What to Know About Cryptocurrency Exchanges in the US Before You Start

What a Cryptocurrency Exchange Does

A cryptocurrency exchange is an online service where users can buy or sell digital assets. Purchases are generally made with fiat currency, meaning a country's standard currency, or with another cryptocurrency. Exchanges vary in size, location, supported assets, payment methods, fees, and level of account verification. Some services combine an exchange with a custodial wallet, while others provide only exchange or trading functions.

A November 9, 2020 article by Chris Hopper of Veriff compared crypto exchanges to currency-exchange offices where travelers exchange one currency for another. The article said users could expect verification at reputable exchanges and exchange fees, which it described as usually being paid to cryptocurrency miners who verify transactions. A crypto exchange differs from a wallet in purpose and structure, although some services combine the two.

Cryptocurrency is a network-based digital currency that does not rely on a central authority such as a government or bank to maintain it. Bitcoin was the first cryptocurrency. Blockchain technology records and verifies transactions across a distributed network of computers. The main word for this article is cryptocurrency exchanges in the us, and that is the lens for everything below.

Exchanges, Wallets, and Private Keys

A digital wallet allows a user to send, receive, or otherwise transfer cryptocurrency. Four general wallet arrangements were identified in the Department of Justice material:

Types of wallets

A wallet contains a long computer-generated alphanumeric public key or address and a corresponding private key. The public address can be shared with others and functions similarly to a bank account number or routing number. The private key functions more like a password, PIN, or cryptographic signature and allows the owner to authorize access or transactions.

Cold storage refers to a private key that is not connected to the internet, reducing exposure to online theft. A user who loses both the private key and every backup may have no way to recover the assets because there is no central authority able to reverse the loss. Some wallet systems provide a recovery seed consisting of a random group of 12 to 16 words that can recreate the private key.

Centralized Control Within a Decentralized Ecosystem

Blockchain protocols may be designed to favor censorship resistance and user autonomy, but many users now depend on centralized corporate intermediaries. Cryptocurrency exchanges, hosted wallet providers, payment processors, mining companies, and other service providers control practical access to the ecosystem.

These companies may determine who may open an account, which assets may be bought, sold, or transferred, how and when accounts are frozen or closed, what identity information and transaction records are retained, how the company responds to government regulations, law-enforcement requests, sanctions, and court orders, and whether users are notified when their data or accounts are affected.

A decentralized network does not remove the risk of a centralized failure when one exchange, wallet provider, or payment processor holds users' funds or controls access to key infrastructure. Companies that host accounts, hold customer funds, process transactions, or maintain user records can become choke points capable of freezing assets, turning over data, or discontinuing service.

7 Best Crypto Exchanges for 2026 Reviewed

Walks through seven top platforms - Coinbase, Robinhood, Crypto.com, Gemini, Kraken, Uphold, Fidelity Crypto - highlighting fees, bonuses, and who each suits.

U.S. Exchange Availability and Market Footprint

A Department of Justice article from 2019 reported that more than 100 VCEs existed, although only a handful had a presence in the United States. Among the ten largest virtual currency exchanges, only two were U.S.-based. At the same time, the article separately identified seven exchanges as among the largest U.S.-based services. These statements concern different scopes: seven listed U.S.-based exchanges did not necessarily mean that seven of the ten largest exchanges worldwide were based in the United States.

The March 2019 article listed the following U.S.-based cryptocurrency exchanges:

U.S.-based exchanges from 2019

These listings reflect the market as described in 2019 and should not be treated as a current statement of ownership, licensing, product availability, or regulatory status. As of March 6, 2019, CoinMarketCap listed more than 2,100 active cryptocurrencies. Bitcoin was the most common cryptocurrency encountered in the bankruptcy cases discussed by the Department of Justice. Other frequently encountered assets included Bitcoin Cash, Litecoin, Ethereum, and Monero.

Historical Exchange Profiles

A November 9, 2020 Veriff article offered the following historical snapshot. Its descriptions are not current endorsements or rankings. Among the platforms described, Kraken had operated since 2011 and supported currency pairs involving 12 cryptocurrencies and several fiat currencies, including U.S. dollars and euros. It was described as useful for international payments through SEPA, with low rates and fast service.

