Crypto.com is a legitimate, licensed exchange, but whether it is safe enough for you depends on what you need protected. As of 14 October 2026 the evidence is: licences or registrations in the EU (MiCA, via Malta), the UK, Dubai, Singapore, the US and other markets; a proof of reserves whose only published snapshot is from 7 December 2022; no confirmed permanent loss of client funds in the incidents found, though 483 accounts were drained in January 2022 before Crypto.com reimbursed them; and a €2.85 million Dutch fine for operating unregistered.
The $750 million insurance figure that many reviews repeat dates from a 2021 announcement covering cold storage only. Crypto.com’s own security page says FDIC cover on US dollar balances does not protect you if Crypto.com itself fails.
“Is Crypto.com safe?” is usually asked by someone about to sign up, or by someone who has seen a scary headline about hacks or a 2-star Trustpilot score. Most answers give you a confident “yes”, a 100% cold storage claim and a $750 million insurance figure. Some of that is out of date, and some of it was never what it sounds like. This guide sets out the evidence instead: who owns Crypto.com, its licences by region, proof of reserves, custody claims, what insurance really covers, dated incidents and enforcement, and the risk that stays with you.
Is Crypto.com safe and legit? The short answer
Crypto.com is legit: it is a real, regulated company, not a scam. Whether it is safe is a different question, and no exchange can be called safe outright. What you can check is the evidence. As of 14 October 2026, Crypto.com companies hold permissions in more than 15 jurisdictions, including a MiCA licence in the EU and a VARA licence in Dubai. In the incidents found for this article, customers who lost funds were reimbursed. On the other side, its only published proof of reserves is almost four years old, it has been fined in the Netherlands, and your crypto balance has no government compensation scheme behind it.
This guide uses the same six checks this site applies to every exchange safety review, matching the methodology criteria of track record, transparency, security practices and jurisdiction coverage:
- Licences by region, from regulator registers where they could be checked
- Proof of reserves: method, who checked it, and the snapshot date
- Custody and cold storage, labelled as company claims
- Insurance, and what it actually covers
- Incident and enforcement history, dated and sourced
- The risk that remains for you
Who owns Crypto.com?
Crypto.com is privately held. It was founded in 2016 in Hong Kong as “Monaco” by Kris Marszalek, Rafael Melo, Gary Or and Bobby Bao, and renamed Crypto.com in 2018. Marszalek is co-founder and CEO. The group operates through companies with the “Foris” name: Foris DAX Asia Pte. Ltd. in Singapore, where the head office is, and Foris DAX MT Limited in Malta, which holds the EU licence. Because it is private, Crypto.com does not file public audited accounts the way a listed exchange does.
Two business ties are worth knowing about. In August 2025 Crypto.com and Trump Media agreed a deal under which Trump Media bought about $105 million of Crypto.com’s CRO token and Crypto.com committed $50 million to Trump Media stock. CRO is Crypto.com’s own token, so a token the company promotes is part of its business. Neither fact tells you whether your balance is safe, but both are part of the company’s risk picture.
Is Crypto.com regulated? Licences by region
Yes, but through different Crypto.com companies in each country. Its licences page says “Crypto.com companies are licensed in the following jurisdictions” without naming the entity behind each permission, so the table below matches them to registers where that was possible.
| Region | Entity | Regulator and permission | Source |
|---|---|---|---|
| European Union / EEA | Foris DAX MT Limited | MiCA crypto-asset service provider (CASP) authorisation from the Malta Financial Services Authority (MFSA), announced 27 January 2025 and passported across the EEA from 12 February 2025. Covers custody, exchange, order execution and transfer services. The company also lists an EU e-money licence and a MiFID investment firm licence. | Crypto.com, 21 March 2025; French AMF CASP white list |
| United Kingdom | Foris DAX UK Limited | FCA cryptoasset business registration under the Money Laundering Regulations (FRN 941745), registered August 2022. Crypto.com also lists a UK e-money institution licence. | FCA register; Cointelegraph, 17 August 2022 |
| UAE (Dubai) | Foris DAX Middle East FZE | VARA VASP licence VL/23/10/003, status active, issued 3 April 2024, for broker-dealer, management and investment, lending and borrowing, and exchange services (including virtual asset derivatives) | VARA public register |
| UAE (Abu Dhabi) | Not named | ADGM Category 3A licence, as listed by Crypto.com | Crypto.com licences page |
| Singapore | Foris DAX Asia Pte. Ltd. | MAS Major Payment Institution licence for digital payment token services | MAS Financial Institutions Directory |
| United States | Several US entities | Crypto.com lists FinCEN money services business registration, state money transmitter licences, a broker-dealer registration, a non-depository trust company charter, and CFTC designated contract market and clearing licences. The OCC gave conditional approval for Foris Dax National Trust Bank on 23 February 2026; conditional approval is not yet a final charter. | Crypto.com licences page; Payment Expert, 24 February 2026 |
| Australia | Not named on the licences page | Listed by Crypto.com as an AUSTRAC digital currency exchange registration and a financial services licence | Crypto.com licences page |
| Other | Various | Canada (FINTRAC and restricted dealer), Brazil, Cayman Islands, Hong Kong (listed with “deemed licence status”), South Korea, Bahrain, Mauritius, as listed by Crypto.com | Crypto.com licences page |
All entries checked 14 October 2026. Dubai, Singapore and UK entries confirmed on the VARA, MAS and FCA registers. Other entries are as listed on Crypto.com’s licences page; confirm them on the AUSTRAC, MFSA and state registers before relying on them.
