Most people who buy crypto for the first time leave it where they bought it: on the exchange. It is convenient, the balance is right there in the app, and moving it elsewhere feels like an extra step with its own risks. Sooner or later, though, a question comes up: what happens to my coins if this company goes bust?
There is no single answer, because it depends on how the provider holds client assets, whether it is authorised in the EU, how well it followed the rules, and which national insolvency law applies. What we can do is explain the moving parts so you understand what you are relying on when you keep crypto on a platform.
This article is educational only. It is not legal, tax or investment advice, it does not assess any specific provider, and it does not predict or promise any outcome in a failure.
The short answer: rules reduce risk, they do not guarantee your money back
The EU’s Markets in Crypto-Assets Regulation (MiCA) sets requirements for authorised crypto-asset service providers (CASPs), including how they must look after client crypto. That is a real improvement compared with an unregulated market. But it is important to be precise about what it means.
- Authorised does not mean risk-free. A licence means a provider must meet certain standards and is supervised. It does not mean it cannot fail, be hacked, or make mistakes.
- There is no deposit guarantee for crypto. Bank deposit guarantee schemes cover money in bank accounts, not crypto-assets held at a platform. Investor compensation schemes generally do not cover crypto either. We cover this in more detail in what MiCA means for crypto users in the EU.
- Rules shape the process, not the result. Requirements on how client assets are held can make a big difference to how a failure unfolds. They cannot promise that every client gets everything back, or when.
How an exchange actually holds your crypto
When you see “0.5 BTC” in your exchange app, you usually do not hold the private keys to those coins yourself. The provider does. What you have is an account and a claim against the provider: a record in its systems that it owes you that amount of crypto.
Behind that record, providers organise custody in different ways:
- Omnibus wallets. Many clients’ coins sit together in shared wallets, with the provider’s internal ledger recording who owns what. This is common and not automatically a problem, but it makes accurate record-keeping essential.
- Segregated wallets. Some providers hold client assets in wallets separate from the company’s own funds, sometimes per client, more often as one pool of client assets kept apart from the firm’s own coins.
- Hot and cold storage. Part of the holdings is usually kept online (“hot”) for withdrawals, with the larger part offline (“cold”) for security. This affects hack risk more than insolvency risk.
- Sub-custodians. A provider may outsource custody to another specialised firm. That adds a layer: you then rely on both companies’ practices.
This is the core difference between custodial and self-custody arrangements. If you want the self-custody side of the picture, our guide on hardware wallets explains what it means to hold your own keys.
What MiCA expects authorised providers to do with client crypto
In plain language, MiCA expects an authorised CASP that holds crypto on behalf of clients to treat those assets as the clients’ and not its own. In broad terms, that includes:
- keeping client crypto separate from the provider’s own holdings: on the blockchain itself, in its records, operationally and legally;
- keeping accurate records of each client’s position, so it is clear at any moment who is owed what;
- not using client crypto for its own account (for example, lending it out or trading with it);
- having a custody policy and internal procedures for safekeeping, and giving clients information about how their assets are held.
The exact scope, wording and exceptions are set out in the regulation and related technical standards, and providers implement them in their own terms and policies. We deliberately keep this qualitative here. If the detail matters to you, the provider’s own custody disclosures and terms of use are the first place to look, and the current official text is the reference.
MiCA states the aim plainly: crypto held in custody should be legally separate from the provider’s own estate, so that the provider’s creditors cannot claim it, in particular in an insolvency. But the regulation adds that this works “in accordance with applicable law”. Whether, and how fully, that separation holds in an actual insolvency also depends on national insolvency law, on the facts of the case, and on how well the provider complied in practice. That is exactly why we do not say “your coins are safe outside the bankruptcy” — it is a question an insolvency administrator and, if needed, a court would answer for a specific case.
What may happen if a provider fails
Every failure is different, but some steps are typical in broad terms.
Withdrawals stop. Often the first visible sign is that withdrawals are paused or delayed. Sometimes a provider announces this as temporary; sometimes it precedes formal insolvency. A pause on its own does not tell you how things will end.
An administrator takes over. If formal insolvency proceedings start, a court-appointed insolvency administrator generally takes control of the company’s assets and affairs. Their job is to establish what there is, who is owed what, and how it should be dealt with under the applicable law.
Claims are established. Clients may be asked to confirm balances or submit a claim through an official process. How client crypto is treated — returned as crypto, valued in euros at some point, or handled differently — depends on the legal situation and the administrator’s assessment. We cannot tell you in advance which applies.
