Crypto Risks Beyond Price: Exchange Failure, Wallets, Seed Phrases, Stablecoins

When people think about crypto risk, they think about price swinging 10% in a day. There is a second group of risks that can lose you money even if price doesn’t move at all: where the coins are, who holds the keys, and what is actually behind the thing you think of as a dollar. This article goes through them one at a time: exchanges, wallets and seed phrases, proof of reserves, Earn accounts, stablecoins, transfer mistakes and approval scams. Then it works out what splitting your money across venues really does, and what it doesn’t. If crypto markets are new to you, start with How crypto differs from Forex.

What “not your keys, not your coins” means

Crypto coins don’t sit inside a wallet. They are balances on a blockchain tied to an address. Whoever holds the private key for that address can send them. That’s the whole rule. There is no bank to call and reverse it.

When you leave coins on an exchange, the exchange holds the keys. The number in the app is what the exchange says it owes you. Exchanges usually pool every customer’s coins in a few large wallets, and your balance is an entry in their database. Normally you can withdraw it. But on the day the exchange runs short of liquidity, gets hacked or is frozen by a regulator, the number in the app doesn’t mean you get the coins back.

If the keys aren’t yours, the coins aren’t really yours. You hold a promise to be paid back, and the promise is only as good as whoever made it.

This isn’t a theoretical worry. Large crypto exchanges have failed several times. The one most people remember happened in late 2022, when a major global exchange stopped withdrawals within days and filed for bankruptcy. Customers waited a year or more in the legal process. In the same year, several crypto lending and deposit platforms froze withdrawals and failed one after another.

Exchange, hot wallet or cold wallet

A hot wallet keeps its keys on a device connected to the internet, such as a phone app or a browser extension. A cold wallet creates and stores the keys offline, for example on a dedicated device (a hardware wallet) that signs transactions inside itself, so the keys never reach your computer.

A common approach is to split by use: money you are trading stays on the exchange, small spending money sits in a hot wallet, and savings you won’t touch for months go in a cold wallet. Two things people forget about cold wallets:

• Buy the device directly from the manufacturer’s own channel. Don’t buy second-hand, and never use a device that arrives with a seed phrase already written down. If someone else wrote the 24 words, they have the keys too
• Check the address on the device’s own screen before you confirm, not on the computer screen, because malware can change what the computer displays

Seed phrase: the whole wallet in a few words

Most modern wallets derive every key from a seed phrase (also called a recovery phrase) of 12 or 24 English words. Anyone with those words can restore the whole wallet on any device and move everything out. Rules worth keeping:

1. Never store it digitally. No photos, no notes app, no chat messages, no cloud
2. Write it on paper or a metal plate. Keep more than one copy in separate safe places, in case of fire or flood
3. Never type it into a website or form. A genuine wallet never asks for your seed phrase on a website. Whoever asks is a scammer, whether they claim to be an admin or support
4. Test a restore before you deposit a large amount. Wipe the device, restore from your written words and check you get the same address. Then you know you wrote it down correctly
5. Think about the people after you. If something happens to you, would your family know the wallet exists and how to restore it, without you revealing the words to anyone now?

Some wallets offer a passphrase (an extra word added to the seed phrase), so that even someone who finds the 24 words still can’t open the wallet. But if you forget the passphrase, you can’t open it either. Every extra layer of protection is also an extra way to lock yourself out.

What proof of reserves proves, and what it doesn’t

After a major exchange failed in 2022, many exchanges began publishing proof of reserves (PoR). It usually has two parts:

• Assets: the exchange publishes its wallet addresses, so anyone can look on the blockchain to see how many coins they hold
• Liabilities to customers: every customer balance is added up in a structure called a Merkle tree. Each customer can check that their own balance is included in the total, without seeing anyone else’s

If the coins in the wallets exceed what is owed to customers, that looks good. But PoR does not prove:

• Other debts, such as money the exchange has borrowed. PoR only counts what is owed to customers, so it isn’t proof the company is solvent, and it isn’t the same as audited financial statements
• Other days. It is a snapshot. Coins could be borrowed to fill the wallets on that day and returned afterwards
• Encumbrances. Coins in the wallets may already be pledged as collateral, and many reports only cover a handful of major coins

PoR is better than nothing, and it lets you check your own balance. Read it as partial evidence, not a guarantee.