Coinbase Pro, formerly known as GDAX, was presented as more suitable for experienced cryptocurrency traders than for casual users. The article associated its lengthy identity-verification process with greater peace of mind about security, but also said that verification made it less fast for beginners. Bitstamp was described as an easy-to-use exchange headquartered in Luxembourg. It supported debit-card purchases, served beginners and experienced traders, and was described as suitable for large transactions.

Bitfinex was described as a high-volume exchange with reasonable fees, high liquidity, and a peer-to-peer financing model. The article said it had roughly twice Kraken's trading volume for much of 2017. It was considered more complex for beginners and, at that time, did not offer fiat support. Its cryptocurrency selection made it more suitable for specialist traders. Bittrex was described as one of the most visited exchanges and as having taken steps to comply with regulations that allowed smaller-scale users to buy and sell.

LocalBitcoins used a peer-to-peer structure in which users dealt directly with the person buying or selling the cryptocurrency. The Finland-based service was described as secure and as supporting PayPal's secure payment service. Bitpanda was described as an easy-to-use Austrian exchange with relatively low fees and a fast verification process. It was presented as suitable for beginners. The 2020 article characterized the selected products as reliable and secure offerings. It also stressed that other exchanges were available and directed readers to shop around, conduct research, check neutral reviews, avoid disclosing personal information, and never make payments to an unverified party.

Regulated Status, Licensing, and U.S. Customers

The legal status of an exchange can depend on its location, customers, products, and the volume of business conducted in the United States. Incorporating a company in a jurisdiction with lighter regulation does not automatically shield it from U.S. obligations when it operates in or serves U.S. customers.

A historical Orrick analysis stated that the Bank Secrecy Act applies to money services businesses wherever located when they conduct business wholly or in substantial part within the United States. It identified the following core requirements for money services businesses with a U.S. nexus:

Requirements for money services businesses

FinCEN and the Commodity Futures Trading Commission had found that BitMEX was operating as an unregistered futures commission merchant under the Bank Secrecy Act. The company also failed to maintain an adequate customer identification program and did not comply with AML program requirements. An effective AML and Know Your Customer program was also presented as necessary for sanctions compliance.

Recommended controls included customer and beneficial-owner identification, sanctions-list screening, geolocation and IP-address blocking, transaction monitoring, and required reporting to FinCEN and the U.S. Treasury Department's Office of Foreign Assets Control, or OFAC.

OFAC and Virtual Currency

OFAC has stated that sanctions obligations are the same whether a transaction is denominated in fiat currency or virtual currency. The sanctions analysis also explained that OFAC had begun adding virtual currency addresses associated with sanctioned people to its Specially Designated Nationals and Blocked Persons List.

Transactions involving blocked persons, blocked property, sanctioned jurisdictions, or prohibited trade- or investment-related dealings can create liability. The historical discussion said strict liability can apply to unauthorized dealings, meaning that a U.S. person may not avoid potential liability merely because the person on the other side of a transaction is unknown. In the event of a direct or indirect relationship with a sanctions target, the U.S. person may be dealing with blocked property or providing prohibited services.

The analysis also warned of secondary-sanctions risk for non-U.S. exchanges that permit access to U.S. sanctions targets. A non-U.S. business that knowingly serves designated persons or jurisdictions could face pressure intended to deter business with U.S. sanctions targets.

BitMEX Enforcement

In February 2022, BitMEX founders Arthur Hayes and Benjamin Delo pleaded guilty to willfully violating the Bank Secrecy Act. The case followed an August 2021 settlement with U.S. regulators, described as one of the largest resolutions involving a cryptocurrency exchange at that time.

BitMEX was incorporated in the Seychelles but maintained U.S. connections, including offices and U.S. customers. FinCEN and the Commodity Futures Trading Commission found that the company had accepted and solicited U.S. orders while failing to comply with anti-money laundering and customer-identification requirements. BitMEX resolved the allegations for $100 million, including a $20 million suspended penalty contingent on remediation and preventive measures. Those measures included ending all operations within the United States and no longer serving U.S. customers.