One date detail shows why registers beat press releases. Crypto.com announced its “full” Dubai VASP licence on 14 November 2023, but the VARA register gives the licence issue date as 3 April 2024.
Can you use Crypto.com in the United States?
Yes, in most of the country. Crypto.com lists money transmitter licences and a FinCEN registration for the US, and its derivatives arm is CFTC-registered. Its licences page does not list which states it covers. Several ranking pages say New York is excluded; that could not be confirmed on the New York Department of Financial Services site for this article, so check the app’s state list before signing up from New York.
What registration does not mean
Several of these permissions, including the UK one, are anti-money-laundering registrations. They let a regulator supervise and sanction the company. They do not guarantee your balance or give you access to a compensation scheme.
Does Crypto.com have proof of reserves?
It has one, but it is old. Crypto.com’s proof of reserves page, checked 14 October 2026, still shows a single verification:
| Item | What Crypto.com publishes |
|---|---|
| Method | The auditor compared assets in on-chain addresses Crypto.com was shown to control with customer balances, and built an anonymised Merkle tree so you can check your own balance was included. The work followed the ISRS 4400 agreed-upon procedures standard. |
| Who checked it | Mazars Group |
| Snapshot date | 7 December 2022, 00:00:00 UTC |
| Scope | Selected tokens only. The page says “not all tokens or chains are supported” by the tools used. Cronos (CRO) and VeChain (VET) were left for “future verifications”. |
| Newer snapshots | None shown on the page |
Within days of that report, Mazars paused its proof of reserves work for crypto firms, naming concerns about how the public understood such reports (CNBC, 16 December 2022). Crypto.com said its report had been completed. No later independent proof of reserves was found for this article. Several ranking pages say Crypto.com “publishes proof of reserves” without telling you the date. A 2022 snapshot tells you nothing about today, and like every proof of reserves it does not show the company’s other liabilities.
Custody and cold storage: what Crypto.com claims
Everything in this section comes from Crypto.com, not from an independent check.
- Cold and hot wallets: Crypto.com’s security page says it has “strict controls on access rights to funds in both cold and hot wallets” and holds assets “on a 1:1 basis”. It gives no cold storage percentage. The “100% cold storage” and “over 90%” figures on some review sites do not appear on the current page.
- Certifications: ISO/IEC 27001:2022, ISO/IEC 27701:2019, ISO 22301:2019, SOC 2 Type II and PCI DSS v4.0 Level 1 Service Provider, as listed by Crypto.com without dates.
- Withdrawals: whitelisting of external addresses through email verification is mandatory.
- Bug bounty: a public programme on HackerOne.
In the EU, custody of client crypto is one of the six services Foris DAX MT is authorised for under MiCA, which brings custody and asset segregation rules. Crypto.com’s terms pages could not be loaded for this article (the site blocked automated access), so what they say about ownership of your coins in an insolvency is not covered here. Read the “title” and “insolvency” clauses of the terms for your region before holding large balances.
Is Crypto.com insured? The $750 million claim
Not in the way most reviews suggest. There are two separate things.
- The $750 million policy: announced on 20 September 2021, effective 6 September 2021, underwritten by Arch Underwriting at Lloyd’s. It covered “Crypto.com’s cold storage assets held on Ledger Vault”. That is insurance for Crypto.com against losses from its cold storage, not a policy on your account. The current security page does not mention it, and no update on whether it is still in force was found.
- FDIC cover on US dollars: Crypto.com’s security page says USD balances are “insured up to $250,000 in the aggregate, but only in the event the respective FDIC member fails”. It adds: “FDIC insurance does not protect your funds in the event of Crypto.com’s failure or from the risk of theft or fraud.”
So Crypto.com is not FDIC insured, and your crypto is not insured by any government scheme. If an exchange tells you about insurance, ask who the insurer is, which wallets it covers, and whether you or only the exchange can claim.
Has Crypto.com been hacked?
