The short answer
- What Crypto.com documents
- All user crypto held offline in cold storage, a long list of security certifications, 2FA for withdrawals and a 24-hour lock on new withdrawal addresses.
- The limits
- Mostly its own statements, a proof-of-reserves report from 2022, a discretionary protection policy, and a withdrawal pause after unauthorised activity in January 2022.
- What depends on you
- Keeping 2FA and the withdrawal lock on, which addresses you whitelist and whether you can tell real support from a scam.
Crypto.com in the United States
- The App is available in 49 states, Washington, D.C. and US territories. New York is the only state where it is not available.2 sources
Shown for your selected market. Other countries
Crypto.com in the United Kingdom
- Foris DAX UK Limited is registered with the FCA under the Money Laundering Regulations for cryptoasset services. Crypto.com notes that cryptoassets themselves are not regulated by the FCA, and some App products come from other group companies.1 source
Shown for your selected market. Other countries
Crypto.com in Canada
- App and Web services in Canada are provided by Foris DAX CAN ULC, registered as a restricted dealer in each province and territory under terms set in a decision of 8 May 2025.2 sources
Shown for your selected market. Other countries
Crypto.com in Brazil
- Not verified yetThe Brazilian terms we could read (24 April 2026) name Foris DAX BR Ltda. for App and Web services; the closure notice says the terms were updated since, so the current structure is not yet confirmed.2 sources
Shown for your selected market. Other countries
Documentary research from Crypto.com’s own pages. We have not opened an account or tested the product.
How Crypto.com stores your crypto
When you hold crypto in the Crypto.com App, Crypto.com holds the private keys for you. On its US App page it states that 100% of user cryptocurrencies are held offline in . That is the company’s own statement, not an independent audit.1 source
Crypto.com lists ISO/IEC 27001:2022, ISO 22301:2019, ISO/IEC 27701:2019, PCI DSS v4.0 Level 1 and SOC 2 Type II, a Tier 4 assessment against the NIST Cybersecurity and Privacy Frameworks, external audits by firms such as Kudelski Security and a HackerOne bug bounty.1 source
Its report, by Mazars and dated 9 December 2022, covered selected assets as of 7 December 2022. It is a point-in-time check of limited scope, not a guarantee of solvency.1 source
The documented facts behind this section (2)
- CustodyOn its US App page, Crypto.com states that 100% of user cryptocurrencies are held offline in cold storage. This is the company’s own statement, not an independent audit.Source: Crypto.com App (US page)
- Certifications and auditsCrypto.com lists ISO/IEC 27001:2022, ISO 22301:2019, ISO/IEC 27701:2019, PCI DSS v4.0 Level 1 and SOC 2 Type II, a Tier 4 assessment against the NIST Cybersecurity and Privacy Frameworks, external audits by firms such as Kudelski Security and a HackerOne bug bounty.Source: Crypto.com security page
Is crypto on Crypto.com protected?
Crypto.com treats cash and crypto differently, and its cover for crypto is a goodwill policy rather than insurance. Read the conditions before relying on it.
| What Crypto.com says | The catch | |
|---|---|---|
| App protection policy (crypto) | Goodwill protection of up to USD 250,000 equivalent for eligible unauthorised losses | Discretionary, with conditions; Prime users only in the US and Canada; authorised scams excluded |
| US dollar balances | Held at Community Federal Savings Bank or other FDIC-member banks | FDIC cover up to $250,000 applies only if the bank fails, and never to crypto |
The documented facts behind this section (3)
- App protection policyCrypto.com describes a goodwill protection of up to USD 250,000 equivalent for eligible unauthorised losses, with conditions and exclusions; in the US and Canada it applies to Prime users only, and scams where you authorised the transfer are excluded.Source: Crypto.com App protection policy (Crypto.com Help)
- Proof of reservesAn agreed-upon-procedures report by Mazars, dated 9 December 2022, covered selected assets (including BTC, ETH, USDC and USDT) as of 7 December 2022. It is a point-in-time check of limited scope, not a guarantee of solvency.Source: Proof of reserves report (Mazars, Dec 2022)
- USD balancesUS residents’ USD balances are held at Community Federal Savings Bank or other FDIC-member network banks, insured up to $250,000 in aggregate only if the bank holding them fails. FDIC insurance does not cover crypto.Source: Crypto.com security page
How to lock down your Crypto.com account
- 1Sign-inYour login on a trusted device.
- 22FA codesSix-digit codes for withdrawals and whitelisting on untrusted devices.
- 3Whitelisted addressesWithdrawals go to addresses you have added.
- 424-hour lockHolds withdrawals to new addresses; switching it off also takes 24 hours.
Crypto.com uses time-based six-digit codes for actions that affect your assets, such as crypto and fiat withdrawals and whitelisting addresses; once enabled, 2FA is mandatory for those transactions on an untrusted device.1 source
An optional 24-hour lock holds withdrawals to newly whitelisted addresses. Crypto.com recommends keeping it on, and switching it off takes effect only after 24 hours. The protection policy also expects security features like these to be on, so they matter twice.2 sources
Account checklist
- Turn on 2FA with an authenticator app and keep the recovery code offline
- Keep the 24-hour withdrawal lock switched on
- Whitelist only addresses you control or know well
- Never share login details, MFA codes or a recovery phrase with anyone
- Contact Crypto.com only through the app or its official help centre
The documented facts behind this section (2)
- Withdrawal lockAn optional 24-hour lock holds withdrawals to newly whitelisted addresses; Crypto.com recommends keeping it on, and switching it off takes effect only after 24 hours.Source: 24h withdrawal lock (Crypto.com Help)
- 2-step verificationCrypto.com uses time-based 6-digit 2FA codes for actions that affect your assets, such as crypto and fiat withdrawals and whitelisting addresses; once enabled, 2FA is mandatory for those transactions on an untrusted device.Source: How to set up Crypto.com App 2FA (Crypto.com Help)
Scams and the 2022 incident
Crypto.com will never ask for1 source
- Your login credentials
- Your private keys
- MFA codes
- Your recovery phrase
Crypto.com says no one from the company will ever ask for these, whatever channel you use to contact it.1 source
In January 2022 Crypto.com paused withdrawals after unauthorised activity. Its own monthly roundup lists press reports of about US$34 million taken from roughly 400 accounts and says it added the 24-hour withdrawal lock that month.1 source
We could not find Crypto.com’s own incident report online, so the January 2022 figures above are press reports, not confirmed by us.
