWeight 25%
Cold-storage assets sit with custodial partner Ledger Vault, but the cold/hot storage split is not disclosed and we could not confirm it from a primary source.
What this means → partial or unverified - RegulationWeight 20%
Malta MFSA MiCA CASP authorisation granted 27 January 2025 covering 6 of the 10 service categories, plus an EU Limited Financial Institution licence from 27 February 2026 for stablecoin services, and licences listed across Singapore, Canada, the UK, Australia, Hong Kong, Brazil and the U.S. without registration numbers we could check against public registers. The SEC closed its investigation with no enforcement action on 27 March 2025.
What this means → partial or unverified - InsuranceWeight 15%
More than $870m of disclosed cover: $750m on cold-storage assets through custodial partner Ledger Vault, expanded September 2021, plus $120m of institutional custody insurance arranged through Aon and announced 25 June 2025. U.S. fiat balances are held at FDIC-insured Community Federal Savings Bank.
meets this factor - Incident historyWeight 10%
About $34–35m taken from 483 accounts in January 2022 through a 2FA compromise; Crypto.com disclosed the breach publicly and fully reimbursed all affected users.
partial or unverified