Earn and lending: where does the interest come from?

“Deposit coins and earn interest” products (Earn, Lending, Savings) have to get the money they pay from somewhere. Usually they lend your coins to someone else, provide liquidity with them, or stake them. The higher the rate, the more you should ask who is carrying the risk.

The part people skip is the terms of service. Many services state that when you move coins into Earn, ownership passes to the platform and you only hold a claim to be repaid. In the bankruptcy of a large crypto lending platform in early 2023, a US court ruled that the coins in Earn accounts belonged to the company under those terms, so depositors stood as general creditors and didn’t get their own coins back first. Before you deposit, read who owns the coins while they are deposited, and where you stand if the company fails. An unusually high rate is the same warning sign described in Scam red flags.

Three types of stablecoin, and why they depeg

A stablecoin is a token that tries to stay close to 1 dollar. Traders use them to park money between trades, and most perpetual contracts are priced in them (see Perpetual futures and funding). But “close to 1 dollar” isn’t the same as “a dollar”. Losing that 1-dollar level is called a depeg.

Type	Backed by	How the price is pulled back to 1 dollar	Why it can depeg
Fiat-backed	Cash and short-term government debt held by the issuer	Verified customers can redeem 1:1 with the issuer	Reserves fall short, reserves stuck at a troubled bank, issuer suspends redemptions
Crypto-collateralised	More crypto locked up than the value of stablecoins issued	If collateral falls too far, the system sells it	Collateral price drops faster than it can be sold
Algorithmic	Usually not fully backed by assets; a sister token is minted or burned	Incentives for arbitrageurs to swap between the two tokens	Confidence breaks, people rush out, endless minting of the sister token wrecks both prices

Two events worth knowing:

• May 2022: TerraUSD (UST), the largest algorithmic stablecoin at the time, lost its peg and never recovered. The system minted huge amounts of its sister token (LUNA) to absorb redemptions, and both fell to nearly zero within days. This is the “death spiral” that is the weak point of the algorithmic design
• March 2023: USDC, a fiat-backed stablecoin, briefly fell below 0.90 dollars after its issuer disclosed that part of its reserves were held at Silicon Valley Bank, which had failed. Once US authorities announced that the bank’s deposits would be protected, the price returned close to 1 dollar within days

The lesson is that even fiat-backed coins carry the risk of the bank holding the reserves, and small holders usually can’t redeem directly with the issuer, so they have to sell on an exchange at whatever the market price is at that moment. Also, most centralised stablecoin issuers can freeze the coins at a given address when ordered to by authorities.

A simple way to think about the average cost of a depeg is value held × probability × depth you’d have to sell at. A hypothetical example: you hold 10,000 dollars. A 2% chance per year of having to sell at 0.90 costs 10,000 × 0.02 × 0.10 = 20 dollars on average. A coin with a 0.5% chance of ending at 0.05 costs 10,000 × 0.005 × 0.95 = 47.5 dollars. Small averages, but the average says nothing about the year it actually happens, when you lose almost everything. That leads to the main example below.

Worked example: what splitting across venues does (hypothetical figures)

Assume a 10,000-dollar portfolio. Every venue has a 3% chance per year of failing, and if it fails you recover 50% (you lose half of what was there). Both numbers are assumptions to show the mechanics, not statistics for any exchange.

Case 1: everything in one venue

1. Expected loss (the average loss) = 10,000 × 0.03 × 0.5 = 150 dollars per year
2. If that venue fails, you lose 10,000 × 0.5 = 5,000

Case 2: four venues, 2,500 each, failing independently

1. Expected loss = 4 × (2,500 × 0.03 × 0.5) = 4 × 37.5 = 150 dollars, the same as before
2. Chance that at least one fails = 1 − 0.97⁴ = 1 − 0.8853 = 11.47%, higher than with one venue
3. One failure costs 2,500 × 0.5 = 1,250
4. Losing 3,000 or more (30% of the portfolio) needs at least 3 of the 4 to fail. Chance = 4 × 0.03³ × 0.97 + 0.03⁴ = 0.0106%