The Department of Justice had charged four founders or executives in October 2020. Prosecutors alleged that Hayes and Delo closely followed U.S. regulatory developments and knew the company had BSA obligations because U.S. customers traded on BitMEX. According to prosecutors, the defendants took steps designed to exempt BitMEX from U.S. law by incorporating it in the Seychelles, a jurisdiction they believed had less stringent regulation, while continuing to serve U.S. customers without AML and KYC compliance.

Without basic AML policies, the exchange was described in court-related allegations as in effect a money laundering platform and a vehicle for sanctions violations. BitMEX had also processed transactions for customers based in Iran, a jurisdiction comprehensively sanctioned by the U.S. Treasury Department.

BitConnect and Other Cases

A separate BitConnect case was cited on February 25, 2022. BitConnect founder Satish Kumbhani was indicted in an alleged cryptocurrency Ponzi scheme that allegedly deprived investors worldwide, including U.S. investors, of more than $2 billion. According to the indictment, BitConnect avoided U.S. regulatory scrutiny, did not register with FinCEN as required by the BSA, and evaded or circumvented U.S. regulations.

Cryptocurrencies and Economic Sanctions

An older Orrick discussion stated that OFAC intended to devote more resources to cryptocurrency issues and had issued subpoenas to virtual currency businesses regarding customers and transactions involving sanctioned countries. In November 2019, U.S. citizen and Ethereum Foundation staff member Virgil Griffith was arrested and charged with conspiring to violate U.S. sanctions after traveling to North Korea. The case did not involve cryptocurrency transactions. Prosecutors said Griffith provided cryptocurrency and blockchain expertise at the Pyongyang Blockchain and Cryptocurrency Conference despite the U.S. government's denial of his request for authorization to attend.

The discussion also noted that Iran reportedly acknowledged cryptocurrency mining as a legitimate industry in 2018. In December 2019, Iran's president reportedly proposed a Muslim cryptocurrency to reduce reliance on the U.S. dollar. The U.S. government prohibited transactions involving Venezuela's state virtual currency, the Petro, in 2018.

Because the risk of encountering sanctioned parties can rise when individuals or jurisdictions adopt cryptocurrency, exchanges have been advised to use risk-based compliance programs, sanctions screening, geolocation controls, transaction monitoring, and government reporting. U.S. users were advised to use exchanges committed to U.S. sanctions requirements because interacting with a platform that permits sanctioned parties could expose a user to liability even when the user is unaware of the counterparty's status.

Top US Crypto Exchanges Compared Quickly

Runs through US‑available exchanges like PropW, Bitunix, and ByBit, noting bonuses, KYC requirements, and a trading community link.

Advertising and Other U.S. Exchange Developments

Microsoft Advertising announced that it was allowing advertising for cryptocurrency exchanges in the United States. The available material describes an advertising-policy change and does not provide further conditions in the announcement. A TRM Labs item stated that authorities had taken down Garantex, describing it as a notorious crypto exchange linked to illicit finance and sanctions violations. The supplied page contained regional-access restrictions rather than additional details about the operation.

Offshore Crypto Perpetual Futures and Coinbase

Decrypt reported that the Commodity Futures Trading Commission had allowed Coinbase to offer U.S. customers access to offshore cryptocurrency perpetual futures through Coinbase's subsidiary, Deribit. The article described Coinbase as the leading U.S. cryptocurrency exchange and Coinbase as the first U.S. exchange to receive authorization for this particular connection to the global perpetual-futures market.

Deribit is an offshore cryptocurrency derivatives exchange that Coinbase had acquired for $2.9 billion the previous year. Perpetual futures are derivative contracts with no expiration date. They allow traders to place leveraged bets on the future price of crypto assets using borrowed capital.

Coinbase requested a CFTC no-action letter on Thursday. The regulator replied less than 24 hours later with a 16-page document outlining a policy that permitted Coinbase's requested activities. The action was characterized as allowing U.S. customers to access the offshore market through Deribit while Coinbase decides which contracts to offer.

The CFTC's clearance applied to perpetual-futures contracts on digital commodities traded on Deribit. The report said the category included contracts associated with Bitcoin, Ethereum, Solana, Dogecoin, and the TRUMP meme coin, among others. Coinbase had not yet decided which assets it considered fit for purpose or the right kind of assets to offer U.S. customers.

