Is It Safe to Keep Crypto on an Exchange? What UAE Investors Should Know in 2026
You bought Bitcoin or Ethereum on an exchange app, and it is still sitting there. Most people do the same. Then a headline like this one appears: on 24 September 2026, the exchange Bitget paused customer withdrawals after attackers moved hundreds of millions of dollars out of its wallets. Suddenly the question is not theoretical anymore. Is your crypto actually safe where it is?
This guide answers that question for investors in Dubai, Abu Dhabi and the wider Middle East. It explains what really happens when an exchange holds your crypto, what UAE regulation does and does not protect, and how to decide what to keep on an exchange and what to move elsewhere.
Quick Answer
Keeping crypto on an exchange is convenient, but it is never completely safe. When an exchange holds your crypto, it controls the private keys, so your balance depends on that company staying secure, solvent and honest. A licensed exchange in the UAE must follow rules on client asset protection, but a licence does not stop hacks or withdrawal freezes. For most investors, a sensible approach is to keep only what you actively trade on a well-regulated exchange and hold long-term savings in a way you control, such as a hardware wallet or a regulated custodian.
What Actually Happens When You Keep Crypto on an Exchange?
When you buy crypto on a centralized exchange and leave it there, you usually do not hold the coins directly. The exchange holds the private keys, which are the codes that prove ownership on the blockchain. What you see in the app is the exchange’s record of how much it owes you.
This is called custodial storage. It works a bit like leaving cash with a company rather than keeping it in your own safe. If the company runs well, you can withdraw any time. If it fails, gets hacked or freezes accounts, you have to wait on the company, and in the worst case, on a court process.
That is why the crypto community repeats the phrase “not your keys, not your coins.” It does not mean every exchange will fail. It means your safety depends on someone else.
What Are the Main Risks of Leaving Crypto on an Exchange?
1. Exchange hacks
Large exchanges are constant targets for skilled attackers, including state-backed groups.
- Bybit, February 2025: According to the FBI’s public service announcement, North Korean hackers stole about USD 1.5 billion in crypto from Bybit on or around 21 February 2025. The attackers hijacked a routine transfer from a cold wallet to a hot wallet. Bybit said it stayed solvent and covered the loss.
- Bitget, September 2026: Bitget detected unauthorized transfers from parts of its hot and warm wallets on 24 September 2026. It later revised the loss to about USD 387.5 million, said its cold wallets were not affected, and said its User Protection Fund covered the loss. Withdrawals were paused while the exchange completed a security review, as Fortune reported. In its official support notice, Bitget set out a phased restart of withdrawals beginning 28 September 2026, with remaining assets scheduled for 2 October.
In both cases, the exchanges said customer balances were covered. But customers still depended on the company’s own funds and decisions, and Bitget users could not withdraw for several days.
2. Withdrawal freezes
Even without a hack, an exchange can pause withdrawals during a security review, a technical failure, heavy market stress or a regulatory problem. During a freeze, you cannot move your crypto, even if prices are moving fast.
3. Mismanagement or fraud
Some of the biggest losses in crypto history came from inside the company, not from hackers. In the case of FTX, the US Securities and Exchange Commission alleged that founder Samuel Bankman-Fried secretly diverted customer funds to his trading firm, Alameda Research, while promoting FTX as a safe platform. When customers rushed to withdraw in November 2022, the money was not there.
4. Bankruptcy
If an exchange goes bankrupt, your result depends on its user agreement, whether client assets were kept separate, and the law of the country where the case is heard. Lawyers speaking to CNBC after the Celsius and Voyager collapses warned that customers may find their crypto treated as company property, which can turn them into creditors waiting in line for partial repayment.
5. Your own account security
This is the risk you control most directly. Phishing links, fake support agents, weak passwords, SIM-swap attacks and leaked API keys can empty an account on a perfectly secure exchange.
| Risk | What it means for you | Can you reduce it? |
|---|---|---|
| Exchange hack | Funds stolen from the platform’s wallets | Partly: choose regulated platforms, keep less on them |
| Withdrawal freeze | You cannot move your crypto for a period | Partly: spread holdings, keep long-term assets off-exchange |
| Fraud or misuse of funds | Company uses client assets improperly | Partly: use firms under strict custody rules |
| Bankruptcy | You may become a creditor | Partly: check how client assets are held |
| Account takeover | Someone else logs in and withdraws | Yes: strong security settings (see checklist below) |
Does a VARA Licence Make a Crypto Exchange Safe?
A licence makes an exchange safer, not risk-free. It is the single most important check for a UAE investor, but it is important to understand what it covers.
Who regulates crypto exchanges in the UAE?