Yes, once in a way that took customer funds, and those customers were reimbursed. There have also been a large operational error and a data exposure.
| Date | What happened | Client funds | Source |
|---|---|---|---|
| May to December 2021 | A staff member typed an account number into the amount field, sending A$10.5 million to an Australian customer instead of a A$100 refund. It went unnoticed for about seven months. Crypto.com’s Australian companies sued in the Supreme Court of Victoria, which in 2022 ordered a house bought with the money to be sold and the proceeds returned. | An operating error, not a hack. Shows weak payment controls at the time. | The Register, 31 August 2022 |
| 17 January 2022 | Attackers made unauthorised withdrawals from 483 accounts without passing two-factor authentication: 4,836.26 ETH, 443.93 BTC and about $66,200 in other assets, reported at around $34 million. Withdrawals were paused; all 2FA tokens were reset. | Crypto.com said “no customers experienced a loss of funds” and that affected users were fully reimbursed | Crypto.com security report via Security Affairs, 20 January 2022 |
| Before March 2023 (reported 19 September 2025) | Members of the Scattered Spider hacking group phished a Crypto.com employee’s account. Crypto.com says “limited PII” of “a very small number of individuals” was exposed and that it reported the incident to regulators. | No customer funds accessed, per Crypto.com | Bloomberg via The Block, 21 September 2025; Cointelegraph, 22 September 2025 |
Checked 14 October 2026. No incident in which customers permanently lost funds held on Crypto.com was found in the sources reviewed.
After the 2022 breach, Crypto.com added a mandatory 24-hour delay on withdrawals to newly whitelisted addresses and launched a Worldwide Account Protection Program covering up to $250,000 for qualifying users. None of the top-ranking pages reviewed for this article mention the 2023 data exposure. Leaked data does not move your coins, but it makes fake “Crypto.com support” calls more convincing.
Is Crypto.com safe from hackers?
No platform is. What you can see is how Crypto.com responded: reimbursement in 2022, then extra withdrawal delays and certifications. Exchange-level controls also cannot fully stop account takeovers and support-impersonation scams, which puts part of the risk on your own security settings.
Crypto.com’s enforcement history
| Date | Regulator | What it was about | Outcome |
|---|---|---|---|
| Made public 13 March 2024 | De Nederlandsche Bank (Netherlands) | Offering crypto services in the Netherlands without the required registration from May 2020 to November 2022 | €2.85 million fine, raised above the €2 million base amount because of the seriousness. Crypto.com has since registered. |
| 2024 to 27 March 2025 | SEC (US) | Crypto.com received a Wells notice and sued the SEC in October 2024, then dropped the suit | Crypto.com said on 27 March 2025 that the SEC had closed its investigation with no enforcement action |
| 2025 to date | Nevada Gaming Control Board (US) | Cease-and-desist over sports event contracts offered by Crypto.com’s CFTC-registered derivatives arm | A federal judge ruled sports event contracts could fall under Nevada gaming law; Crypto.com appealed to the Ninth Circuit, with no appellate ruling reported as of 18 February 2026 |
Checked 14 October 2026 against NL Times, The Block and FinanceFeeds reports. No action finding that client funds were missing was found.
A note on the prediction market product
Crypto.com | Derivatives North America (CDNA), a CFTC-registered exchange and clearing house, offers prediction market and event contracts, including on sports, in the US. The Nevada case above is about whether those contracts are federally regulated derivatives or state-regulated gambling. This guide does not cover how to use the product. It matters for safety only because the legal status of that business line is still contested in court, as of the dates above.
Can you lose money on Crypto.com?
Yes, in several ways none of the above removes:
- Company failure: FDIC cover does not apply if Crypto.com itself fails, and your crypto has no government scheme behind it.
- Account takeover and scams: the 2022 breach and the 2023 data exposure both show why your own 2FA and caution matter.
- Your own transfer errors: crypto sent to the wrong address or network is usually gone.
- Trading and leverage losses: derivatives and margin products can lose more than you expect.
What users complain about most is service rather than security. On 14 October 2026 Google showed Crypto.com’s Trustpilot TrustScore as 2 out of 5 from about 9,000 reviews, and Reddit threads ranking for this question focus on app spreads and account restrictions. Treat that as a signal to read the fee schedule and support terms, not as evidence on solvency.
Is Crypto.com safer than Coinbase or Binance?
Don’t trust a one-word ranking. Compare the same six points for each platform: which entity serves your country, how recent the proof of reserves is, the custody terms, what insurance really covers, incident history and enforcement history. The same evidence check is published for Coinbase, Binance and Kraken, and US readers can compare licensed platforms in the best US exchanges guide.
How to reduce the risk you control
- Use an authenticator app or security key for 2FA, not SMS, and set up withdrawal address whitelisting.
- Keep the 24-hour delay on new withdrawal addresses in mind: it is a protection, so don’t try to rush around it if someone pressures you.
- Treat unexpected “Crypto.com support” calls and emails as suspect, especially ones that know your details.
- Keep only what you actively trade on the exchange. Move long-term holdings to a wallet you control, and learn how to store your seed phrase first.
What this means for you
As of 14 October 2026, Crypto.com is a legitimate, widely licensed exchange with a MiCA licence, a Dubai VASP licence and a Singapore payment institution licence, and every customer loss found in its incident record was reimbursed. Against that sit a proof of reserves last published for 7 December 2022, an insurance figure that covered cold storage rather than your account, a 2023 data exposure that only came out in 2025, and a Dutch fine for operating without registration. The remaining risk is counterparty risk: you are trusting Crypto.com’s solvency and controls with whatever you leave on it, with no compensation scheme behind your crypto. Size what you hold there to match that trust.
For the same evidence check on other platforms, see the Exchanges section.
