Is Crypto.com Exchange safe to connect?
Exchange ยท Multi-asset centralized exchange (spot, futures, margin). Checked 2026-10-25; every line links its source.
Worst case: Crypto.com holds your coins and its terms let it freeze assets or cut access 'for any reason' during reviews; a Malta arbiter upheld a freeze that had lasted about a year without an explanation to the user.
Safe setup in 3 steps
- Restrict every API key to your server's IP and give bots only read and trading rights
- Use crypto.com/exchange (not the App) only if you need it, and verify app listings are published by Foris DAX
- Keep only active trading balances on the Exchange and withdraw the rest to your own wallet
What it can do with your money
| Who holds the keys | The exchange holds your funds Custodial; the EU entity Foris DAX MT is authorised for custody under MiCA. source |
|---|---|
| Can funds be sent out to any address? | Yes. Withdrawals available, but terms allow freezing assets and refusing transactions. source |
| Can it hold or freeze your funds? | As quoted in a Malta Financial Arbiter decision (2025-06-20): Crypto.com (Foris DAX MT) Terms of Use clause 2.3 reserve the right to suspend, restrict or terminate access to any or all services, including on suspicion of money laundering, fraud or other financial crime or pending investigation; clause 15.1 allows freezing digital assets, refusing or reversing transactions 'for any reason'. In that case a user's account had been restricted since 2024-06-17 and Crypto.com said regulatory reasons prevented releasing funds or more information; the Arbiter declined to order release. In 2026 Crypto.com told BeInCrypto it 'may place restrictions on accounts while such reviews are ongoing'. No maximum duration is stated. source |
| What a leaked API key can do | Third-party integration guides only: keys have per-key restrictions ('Can Read' on by default, 'Enable Trading' optional) and an IP access restriction setting ('Restricted to certain IPs'). How withdrawal permission and expiry work was not confirmed from Crypto.com's own docs. source |
| Monero and Zcash | XMR: not listed source source |
Official links
- Website:
crypto.com - X:
@cryptocom - App:
https://apps.apple.com/app/crypto-com-exchange/id1569309855
Where we confirmed these
Deadlines
- 2027-07-10: EU AMLR (Regulation (EU) 2024/1624, Art. 79(1)) applies: crypto-asset service providers may not keep accounts that allow anonymisation or obfuscation of transactions, including through anonymity-enhancing coins (e.g. XMR, ZEC). Relevant if you use this service through its EU-licensed entity (Foris DAX MT Limited, Malta; MiCA authorisation 2025-01-27: https://crypto.com/de/company-news/mica-change-in-license). source
Incidents
| Date | What happened | Amount | Outcome | Source |
|---|---|---|---|---|
| 2026-08-13 | Reported by a user (BeInCrypto staff member): Exchange account suddenly inaccessible ('401 Unauthorized'), support first called it 'rejected' then said no account existed; funds still not returned after ~8 days | unresolved at publication (2026-08-21); Crypto.com asked for a withdrawal address | source | |
| 2025-09-19 | Bloomberg reported a previously undisclosed pre-2023 breach by a Scattered Spider member via a phished employee account; Crypto.com said a 'very small number' of people's personal data was affected and no funds were accessed | no customer funds lost (per Crypto.com) | source | |
| 2025-06-20 | Malta Financial Arbiter rejected a user's request to order release of an account blocked since 2024-06-17, finding Crypto.com acted within its terms | funds not released by order | source | |
| 2025-01-28 | Crypto.com told EU users it would delist USDT and nine other non-MiCA-compliant tokens (purchases suspended 2025-01-31, full delisting 2025-03-31); unconverted holdings auto-swapped | forced conversion for EU holders | source |