The UAE does not have one crypto regulator. The right one depends on where the firm operates:
| Regulator | Area covered | Where to check a firm |
|---|---|---|
| Virtual Assets Regulatory Authority (VARA) | Dubai mainland and free zones, except the DIFC | VARA Public Register |
| Dubai Financial Services Authority (DFSA) | Dubai International Financial Centre (DIFC) | DFSA website |
| Financial Services Regulatory Authority (FSRA) | Abu Dhabi Global Market (ADGM) | FSRA Public Register |
| Capital Market Authority (CMA) | Federal level; replaced the Securities and Commodities Authority (SCA) on 1 January 2026 | CMA official channels |
| Central Bank of the UAE (CBUAE) | Payment services that use virtual assets, such as payment tokens | CBUAE official channels |
At the federal level, the CMA issued Decision No. 4/R.M/2026, which replaced the old SCA virtual asset rules in full. VARA remains the authority for Dubai outside the DIFC, while ADGM and the DIFC keep their own rulebooks.
What VARA custody rules require
VARA’s Custody Services Rulebook sets strict rules for firms licensed to hold client crypto. Among them:
- Client crypto held in custody is not treated as the firm’s own assets or liabilities.
- Each client’s crypto must be kept in separate wallets that hold only that client’s assets.
- The firm may not lend out or reuse client assets (rehypothecation), even if the client agrees.
- The firm must keep control of client assets at all times and keep reconciled records of each client’s holdings.
These rules target exactly the kind of misuse seen at FTX. That is a real advantage of using a properly licensed firm.
What a licence does not do
- It does not make a platform hack-proof. Licensed or not, exchanges run internet-connected systems that attackers target.
- It covers only the listed activities. VARA licenses separate activities, such as exchange, broker-dealer and custody services. Check which services a firm is actually authorized for.
- An In-Principle Approval (IPA) is not a licence. VARA states that IPA holders may not start operations or serve clients until they receive a full licence.
- A company balance-sheet fund is not a government guarantee. Exchange “protection funds” are promises from the company itself.
VARA also publishes a list of unlicensed firms it has acted against, and its FAQ states that unlicensed providers may not onboard Dubai residents as customers.
How Do You Check If a Crypto Exchange Is Licensed in the UAE?
- Find the legal entity name. The brand name in the app is often different from the licensed company. Look in the platform’s terms of service or ask support.
- Pick the right register. Dubai (outside the DIFC) is VARA. ADGM is the FSRA. The DIFC is the DFSA.
- Confirm the status is a full licence, not an application or an In-Principle Approval.
- Check the licensed activities. Make sure exchange and custody services are both covered if the firm will hold your crypto.
- Check warning lists. Search VARA’s regulatory notices and unlicensed firm list. For example, VARA issued an investor alert about KuCoin, stating it held no licence to serve clients in or from Dubai.
If a platform will not tell you which company you are dealing with, treat that as a warning sign.
Exchange vs Self-Custody Wallet: Which Is Safer?
Moving crypto off an exchange removes platform risk, but it hands the full responsibility to you. Neither option is automatically “safe.” They carry different risks.
| Factor | Licensed exchange (custodial) | Hardware wallet (self-custody) |
|---|---|---|
| Who holds the private keys | The exchange | You |
| Exposure to exchange hacks or freezes | Yes | No |
| Exposure to exchange bankruptcy | Yes | No |
| Password reset or account recovery | Usually available | Not available; lose the recovery phrase and the crypto is gone |
| Speed for trading | Fast | Slower; you must send funds to an exchange first |
| Main risk | Company failure or attack | Human error, lost backups, scams |
| Best suited for | Active trading and short-term balances | Long-term holdings you rarely touch |
A hot wallet is any wallet connected to the internet, such as a phone app. A cold wallet, such as a hardware device, keeps keys offline. Cold storage lowers online attack risk, but it only protects you if the recovery phrase is stored safely, offline and never shared with anyone.
For larger holdings, some investors also use a regulated custodian, a firm licensed specifically for custody services. This sits between the two options: you do not manage keys yourself, but the firm operates under custody-specific rules.
How Much Crypto Should You Keep on an Exchange?
There is no single number that suits everyone, because it depends on how you use crypto and how much of your wealth it represents. A practical way to think about it is by purpose:
- Trading balance: The amount you actively buy and sell. This is the part that most often stays on an exchange.
- Long-term holdings: Crypto you plan to hold for years. This is the part most investors move to self-custody or regulated custody.
- Money you cannot afford to have frozen: Funds needed for a property deposit, school fees or business costs should not depend on any single platform staying open.
A useful test: if this exchange froze withdrawals for two weeks starting today, would it cause you real harm? If yes, you may be holding too much there.
Crypto Exchange Safety Checklist for UAE Investors
If you keep crypto on an exchange, these steps reduce the risks you can control:
- Use a platform with a full licence from VARA, the FSRA or the DFSA, depending on where it operates.
