5 Questions to Ask Before Using Any New Crypto Platform

5 Questions to Ask Before Using Any New Crypto Platform

A new exchange, lending app or "AI trading" product launches almost every week, and most of them want one thing from you on day one: a deposit. The honest answer to "is a crypto platform safe?" is rarely a clean yes or no. It's a judgement you make from a handful of facts you can actually check. This guide gives you five of them.

We're not going to tell you any single platform is bulletproof. Nobody can. What we can do is hand you the questions that have separated the survivors from the disasters, over and over again. The big collapses of recent years weren't unknowable. The warning signs were there for anyone who stopped to ask.

The scale of the problem is real. The FBI's Internet Crime Complaint Center reported that Americans lost about $9.3 billion to crypto-related fraud in 2024, a 66% jump on the year before, across nearly 150,000 complaints (FBI press release). Older adults were hit hardest, losing roughly $2.8 billion of that total. Those numbers are reported losses from one country's complaint system, so the true global figure is almost certainly higher. The point isn't to scare you off crypto. It's to make the case that five minutes of checking is cheap insurance.

The short version

If you only remember one thing from each question, remember these.

Work through all five before you fund an account. None of them needs technical skill. They need about half an hour and a willingness to walk away if the answers are bad.

1. Who is actually behind it?

Crypto grew out of a culture that prized anonymity, so this question can feel almost rude. Ask it anyway. When you use an exchange or a protocol, you're trusting the people who built it, run it and hold the admin keys, not just the code.

An anonymous team is an unaccountable one. If there's a hack, an exploit or a straight rug pull, there's nobody to name, sue or even call. The Squid Game token in 2021 is the blunt version of this: anonymous developers built a token, watched it spike, then drained it and disappeared with investors' money. There was no team to chase because there was never a real team at all.

Compare that to a project with a public team whose names and reputations are attached to the work. Public founders can still fail you, but they have something to lose, and that changes how they behave.

Here's how to check, in order of effort:

• Find the team page. Does one exist? Are there real names, not just first names and cartoon avatars?
• Verify the people. Search LinkedIn and past projects. A founder with a decade in finance, security or engineering is a different proposition from an account created last month.
• Search their history. Put each founder's name next to words like "scam," "lawsuit" or "rug." If something ugly comes up, read it before you decide.

If the team is anonymous, ask yourself why. There are legitimate privacy reasons to stay pseudonymous in crypto. But a platform asking you to deposit real money is asking for trust, and anonymity and trust pull in opposite directions. Our own Trust Scores explainer walks through how we weigh team transparency against the rest of a platform's profile.

2. How does it actually make money?

"High returns, paid reliably, every month" is the line that has emptied more wallets than any hack. If a platform can't explain where the yield comes from in language you understand, treat the yield as a warning, not a feature. Often, the answer is uncomfortable: the returns are funded by new deposits, which is the definition of a Ponzi scheme.

Two collapses make the lesson concrete.

Celsius Network promised users market-beating yields by lending out their deposits. The strategies behind those yields were opaque and far riskier than customers were told, and when the model broke, depositors were left with catastrophic losses. The founder was later charged with fraud.

Terra and its UST stablecoin were propped up by Anchor Protocol's roughly 20% yield, a rate that was subsidised rather than earned. When confidence cracked in May 2022, UST lost its dollar peg and the linked Luna token entered a death spiral, wiping out about $40 billion of value within days and helping trigger the wider 2022 crash (The Block). Founder Do Kwon was later sentenced to 15 years after pleading guilty to fraud charges; a judge estimated there may have been up to a million victims.

A legitimate platform can tell you, simply, where its money comes from:

• Exchanges earn trading and withdrawal fees.
• Lending protocols take a cut of the interest borrowers pay.
• Staking services earn a commission on the rewards the underlying blockchain pays out.

If the explanation involves "proprietary algorithms," a black box, or a number that never seems to move regardless of the market, slow down. Steady, guaranteed-feeling returns in a market this volatile are a signal that something is being hidden or invented. Be especially wary of services promising to recover funds you've already lost, since many of those are themselves recovery scams targeting victims.

3. Where are your coins really held?

This is the question that separates owning crypto from holding a promise of crypto. When you control your own private keys, you own the asset. When you deposit onto a custodial platform, you own a balance in their database and a claim against the company. Those are not the same thing, and the difference only becomes visible when something goes wrong.

FTX is the case everyone now knows. It collapsed in November 2022 after a wave of withdrawals exposed a roughly $8 billion hole in its accounts; customer funds had been quietly funnelled to its affiliated trading firm. Years of bankruptcy work have since recovered billions, and most creditors are being repaid based on November 2022 dollar values plus interest (Washington Post). That's a better outcome than Mt. Gox's victims ever got, but "you might be made whole years later, at the old price" is not the same as "your money was safe." It never was.

Custody comes in two broad shapes:

If a platform is custodial, your safety question becomes a question about the company: is it regulated, is it insured, what's its track record, and does it publish meaningful proof of its reserves? "Proof of Reserves" attestations help, but they're a snapshot on a chosen day and don't prove the platform's liabilities, so treat them as one data point, not a clean bill of health.