Perpetual futures carry a high risk of leveraged loss. A favorable trade can produce a return several times larger than the initial investment, while losing positions can be liquidated quickly. A sharp price movement in the fall of 2021 reportedly erased $19 billion in crypto positions within minutes, largely because of leverage.

The size of the broader market created additional context for the policy change. DeFi Llama data cited in the report showed more than $588 billion in crypto perpetual-futures trading volume during the preceding month, compared with $160 billion in trading volume across the entire decentralized-finance ecosystem during the same period.

The CFTC also gave prediction-market operator Kalshi approval to create Bitcoin perpetual futures in the United States. That was described as the first U.S.-created product of its kind. The report expected other U.S. exchanges to seek similar access under the CFTC's newly stated guidelines, although that broader outcome was presented as an expectation rather than a completed action.

Account Takeover Risks

A centralized exchange controls whether a customer can use a brokerage account, and the quality of the platform's account-security design affects whether an attacker can take it over. A security review defined an account takeover, or ATO, as an incident in which an attacker obtains access to another person's account and then locks out the rightful owner by changing access credentials.

The review argued that users cannot be assumed to know which protections an exchange supports or how to configure them. A platform may omit phishing-resistant multifactor authentication, fail to monitor account events, or fail to present in-app Was this you? prompts after anomalous activity. Those omissions can give attackers opportunities that the user cannot correct independently.

Sift's Digital Trust and Safety Index reported an 808% year-over-year increase in reported takeovers of financial accounts, including cryptocurrency accounts. A later index reported a further increase in account takeovers across all industries since 2023. Not every platform has enough logging and monitoring to detect an ATO promptly. Fewer than half of the victims surveyed by Sift were told that data loss or a breach had occurred. A 2016 RAND survey about data-breach notifications and loss of personal information found that 68% of respondents who had experienced compromised financial information reported a median financial loss of $864.

An account compromise may not immediately result in stolen funds. An attacker might exploit a platform flaw to export credentials or valid session tokens and sell them. Another attacker might buy collections of credentials or identifiers on the darknet and test them against several exchanges before reselling the working entries. The time between the initial compromise and an attempted purchase, transfer, or trade can therefore be substantial.

Password, Phishing, and Second-Factor Attacks

A user may be compromised by failing to use a strong password and a second authentication factor, but a user can also be compromised even when they use every available platform feature if those features are weak or poorly implemented.

SMS codes, mobile authenticator applications, and email-based codes are not equivalent to phishing-resistant hardware authentication. If a user receives MFA codes in email, an attacker who compromises the email account can use the second factor to access the exchange. If SMS is the exchange account's second factor, an attacker may perform a SIM swap and receive the code on the substituted phone.

Attackers may also exploit password-reset flows. A weak reset process may allow an attacker to bypass the second factor or otherwise obtain control of an account. Other entry points include brute-forcing a weak password, phishing credentials, reusing credentials from another breach, or obtaining valid session tokens.

Platform Features Relevant to Users

The review recommended overlapping security controls supported by technical mechanisms, documented processes, and clear user guidance. Features identified as important included:

Security features for exchanges

The review was written for exchange executives, technical product managers, security engineers, and software engineers. It argued that platforms should provide a secure-by-design environment and give users basic personal-security guidance instead of requiring every user to discover and configure every protection independently.

Large Exchange Cyberattacks and Key Management

An analysis published on June 30, 2023 argued that newly launched systems initially give threat actors an advantage because organizations have not yet established mature attack patterns. However, early outlier attacks often reveal techniques that are reused with minor changes.

Three attacks were treated as outliers in the analysis because all occurred before Bitcoin reached its reported peak market capitalization in 2021, all targeted centralized exchanges, and all resulted in unusually large Bitcoin thefts. Together, they represented approximately $1.09 billion when measured using Bitcoin prices at the time of exfiltration and the later value of dormant assets. The three represented about 15% of total losses attributed to cryptocurrency cyberattacks through the period analyzed.

For comparison, almost $7.2 billion in cryptocurrency had been stolen by the end of 2022. Most assets in the three outlier cases were not frozen, marked, or reclaimed, allowing some stolen holdings to remain in attacker-controlled wallets and appreciate in value.

