How to tell if a crypto exchange is legit: check official registers and warning lists, the real domain and app, withdrawals and the red flags of fakes.
Quick answer: To tell if a crypto exchange is legit, confirm that it is registered or licensed with the financial regulator where you live, check that regulator's warning list, make sure you are on the exchange's real website or official app, and test a small withdrawal before you deposit more. An exchange that guarantees returns, contacted you first, or asks for a fee before you can withdraw is almost certainly a scam.
Two different problems hide behind the question. Some "exchanges" are fake from top to bottom: a website or app built only to collect deposits. Others are real, regulated exchanges whose login pages have been cloned on lookalike domains. The eight checks below cover both.
How to tell if a crypto exchange is legit: 8 checks
1. Find it on the regulator's register where you live
Most major markets now require crypto exchanges that serve their residents to register or hold a licence. Search the official register yourself rather than trusting a licence number or certificate shown on the exchange's own site, because those are easy to fake.
- European Union: under the Markets in Crypto-Assets Regulation (MiCA), crypto-asset service providers need an authorisation. ESMA publishes an interim register of authorised providers, plus a list of non-compliant entities, on its MiCA page. The transitional period that let existing firms operate without a MiCA authorisation ended on 1 July 2026 at the latest.
- United Kingdom: crypto businesses must be registered with the FCA for anti-money-laundering purposes. Search the Financial Services Register and check the name against the FCA Warning List. The FCA also points out that you are unlikely to be covered by the Financial Services Compensation Scheme if a crypto firm fails (FCA).
- United States: exchanges register with FinCEN as money services businesses and, in most states, need a money transmitter licence. Search FinCEN's MSB Registrant Search and the state licence records on NMLS Consumer Access. FinCEN states that a listing is not a "certification of legitimacy" and that it does not verify what businesses submit (FinCEN), so treat a listing as necessary, not sufficient.
- Elsewhere: search your national regulator's register, and check IOSCO I-SCAN, which gathers investor warnings from securities regulators around the world.
Then compare details. The legal name on the register should match the company named in the exchange's terms of service, and the register should list the same website. Scammers sometimes copy the name and registration number of a genuine firm, so a match on name alone is not enough.
2. Search the warning lists
Regulators publish the names they have flagged. Besides the FCA Warning List and I-SCAN, the US Commodity Futures Trading Commission keeps a RED list of foreign firms that appear to need CFTC registration but are not registered. A name on a warning list is a clear stop sign. A name missing from one proves nothing, because new fake platforms appear faster than lists are updated.
3. Make sure you are on the real domain
Clones of well-known exchanges usually sit on domains that add a word such as -login, -verify or -app, swap a letter, or use a cheap ending such as .top or .xyz. Type the address yourself or use a bookmark, and don't trust search ads or links in messages. If a domain looks off, look up its registration date with ICANN Lookup: an exchange that has operated for years will not run its login page on a domain registered last month. You can also paste a suspicious link into our link checker. The common tricks are explained in typosquatting and homoglyph domains.
4. Install the app only through the exchange's own site
Scam platforms often send a direct download link or a "web app" shortcut, and fake trading apps sometimes reach official app stores. Follow the app-store link from the exchange's verified website, and check that the developer name matches the company on the register.
5. Test a small withdrawal first
Fake platforms are built to take deposits, not to pay out. Deposit a small amount, wait, then withdraw it to your own wallet. Stop if the withdrawal is delayed with excuses, or if you are told to pay a "tax", "unlock fee" or "verification deposit" before you can take your money out. The FBI describes this pattern in its 2025 Internet Crime Report: victims are shown fake profits and, when they try to withdraw, are charged taxes and fees before the scammers disappear. Legitimate exchanges publish their fees in advance and take them from the amount you withdraw; they don't ask you to send fresh money to a separate address.
6. Think about how you found it
How you were introduced matters as much as the website. According to the same FBI report, cryptocurrency investment fraud was the largest source of reported losses in the United States in 2025, with 61,559 complaints and $7.228 billion lost. The FBI says these scams typically start with a text message, social media contact, an advert or a dating app, then move to a messaging app where a "mentor" or investment group recommends the platform. If an exchange was recommended by someone you met online, treat that as a red flag on its own. Celebrity endorsements are another favourite, as our guide to fake ads and deepfake investment scams shows.
7. Check who runs it and how support works
A real exchange names its operating company, gives a registered address, publishes terms of service and a fee schedule, and runs support inside its own website or app. Warning signs include no legal entity at all, support only through Telegram or WhatsApp, and an "account manager" who contacts you first and urges you to deposit more.
8. Don't be reassured by surface signals
A polished design, live price charts, a padlock icon and glowing reviews on the platform's own pages cost a scammer very little. The US Federal Trade Commission puts the most reliable test simply: "Only scammers will guarantee profits or big returns" (FTC).
Red flags of a fake crypto exchange
- Guaranteed returns, fixed daily profits or a deposit bonus that "can't lose".
- No entry on any regulator's register, or a registration number that belongs to a different company.
- Withdrawals that require a fee, tax or extra deposit first.
- Support only through a messaging app, or an account manager who pushes you to deposit more.
- A login page that asks for your wallet's recovery phrase. No exchange login needs it.
- A request to connect your wallet and sign a message to "verify" your account, which is how wallet drainer scams empty wallets.
What to do if the exchange turns out to be fake
- Stop sending money. Don't pay any withdrawal fee, tax or "insurance". Each payment is usually followed by another request.
- Collect the evidence: the website address, app name, the wallet addresses you paid, transaction IDs (hashes), dates, amounts and screenshots of your chats. The FBI lists these details as the most useful in its guidance for cryptocurrency scam victims.
- Report it. In the US, file a complaint at ic3.gov and at ReportFraud.ftc.gov. In other countries, see how to report a scam by country. If you sent the funds from a legitimate exchange, tell its support team as well.
- Ignore recovery offers. People who promise to get your crypto back for an upfront fee are usually running a second scam. The FBI recorded 10,516 complaints about recovery scams in 2025, with $1.4 billion in losses.
If you run an exchange: clones of your brand
Every recognisable exchange attracts cloned login pages, fake apps and impersonating support accounts, and its customers are the ones who lose money. The practical defence is to spot lookalike domains early, as described in lookalike domain monitoring, and to get confirmed clones blocked and removed quickly. Phishvoid does this as a managed service: a human team verifies each site, then reports it to Google Safe Browsing, Microsoft SmartScreen, the hosting provider, the registrar and Cloudflare until it is gone.
FAQ
How can I check if a crypto exchange is regulated?
Search the official register of the financial regulator in your country, such as ESMA's interim MiCA register in the EU, the FCA register in the UK, or FinCEN and NMLS Consumer Access in the US. Search by the company's legal name and confirm that the register lists the same website.
Is a crypto exchange legit if its app is in the app store?
Not necessarily. Fake trading apps sometimes get through store reviews. Install the app only through a link on the exchange's verified website, and check that the developer name matches the registered company.
Why does the exchange want me to pay tax before I can withdraw?
That is a hallmark of a fake platform. The FBI describes victims being charged taxes and fees when they try to withdraw, after which the scammers disappear. Don't pay; report the platform instead.
Can I get my money back from a fake crypto exchange?
It is difficult, because crypto transfers can't be reversed. Report quickly with full transaction details, which gives investigators the best chance of tracing the funds, and avoid anyone who charges an upfront fee to recover them.
Is someone impersonating your brand?
We find lookalike domains and cloned pages and take them down. Start with a free exposure scan.