Split	Expected loss	Chance of any loss	Loss if largest venue fails	Chance of losing ≥ 3,000
One venue 100%	150	3.00%	5,000	3.00%
70 / 30	150	5.91%	3,500	3.00%
50 / 50	150	5.91%	2,500	0.09%
4 venues × 25%	150	11.47%	1,250	0.0106%
4 venues × 25%, shared crisis	150	8.76%	1,250	1.00%

The last row is the one to watch. 2022 showed that failures in crypto spread, because platforms lend to and borrow from each other. Suppose there is a 1% chance per year of a crisis in which every venue fails together (and lower the separate failure chance to 2.02% so each venue’s total chance stays at 3%). The chance of losing 3,000 or more jumps from 0.0106% to 1.00%, roughly 100 times higher. Splitting only protects you against risks that don’t happen at the same time, the same principle as Correlation and portfolio risk.

Splitting across venues doesn’t lower your average loss. It turns “an unlucky year costs half the portfolio” into “an unlucky year costs a smaller piece”, and that is what keeps you in the game.

If you move to holding coins yourself, count your own risk too. Say 5,000 stays on an exchange (3% failure chance, half recovered) and 5,000 goes into your own cold wallet, with a 1% yearly chance that you lose the seed phrase or get tricked, in which case it is all gone. Expected loss = 5,000 × 0.03 × 0.5 + 5,000 × 0.01 × 1 = 75 + 50 = 125 dollars, lower than one venue. But that only holds if your own chance of a mistake really is that low. For someone new who has never tested a restore, it may be higher than they think.

Wrong network, fees and fake addresses

The most common loss isn’t an exchange failing. It’s our own mistakes when sending.

• The same coin can live on several networks. One stablecoin may exist on several blockchains. The deposit address has to match the network you send on. Send on the wrong one and the destination may not support it, and the money may be unrecoverable or cost a fee to recover
• Addresses can look identical across networks. Many networks use the same address format (starting with 0x), so nothing warns you that you picked the wrong network
• Memo or tag. Some coins need a memo or tag code when you deposit to an exchange. Leave it out and the money lands in the exchange’s pool with no record of whose it is
• Network fees (gas). You need the network’s native coin to pay the fee, or you can’t send at all, and fees rise and fall with congestion
• Address poisoning. Scammers send a tiny amount from an address whose start and end match one you use often, hoping you copy the wrong one from your history. Some malware also swaps the address in your clipboard when you paste

The habit that helps most: send a small test amount first every time you use a new address, check the characters at the start, middle and end of the address, and copy it from a trusted source, not from your transaction history.

Approval scams and signatures you can’t read

On blockchains with smart contracts, using a DeFi app often means clicking Approve, which lets that contract pull a particular token out of your wallet. Many apps ask for unlimited approval so they don’t have to ask again. The problem is that the permission stays until you revoke it. If the contract is hacked, or belonged to a scammer from the start, that token can be drained completely without anyone knowing your seed phrase.

Common forms are fake free-token sites (airdrops), sites that look like a real app, or an “admin” who messages you to help, then gets you to sign a message (a signature) that costs no gas but grants permission to spend your tokens. To protect yourself:

• Read the confirmation screen every time. If you see Approve, Permit or Set approval for all on a site you’re unsure of, cancel
• Use a separate wallet for trying new apps, holding only what you can afford to lose
• Check and revoke lingering approvals regularly with a token approval checker you reach by typing its address yourself
• Treat anyone who contacts you first about your wallet as a scammer until proven otherwise

Common mistakes

• Thinking the balance in the exchange app is your coins. It is a claim on the exchange, and only as safe as the exchange
• Storing the seed phrase as a photo or file, and never testing a restore. You find out you wrote it down wrong when the device has already died
• Reading proof of reserves as a guarantee. It doesn’t count all of the company’s debts, and it is a picture of one day
• Using Earn for the high rate without reading the terms. Not realising ownership of the coins has already passed to the platform
• Treating all stablecoins as the same. Each type fails a different way, and both algorithmic and fiat-backed coins have depegged before
• Splitting across venues and thinking the risk is gone. If the venues are connected, one crisis can bring them down together
• Sending a large amount to a new address in one go. No small test first, and no check of the network and memo

None of these risks shows up on a chart, and a Stop loss can’t protect you from them. What you can do is know where each pot of money is, who holds the keys, and how much you’d lose if that place disappeared tomorrow, then keep that number at a level you can live with, the same way you control position size in Crypto position sizing by volatility.