The report described a timeline in which large exchange attacks began with Mt. Gox between 2011 and 2014, continued at a lower rate, and increased shortly before 2018 as Bitcoin experienced a major price increase. Bitcoin was described as reaching an all-time price of $65,000 in November 2021. A gap in the data immediately after March 14, 2020 was attributed to the first global lockdowns.

Security Lessons From Mt. Gox

Mt. Gox experienced a series of cyberthefts between 2011 and 2014, with losses reported of up to 850,000 Bitcoin, valued in the report at $470 million.

The first recorded compromise occurred on June 13, 2011, approximately one year after the first Bitcoin retail transaction. The initial entry point was a machine controlled by a recent Mt. Gox auditor who may also have been connected to a platform founder's account. A lawsuit suggested that a dictionary attack may have been used to guess the auditor account's password. Other reporting indicated that the auditor system was accessed with known credentials, providing privileged access to the exchange.

The attacker used that access to steal private keys from a hot wallet, a wallet container that remained connected to the internet, and obtained privileged access related to a nominal amount of trading value. Bitcoin was transferred to the attacker's wallet. Mt. Gox reported cybertheft across 478 accounts. On June 17, a message offering the Mt. Gox user database for sale appeared on Pastebin under the username crazlestinger. Reporting indicated that some vulnerabilities had been known to the platform's founder since at least the end of the initial hack.

In September 2011, two Russian nationals exploited existing weaknesses and reportedly an unknown vulnerability to access an Mt. Gox server. They compromised some of the primary signing keys used to authorize transactions and slowly removed Bitcoin until 2014. The stolen Bitcoin was laundered through BTC-e. Bankruptcy proceedings reported that 850,000 Bitcoin had been lost. Approximately 200,000 Bitcoin were reported found or recovered, but only 1,811 Bitcoin could be reliably traced under the figures given in the report. Mt. Gox, the largest exchange of its time, closed after the attacks.

EclecticIQ analysts said the person posting the database under crazlestinger was probably not the same threat actor responsible for the auditor-account compromise or the Russian cybercriminals who were indicted. They also said the date of the database post was probably not the same as the compromise date, making the incident timeline difficult to establish. Known vulnerabilities may have remained for a year or more, and the exchange of stolen account information could have enabled later compromises by other attackers. The case illustrated the risks of reused or exposed credentials, privileged accounts, hot-wallet private keys, weak key architecture, delayed disclosure, and inadequate monitoring.

Security Lessons From Bitfinex

Bitfinex reported the theft of 120,000 Bitcoin, valued at approximately $72 million, in 2016. The original entry point remains unknown. Reporting suggested that the compromise may have taken place over more than a year, but the funds were moved in a single transaction to a single wallet. Most stolen funds reportedly remained in that original wallet.

The attacker compromised more than one signing key in a multisignature arrangement. Bitfinex held two keys, while associated company BitGo held the third. There was no effective mechanism to identify and block the large withdrawal. Investigators found no evidence that BitGo servers had been compromised, which pointed toward the Bitfinex side of the signing system.

EclecticIQ analysts proposed two possibilities. The attacker may have conducted extensive network reconnaissance to identify privileged signing systems, or the attacker may have pivoted from another network node that served as the origin of the intrusion. Either possibility would have required greater sophistication, resources, time, and operational discipline than a simple credential-theft attack. The long intrusion period and advanced techniques reportedly left few indicators of compromise. The report compared those characteristics with advanced persistent threat groups that have the resources and patience to use obfuscation tools. If the actor was an individual rather than a group, the report said the person would have needed substantial skill and may have possessed insider knowledge.

Elliptic identified four concentrated campaigns that attempted to move or launder some of the stolen funds. One IP address and the same email provider were used to create multiple accounts over a short period. U.S. authorities later prosecuted two individuals after observing movement of the funds. A service-provider order reportedly provided access to a cloud account containing private keys associated with a laundering wallet, and funds continued to enter and leave the original main wallet in smaller movements. The case showed why multisignature arrangements require independent validation, monitoring of large withdrawals, separation of key privileges, and mechanisms capable of stopping anomalous transactions.

Security Lessons From Coincheck

A January 26, 2018 attack targeted Coincheck's primary hot wallet. The wallet did not use multisignature technology to validate transactions. The original NEM tokens were sent to an attacker-controlled wallet on the same day.