- Turn on two-factor authentication with an authenticator app or security key rather than SMS.
- Enable withdrawal address whitelisting, so crypto can only go to addresses you approved in advance.
- Set an anti-phishing code if the exchange offers one, so you can recognize real emails.
- Delete or restrict API keys you no longer use, especially any with withdrawal rights.
- Do not keep everything on one platform.
- Read the custody section of the terms of service to see how your assets are held.
- Keep your own records of deposits, trades and balances, including screenshots.
- Never share codes or recovery phrases with anyone claiming to be support staff.
Is Proof of Reserves Enough to Trust an Exchange?
Many exchanges publish proof-of-reserves reports showing they hold enough crypto to match customer balances. These reports are useful, but they have limits. They show a snapshot at one moment, and they may not capture every liability the company has.
Proof of reserves also says nothing about security. Bybit had published reserve data shortly before its February 2025 hack. A strong reserve report tells you the company appeared solvent at a point in time. It does not tell you the platform cannot be attacked or frozen.
What Should You Do If Your Exchange Freezes Withdrawals?
- Follow only official channels. Freezes attract scammers posing as support staff or “recovery” services.
- Record your balances. Take dated screenshots of every asset in your account.
- Do not send more funds to “unlock” your account. Legitimate exchanges do not ask for this.
- Raise a complaint with the firm first. If it is licensed in Dubai and the issue is not resolved, VARA accepts complaints about licensed firms and reports of unauthorized activity.
How Crypto Storage Fits Into a Wider Investment Plan
Where you store crypto is one part of a bigger question: how much crypto risk belongs in your portfolio at all. An investor in Dubai may hold US stocks through a broker, property in Dubai, and crypto across an exchange and a wallet. Each carries different risks, from market swings to platform and custody risk.
Thinking about custody alongside diversification helps avoid a common mistake: taking careful market risk, then leaving a large share of your wealth exposed to a single platform. If you want guidance on how crypto fits next to US stocks and Dubai or UAE real estate in a balanced strategy, Anna Vasyutina Investments offers consultations focused on informed, diversified investment decisions.
Frequently Asked Questions
Is it safe to keep crypto on Binance, OKX or Bybit in the UAE?
Safety depends on the specific legal entity serving you and what it is licensed for, not only the brand. Check the entity on the VARA, FSRA or DFSA register. Even with a valid licence, platform risks like hacks and withdrawal freezes remain, so avoid keeping more there than you need.
Is crypto on an exchange insured?
Generally not in the way a bank deposit may be. Some exchanges run their own protection funds or private insurance, but these are company arrangements with limits, not government guarantees. Read the exact terms before relying on them.
Can an exchange freeze my crypto?
Yes. Exchanges can pause withdrawals during security incidents, technical problems or regulatory action, and can restrict individual accounts for compliance reasons. Bitget paused all withdrawals after its September 2026 hack before starting a phased restart.
What happens to my crypto if an exchange goes bankrupt?
It depends on the user agreement, whether client assets were segregated, and the court handling the case. In some past bankruptcies, customers became creditors and waited a long time for partial repayment. Strict segregation rules, such as those in VARA’s custody rulebook, are designed to reduce this risk.
Is a hardware wallet safer than an exchange?
A hardware wallet removes exchange risks, but adds personal responsibility. If you lose your recovery phrase or reveal it to a scammer, there is no one to reverse the loss. It is usually better for long-term holdings than for active trading.
Does a VARA licence protect me from exchange hacks?
No. A VARA licence means the firm must meet rules on custody, segregation, governance and security, which lowers risk. It does not guarantee that a platform cannot be hacked or that withdrawals will never be paused.
Should I move all my crypto off exchanges?
Not necessarily. Many investors keep a trading balance on a regulated exchange and move long-term holdings to self-custody or regulated custody. The right split depends on how actively you trade and how comfortable you are managing your own keys.
Key Takeaways
- Keeping crypto on an exchange is convenient but never fully safe, because the exchange controls the private keys.
- Main risks are hacks, withdrawal freezes, misuse of funds, bankruptcy and account takeover.
- In the UAE, check the right regulator: VARA for Dubai, the FSRA for ADGM and the DFSA for the DIFC.
- VARA custody rules require segregated client wallets and ban reuse of client assets, but a licence does not prevent hacks.
- A practical approach is to keep your trading balance on a regulated exchange and long-term holdings in self-custody or regulated custody.
- Recent events, including the Bybit hack in 2025 and the Bitget hack in September 2026, show that even large platforms can be attacked.
Information current as of 28 September 2026. This article is general educational content and is not personal financial, legal or tax advice. Regulations and platform licences change often, so always confirm details with the relevant regulator before acting.