Timelines are unpredictable. Insolvency processes can take a long time, especially across borders or when records are incomplete. There is no standard timeline you can rely on, and we deliberately do not suggest one.
Outcomes vary. Some clients in some cases may get most or all of their assets back; in others, recovery may be partial, delayed, or uncertain. Well-kept records and proper separation of client assets tend to help. But this is not something any article — or any regulation — can guarantee.
Unauthorised or non-EU platforms: less to fall back on
All of the above assumes the platform is authorised under MiCA in an EU member state. If it is not — for example, an offshore platform serving EU users without authorisation — the MiCA safeguards for client assets simply do not apply to that relationship. EU supervisors, including ESMA, have warned consumers about this point.
In that case you may be dealing with a foreign company, foreign law and foreign insolvency proceedings, which can make it much harder to understand or exercise your position. Before you rely on any platform, it is worth checking who the legal entity is and whether it is authorised. Our guide on how to check whether a crypto exchange is licensed in the EU walks through that step.
Stablecoins, staking and lending add extra layers
Not everything in your account carries the same type of risk.
- Stablecoins add the issuer’s risk on top of the platform’s: a stablecoin is only as solid as its issuer and reserves. See stablecoins under MiCA for what the rules say about issuers.
- Staked or locked assets may take longer to withdraw, even in normal times, because of lock-up or unbonding periods. In a stressful situation that can matter. Our staking explainer covers how this works.
- Lending or “earn” products can change what you own. Depending on the terms, assets in such a product may be used by the provider or a third party. Such products are often not a MiCA-regulated service, so MiCA’s safeguards for client assets may not apply to them, even at an authorised provider; ESMA has warned about exactly this. Read the terms carefully; we do not cover yield products here.
Ways to reduce your exposure (options, not advice)
You cannot remove all risk, but you can decide how much depends on a single company. Some options people consider:
- Check authorisation before you deposit. Know which legal entity you are dealing with and whether, and where, it is authorised.
- Read the custody disclosures. Look for how the provider holds client assets, whether it uses sub-custodians, and what its terms say about using client crypto.
- Keep on a platform only what you need there. Some people keep only what they actively trade on an exchange, rather than their whole holdings.
- Consider whether to spread exposure across more than one arrangement, recognising that more accounts also means more logins and more to keep track of.
- Self-custody is an option, with its own risks. Holding your own keys removes the provider’s insolvency risk, but you become fully responsible: a lost or stolen recovery phrase can mean permanently lost funds, with no one to call. If you consider it, read how to move crypto from an exchange to a hardware wallet and how to back up your seed phrase safely first.
- Keep your own records. Periodically save statements or exports of your balances and transaction history. If anything goes wrong, your own records help you check what you are owed.
Which of these fit you depends on your situation, your amounts and how comfortable you are managing technical security yourself.
If your exchange stops withdrawals
If you find yourself in this situation, a calm, methodical approach helps more than panic.
- Use official channels only. Follow updates on the provider’s own website, verified accounts and, if formal proceedings start, the administrator’s official communications. Be wary of rumours and unofficial “update” groups.
- Document your position. Save screenshots and exports of your balances, open orders, deposit and withdrawal history, and any messages from the provider, with dates.
- Do not send more money to “unlock” withdrawals. A request to pay a fee or tax before you can withdraw is a classic warning sign of fraud.
- Beware of “recovery” offers. People who lose access to funds are often targeted by so-called recovery services promising to get their crypto back for an upfront fee. These are commonly a second scam. Our guide on how to spot crypto scams explains the warning signs.
- Never share keys or codes. No legitimate administrator or support agent needs your passwords, 2FA codes or recovery phrase.
- Consider independent advice if significant amounts are involved, especially once formal proceedings have started.
A quick recap
- Crypto on an exchange is usually a claim against the provider, not coins you control yourself.
- MiCA expects authorised providers to keep client crypto separate, keep proper records and not use it for their own account — but it does not guarantee outcomes in a failure.
- There is no deposit guarantee for crypto.
- What happens in an insolvency depends on national law, the provider’s records and compliance, and the specific case.
- You can limit how much depends on any single platform; self-custody is one option, with its own responsibilities.
Sources: Regulation (EU) 2023/1114 (MiCA) and related ESMA materials on custody and consumer warnings, plus official information from EU/national supervisors and deposit-guarantee bodies. Information as of November 2026. Not legal, tax, or investment advice.
This article has no affiliate links. Our [Affiliate Disclosure](/affiliate-disclosure/) explains how we handle partner links when we use them.