The source contains conflicting figures and asset labels. The section heading describes the loss as 46,000 Bitcoin ($532,000,000), while a later passage describes the loss as NEM tokens and refers to reports of approximately $400 million. The report's account also uses Bitcoin in discussing parts of the exfiltration process. The figures and asset labels should therefore be treated as internally inconsistent within the source.

The exchange's architecture used a proof-of-importance consensus process under which network nodes agree on transactions without relying on computational processing power. The report said this design helped protect against a 50% consensus-style attack. The attacker nevertheless likely gained access to a privileged network machine in order to bypass the process, possibly through targeted phishing or another privileged point of entry.

Bitcoin exfiltration began on February 1, 2018. The largest recorded transaction occurred on March 20, using Mosaic to obtain 1,000 Bitcoin. A total of 4,778 transactions completed the exfiltration phase, with most falling between approximately $50 and $9,000. An initial 2018 investigation suspected North Korea. A later 2019 investigation implicated Russian cybercriminals after malware-as-a-service variants associated with Russia-based developers were identified. The conflicting attribution illustrates that responsibility for a major exchange attack can remain uncertain for years.

The case showed why a large concentration of assets in a single internet-connected hot wallet remains vulnerable even when the underlying network has a formal consensus process.

Control Measures Identified Across the Cases

The report identified several recurring control areas:

Control areas from exchange attacks

According to figures cited in the report, poor design integrating smart-contract and wallet flaws accounted for more than 70% of some measures of large-scale attacks through 2022. In 2022 alone, known vulnerabilities accounted for an estimated 20% to 50% of attacks on cryptocurrency financial technology. Key exposure was estimated at 4% to 16% in 2022, while other sophisticated tactics and techniques exceeded 60%. Network-design and protocol-implementation flaws represented approximately 18% of large cyberattacks by 2022. These percentages were presented as report estimates rather than as a single universally applicable measurement.

Experts Break Down $6.3B Binance Hack

CNN covers the record Binance theft, with analysts Carol Alexander and Jonathan Levin on suspects, possible AI use, and how stolen funds might be traced.

Later Exchange and Bridge Incidents

The analysis also referenced other large incidents:

Later incidents

The report argued that centralized regulation was the most likely path toward minimum cybersecurity standards. Its broader conclusion was that continued attention to the patterns established by early high-impact attacks could reduce risk for platforms and users.

Transparency, Government Requests, and User Rights

The Electronic Frontier Foundation's Rainey Reitman published Defending Users: Initial Ideas for Cryptocurrency Exchanges, Payment Processors, and Other Choke Points Within the Blockchain Ecosystem on July 30, 2018.

The article argued that the blockchain ecosystem had changed substantially over its first nine years. Early enthusiasts had often imagined people mining Bitcoin on home laptops, storing private keys on personal hard drives, and sending Bitcoin directly to friends and merchants. By 2018, many users instead relied on companies that performed mining, storage, exchange, and payment-processing functions. These companies set rules for account eligibility, asset storage, exchange access, account freezes, regulatory responses, and user-data handling. These real-world policies could be more important to users than the censorship-resistant design of the underlying protocol.

Government pressure can include direct regulation, legal demands, threats, investigations, requests for assistance, account shutdowns, data requests, or requirements to build security backdoors. Exchanges can also be pressured through secondary sanction enforcement, user controversy, fraud controls, terms-of-service enforcement, internal policy decisions, and commercial pressure from partners or investors.

EFF Policy Concepts

The EFF presented five initial policy concepts for companies at the transactional layer.

Transparency reports are public summaries of government requests received during a defined period. They can disclose how many requests were made, how many were complied with, how many accounts were affected, and how many requests involved censorship or account shutdowns. The article said blockchain firms that file Suspicious Activity Reports with the U.S. government should make that reporting relationship clear. Even if the reports cannot be publicly disclosed in full, publishing aggregate information can provide users with a better understanding of the company's relationship with government oversight. Companies that receive less formal data requests may still receive unofficial demands to freeze accounts or suppress activity. Transparency reporting can expose these pressures when the company complies with them.

