The thing that took me too long to internalize is that the number on your exchange dashboard is not your money in the way a bank balance is your money. It is a claim. You handed the venue your coins, and in return you hold a promise that they will give them back when you ask. Most of the time that promise is good. When it is not, you find out that you were an unsecured creditor the whole time, standing in line behind everyone else with the same promise. So the useful question is not whether an exchange is safe. It is how much unsecured credit you are willing to extend to it, and whether you are getting paid anything to take that risk. Usually you are not.
Once you frame a balance as a loan you did not choose to make, the budgeting gets a lot clearer. You would not lend a random counterparty a third of your net worth with no interest and no collateral just because their app has a nice chart. But that is exactly what a lot of people do by leaving everything on one venue because moving it is annoying.
Treat each venue as a credit line you are extending
Start by writing down, honestly, why any given balance is sitting on an exchange at all. There are only a few good reasons. You are actively trading it. You need margin posted against open derivatives positions. You are parked in something that pays a yield you actually understand and have decided is worth the risk. Or you are mid-transfer. Everything outside those buckets is idle credit you are giving away for free, and idle credit is the first thing to sweep.
For derivatives specifically, the discipline is to keep only the margin the position requires plus a buffer, and nothing more. It is tempting to over-collateralize so you never get a margin call at three in the morning, and a buffer is fine, but a fat buffer is just a larger unsecured loan to the venue sitting there doing nothing. I would rather hold that buffer in self-custody and top up the margin account when a position actually needs it. The top-up takes a few minutes. The over-collateralization can cost you everything if the venue goes down.
Set a hard cap per exchange as a share of net worth
The single rule that has done the most for me is a percentage cap on any one venue, expressed as a share of total net worth rather than a dollar figure. A dollar figure goes stale as your portfolio moves. A percentage travels with you. Where you set it depends on how much you trust the venue and how much you need it operationally, but the point is that the cap exists at all and that you enforce it mechanically instead of by vibe.
A rough tiering I have used:
- Venues I trade on constantly and consider well run get the largest slice, and even then I try to keep it modest as a share of the whole. If losing that balance overnight would change my life, it is too big.
- Second-tier venues, ones I use for a specific pair or region but do not fully trust, get a much smaller cap. Think a slice you could write off entirely and still sleep.
- Anything I am on only because it lists a token I cannot get elsewhere gets the smallest cap possible. Buy, withdraw, done. The exchange is a turnstile, not a vault.
The failure mode this prevents is concentration creep. You open an account for one trade, it works, you leave the funds there, you do it again, and six months later a quarter of everything you own is on a venue you never actually decided to trust. The cap forces that decision to happen on purpose.
Proof of reserves, jurisdiction, and history are inputs, not guarantees
People treat a proof-of-reserves page like a seal of approval. It is better than nothing, but read what it actually proves. A reserves attestation typically shows assets at a moment in time. It usually says much less about liabilities, and almost nothing about whether those assets are pledged, borrowed, or shared with an affiliated entity you have never heard of. A venue can pass a reserves snapshot and still be insolvent the next morning, or the same morning, if the liability side is hidden. Use it as a weak positive signal, not a guarantee.
Jurisdiction matters for a similar reason. What you are really asking is: if this venue fails, whose court decides what happens to my claim, and does that court have any history of protecting people like me? A venue in a place with real custody rules and a functioning legal process is a different risk than one incorporated somewhere you could not find on a map. You are not going to litigate your way to recovery in most cases, but jurisdiction shapes the odds.
Operational history is the input I weigh most, and it is the least quantifiable. How did they behave during the last few bad weeks the market had? Did withdrawals keep working when everyone hit the button at once? Did they freeze, delay, or invent a maintenance window at exactly the wrong time? A venue that processed withdrawals smoothly through a panic has told you something no attestation can. None of these three inputs is a green light on its own. They just move your per-venue cap up or down at the margin.
Automate the sweep so discipline is not a daily decision
People leave too much on exchanges because of friction, not because they think it is safe. Moving funds to self-custody is a small chore, and small chores lose to inertia every time. So take the decision out of the daily flow and put it on a schedule.
Here is the routine I would set up. Pick an interval, weekly or every couple of weeks. On that day, check each venue balance against its cap. Anything over the cap that is not posted as margin or actively in a trade gets withdrawn to cold storage in one batch. Batching matters because it saves on fees and because one deliberate transfer session is easier to actually do than ten scattered ones. Keep a simple record of what each venue holds so you can see concentration creeping before it becomes a problem. If you track balances across venues in one place, whether that is a spreadsheet or something like the Blockcircle scorecard, the sweep becomes a five-minute review instead of a hunt through a dozen apps.
A few guardrails worth writing into the routine. Always send a tiny test transaction to a new withdrawal address before the real one, every time, no exceptions. Whitelist your self-custody addresses on each exchange so a compromised account cannot drain to somewhere new. And do not let the sweep tempt you into holding more in hot self-custody than you can secure well, because trading one counterparty risk for a sloppy key-management risk is not progress.
None of this makes you immune. A determined enough failure will still hurt. What the framework buys you is that no single venue can end you, that the money sitting as unsecured credit is money you chose to lend rather than forgot to move, and that the decision gets made on a calendar instead of in a panic. That is most of what risk management is, honestly. Deciding the boring thing in advance so you are not deciding it while the withdrawals page hangs.