If it's non-custodial, the risk moves to the code. Even holding your own keys won't save you if the protocol's smart contracts have a flaw, or if you're tricked into signing a malicious transaction by a fake browser extension or a phishing site. Our scam warnings hub tracks the live ones.

4. What do independent experts and audits say?

A platform's own marketing exists to sell you. That's not a criticism; it's just its job. Your job is to find the analysis that wasn't paid for by the people who want your deposit.

For any DeFi protocol, an independent security audit is a baseline, not a gold star. Firms like Trail of Bits, OpenZeppelin and CertiK review smart-contract code for vulnerabilities. The badge on the homepage is the least useful part. The useful part is the report: how many issues were found, how serious they were, and whether the team actually fixed them. An audit is a health check on a specific date, not a permanent certificate, and audited protocols still get exploited.

Then widen the net:

• Read critical reviews, not just glowing ones. A good review covers the team, the model, the tech and the trade-offs, not only the upside.
• Check the regulator. In the UK, you can confirm whether a firm is authorised or registered using the FCA's official register. If a firm isn't properly registered, you typically lose access to the Financial Ombudsman and the Financial Services Compensation Scheme, which means little recourse if it fails.
• Search for the complaints. The platform's name next to "scam," "hack" or "withdrawal" will surface Reddit threads and reviews that never appear in the marketing.

Aggregate ratings and trust scores are a useful sanity check on community sentiment, but they can be gamed, so weigh them alongside everything else rather than treating them as the verdict. You can compare what we've found on the platforms we've reviewed across our exchange listings.

5. What's your exit plan?

Before you deposit anything meaningful, know exactly how you'll get it out, and test it. A platform that makes depositing frictionless but withdrawing painful is showing you something important about itself.

What to check before you commit:

• Fees. Are withdrawal fees reasonable, or quietly punishing? Some platforms lure you with low trading fees and recoup it on the way out.
• Limits. Are there daily or monthly caps? They can be a genuine security control, or a sign the platform doesn't have the liquidity to let everyone leave at once.
• Lock-ups. Does earning yield require locking your funds, and for how long? An unexpected lock-up can trap money you needed.
• Process. Is a withdrawal instant and automated, or a multi-day manual approval that can stall whenever the platform chooses?

The single best test costs almost nothing. Deposit a small amount, then immediately withdraw it. You'll see the real fees, the real timing and the real friction before any serious money is on the line. If a tiny withdrawal is slow or sticky, a large one will be worse. Sudden delays or "temporary" pauses on payouts are one of the most reliable early signs that a platform is in trouble, and by the time they're public, the queue is usually already forming.

Putting it together

You don't need all five answers to be perfect. You need them to add up. A public team with a clear business model, real audits, sane custody and clean withdrawals is a different risk from an anonymous team paying suspiciously steady "guaranteed" yields. Most genuinely dangerous platforms fail two or three of these questions at once, which is exactly why running all five catches more than running one.

If you do get caught out despite doing the checks, you're not stupid and you're not alone. These operations are designed to be convincing. Move quickly, document everything, and read our crypto recovery guide before you engage anyone promising to get your money back, because that promise is itself one of the most common second scams.

Frequently asked questions

Is a crypto platform safe just because it's popular or has a slick app?

No. Popularity and a polished interface tell you about marketing budget, not solvency or honesty. FTX and Celsius were both large, well-known and heavily promoted right up until they collapsed. Judge a platform on the five questions above, not on its follower count.

How can I tell if a crypto exchange is legitimate and regulated?

Check the relevant regulator's official register directly. In the UK, use the FCA's firm checker. Confirm the exact legal entity name and registration number on the regulator's own site, not via a link the platform gives you, since fake "regulated" claims and cloned firm pages are common.

What does "not your keys, not your coins" actually mean?

It means that if a platform holds your private keys, you don't directly own the crypto, you own a claim against that company. If the company fails, freezes withdrawals or misuses funds, your access depends entirely on it. Holding your own keys removes that counterparty risk, but it shifts the responsibility for security onto you.

Are audited DeFi platforms safe to use?

An audit lowers risk but doesn't remove it. It's a review of the code at one point in time by one firm, and audited protocols are still exploited regularly. Read the actual report for the number and severity of findings and whether they were fixed, and treat an audit as one input rather than a guarantee.

Why should I make a small test withdrawal first?

Because it surfaces problems while your exposure is tiny. A test deposit and immediate withdrawal shows you the real fees, the real processing time and any hidden friction before you commit serious money. If a small withdrawal is delayed or blocked, that's the clearest signal there is to stop.

Is any crypto platform completely safe?

No, and you should be wary of anyone who says otherwise. Even well-run, regulated platforms carry custody, market and operational risk, and self-custody carries the risk of human error. The realistic goal isn't zero risk. It's choosing platforms whose risks you understand and can live with, and never depositing more than you can afford to lose.