The EFF identified user notification as an important safeguard. A user should be told when the government seeks access to that user's data, ideally before the company releases it and with enough time to obtain legal counsel or challenge the request. Possible exceptions include emergencies involving a grave physical danger, a compromised account in which advance notice would undermine the investigation, gag orders, or situations in which notice would violate another law. Even where advance notice is impossible, the company should consider promising notice after the emergency passes.

Potential government-requested data can extend beyond information entered into a blockchain. A company may possess email addresses associated with app downloads, device identifiers, IP addresses in web-server logs, records of who submitted or queried data on a blockchain, geolocation data, service-use histories and timestamps, communications metadata, including the people, time, and frequency of conversations, and logs that could reveal a user's identity even when message content is end-to-end encrypted. The EFF said companies should make notification commitments before receiving the first warrant or subpoena, rather than designing a policy during an emergency.

Blockchain records can be difficult to edit or erase because of the cost of rewriting history. A company applying blockchain technology may still be compelled to introduce transaction blacklists, reject particular transactions, or freeze user accounts. The article raised questions about whether a content-addressing system could be forced to apply a default blacklist, whether a mining pool could be pressured to reject a transaction, and whether an exchange such as Kraken could be pressured to freeze accounts associated with controversial writers or viewpoints. Each platform had to decide in advance how it would handle users with whom it disagreed and uses that violated company expectations. Policies based on speech and lawful conduct are more neutral than decisions based solely on a company's approval of a user.

Account closures and freezes can have severe consequences, particularly when automatic systems act on behavior associated with fraud, sanctions, terms-of-service violations, or unusually large asset inflows. A small business or individual may be unable to continue operating after an incorrect automated decision. The EFF recommended human review by someone not involved in the original decision and a meaningful, timely appeals process. Automated freezes should not be treated as final simply because the initial decision was made by a system.

Companies should collect only the data necessary to operate the service, delete data when it is no longer required, permit full account deletion, encrypt backups and delete them when appropriate, use user-side encryption where possible, and clearly explain retained data. Some information may be required by law, needed for the service to function, or necessary to prevent fraud and abuse. Even so, retained information can later be sought by government investigators or civil litigants. Data-minimization and clear retention policies can reduce the likelihood that an exchange becomes a concentrated source of surveillance information.

Exchange Records and Asset Recovery

The Department of Justice's 2019 bankruptcy article emphasized that exchange records can be important for identifying, preserving, and administering cryptocurrency holdings. It was written by Nancy J. Gargula, United States Trustee for Regions 10 and 21, and Colin May, a bankruptcy auditor in the Office of the U.S. Trustee. The article originally appeared in the Spring 2019 issue of the American Bankruptcy Trustee Journal and was later marked as updated.

Cryptocurrency may not appear in a bankruptcy filing or statement of financial affairs. It can be discovered by examining bank statements, PayPal transactions, credit-card statements, payments to or from a known VCE, long computer-generated alphanumeric addresses that are too long to be ordinary account numbers, and entries such as Coinbase/BTC or similar payment descriptors.

A U.S. person might be asked whether they have held or used Bitcoin or another virtual currency during the previous 12 months. Follow-up questions may include when and why the person began using the currency, the purpose of the initial and later transactions, the largest amount held during the period, which exchanges and payment processors were used, which email addresses were used to create digital wallets, where the wallet was retained, where any cold-storage wallet, USB drive, or paper key was located, where the private key was stored at that time, and whether the person bought, sold, or transacted cryptocurrency for anyone else.

Transacting on behalf of another person may indicate a crime. A debtor's inability to explain cryptocurrency transactions may also indicate concealed ownership, undervaluation, false statements, or another irregularity. Because cryptocurrency can be transferred quickly, a trustee or other authorized party may need immediate control of a wallet and private key. Possible steps include contacting an exchange to determine how to identify a customer account, what information is required to locate a transaction and obtain records, how to request a freeze that prevents sales, exchanges, transfers, or trades, and what information is needed to transfer the account's value into a controlled estate account.

Exchange records are commonly associated with the email addresses used to open the account. Policies and procedures change as cryptocurrency adoption evolves, so a plan for freezing, obtaining records, and transferring assets may need to be reviewed periodically. The article's 2019 description of U.S.-based exchanges said they were regulated by state and federal authorities and had to maintain financial and customer records. Those records were often described as critical in investigations because the exchange may be the only institution that links a customer identity, email address, transaction history, account balance, and withdrawal destination.

Investment Characteristics and Market Risk

Daniel Gonzalez of Brooklyn Coop wrote that members had shown increasing interest in cryptocurrency. The article noted that the presidential administration in office at the time appeared friendly toward crypto, while cautioning that future administrations might take a different position. It described a market characterized by major gains, scams, collapses, failures, and uncertainty about the long-term usefulness of digital assets.

The article stated that it was not financial advice and was intended to support further research. Its risk assessment covered the following areas.

Cryptocurrency is not backed by a government, and governments generally did not treat it as legal tender. The article's framing was that governments considered cryptocurrency a commodity rather than currency. Because its value depends on trust in the network, its participants, its code, and the organizations that support it, a loss of confidence can cause a rapid decline in price. Some assets have appreciated enough to increase holders' net worth, but widely publicized scams, collapses, and failures have also caused severe losses. The article argued that lightly regulated, intangible assets are particularly exposed to moral hazard because ownership of many cryptocurrencies and exchanges is not transparent.

Bitcoin was identified as the original cryptocurrency. A Brooklyn Coop article characterized Bitcoin and Ethereum as the two principal success stories because millions of people had invested substantial sums in them and they had relatively widespread acceptance. The same article cited built-in scarcity, blockchain design, and secure transaction mechanisms as factors that had earned buyer trust. Those statements described the author's perspective; another 2019 source counted more than 2,100 active cryptocurrencies.

Cryptocurrency does not have the tangible collateral represented by real estate or other physical property. Its value depends heavily on continued participant confidence and infrastructure. A failed exchange may have few real assets available to satisfy customer claims. A centralized exchange failure can therefore affect both the cryptocurrency held on the platform and the fiat currency deposited to buy it. The Brooklyn Coop article stressed that users may lose access to both the asset and the exchange claim.

Crypto assets also do not generate dividends or interest in the way some traditional assets do. A holder generally realizes a gain only by selling at more than the purchase price. If the market declines before the holder can sell, the investment may lose most or all of its value. No guarantee exists that a buyer will be able to complete a sale. The article also stated that the ongoing liabilities associated with crypto are generally fewer than those associated with real estate, stocks, or bonds. It identified property taxes and insurance for real estate, and annual brokerage fees for stocks and bonds. In contrast, the source considered the main significant crypto costs to be the initial exchange fee and capital gains tax at sale.

Crypto can be purchased with a smaller amount of money than real estate, which may make it accessible to people with lower incomes. A source argued that this lower entry point is an advantage for smaller investors. The article also stated that crypto enthusiasts do not need to be banked to buy or sell through every available platform. Stock and bond purchases generally require a bank account and may also require a brokerage account. Crypto may therefore appear more accessible to an unbanked person.

At the same time, the article characterized crypto as a shortcut to speculation rather than a substitute for understanding traditional markets, fees, and financial products. The regulatory requirements and risks associated with crypto could make the apparent simplicity misleading.

The Brooklyn Coop author stated that the weaknesses of crypto as an asset class outweighed its potential upside and advised against buying it. The author discouraged speculation generally and viewed crypto trading as no different from other speculative activity. For people who would invest in crypto regardless, the article recommended limiting speculation to Bitcoin and Ethereum. The reason given was their worldwide user base and relatively widespread acceptance as media of exchange. More obscure cryptocurrencies were described as more likely to bubble and collapse or to be outright scams.

The article compared crypto with other assets, stating that investors should conduct due diligence for intangible assets, regulated real estate, and insured certificates of deposit. It stressed that every person has a different risk appetite and that only the investor can determine which asset fits the individual risk profile.

For people who would invest in crypto regardless, the article recommended limiting speculation to Bitcoin and Ethereum because of their worldwide user base and relatively widespread acceptance as media of exchange.

That is the full picture of cryptocurrency exchanges in the us as described in the source material. The landscape has changed since many of these reports, but the underlying dynamics of custody, regulation, security, and risk remain relevant for anyone evaluating a crypto exchange usa today.