- Not verified yetJanuary 2022 incidentIn January 2022 Crypto.com paused withdrawals after unauthorised activity; its own monthly roundup lists press reports of about US$34 million taken from roughly 400 accounts and says it added the 24-hour withdrawal lock that month. We could not find Crypto.com’s own incident report online, so the figures are not confirmed here.Source: Crypto.com: January 2022 Updates
The documented facts behind this section (2)
- ScamsCrypto.com says no one from the company will ever ask for your login credentials, private keys, MFA codes or recovery phrases, whatever channel you use to contact it.Source: All about: Data Privacy (Crypto.com Help)
- Not verified yetJanuary 2022 incidentIn January 2022 Crypto.com paused withdrawals after unauthorised activity; its own monthly roundup lists press reports of about US$34 million taken from roughly 400 accounts and says it added the 24-hour withdrawal lock that month. We could not find Crypto.com’s own incident report online, so the figures are not confirmed here.Source: Crypto.com: January 2022 Updates
The App vs the Onchain wallet
Crypto.com offers two very different ways to hold crypto, and the risks sit in different places.1 source
| Crypto.com App | Crypto.com Onchain | |
|---|---|---|
| Who holds the keys | Crypto.com | You |
| Crypto.com account needed | Yes | No |
The documented facts behind this section (1)
- App vs Onchain walletThe Crypto.com App is a custodial brokerage: Crypto.com stores your crypto and you do not control the private keys. Crypto.com Onchain is a separate, user-custodied wallet: you hold the keys, need no Crypto.com account, and pay network fees.Source: Differences between the Crypto.com App and Onchain (Crypto.com Help)
How Crypto.com compares with Coinbase and Kraken
The three exchanges document their safeguards differently. This table only sets side by side what each one says on its own pages; it is not a ranking.
| Crypto.com | Coinbase | Kraken | |
|---|---|---|---|
| Cold storage | 100% of user crypto offline (US App page)1 source | Over 99% of customer assets1 source | Uses cold storage and hot wallets; no share stated1 source |
| Two-factor authentication | 6-digit codes required for withdrawals and whitelisting1 source | Required to access the account; security keys rated highest1 source | Passkeys (recommended) or an authenticator app2 sources |
| New withdrawal addresses | Optional 24-hour lock on new whitelisted addresses1 source | Optional allowlist: new addresses wait 48 hours1 source | Email confirmation; optional Global Settings Lock2 sources |
| Reserves and accounts | Proof-of-reserves report by Mazars (Dec 2022)1 source | Audited financial statements filed annually with the SEC1 source | Proof-of-reserves check by an accounting firm (post of Nov 2022)1 source |
| Support never asks for | Login details, private keys, MFA codes, recovery phrase1 source | Password, 2-step codes, seed phrase1 source | Password, 2FA codes, seed words, Master Key1 source |
Is Crypto.com regulated?
Crypto.com serves each market through a different local company. A registration covers specific activities and is not a guarantee against loss. We have not yet confirmed the US entity from the current US terms, and the Brazilian structure is pending after the BRL account closure.
United States Your selected market
- The App is available in 49 states, Washington, D.C. and US territories. New York is the only state where it is not available.2 sources
United Kingdom Your selected market
- Foris DAX UK Limited is registered with the FCA under the Money Laundering Regulations for cryptoasset services. Crypto.com notes that cryptoassets themselves are not regulated by the FCA, and some App products come from other group companies.1 source
Canada Your selected market
- App and Web services in Canada are provided by Foris DAX CAN ULC, registered as a restricted dealer in each province and territory under terms set in a decision of 8 May 2025.2 sources
Brazil Your selected market
- Not verified yetThe Brazilian terms we could read (24 April 2026) name Foris DAX BR Ltda. for App and Web services; the closure notice says the terms were updated since, so the current structure is not yet confirmed.2 sources
Is Crypto.com safe?
Crypto.com documents several safeguards: it says all user crypto is held offline in cold storage, lists certifications such as ISO/IEC 27001 and SOC 2 Type II, and offers 2FA and a 24-hour lock on new withdrawal addresses. But these are largely its own statements, its proof of reserves dates from 2022, its protection policy is discretionary and conditional, and it paused withdrawals after unauthorised activity in January 2022. Your own account security matters as much.7 sources
Is Crypto.com legit?
Crypto.com serves customers through registered local companies, such as Foris DAX UK Limited, registered with the FCA under the Money Laundering Regulations, and Foris DAX CAN ULC, a restricted dealer in Canada. Being legitimate does not make it risk-free; see the protection and scam sections above.3 sources
Is my crypto insured on Crypto.com?
Not by government deposit insurance. Crypto.com describes a goodwill protection policy of up to USD 250,000 equivalent for eligible unauthorised losses, with conditions; in the US and Canada it applies to Prime users only, and authorised scams are excluded. US dollar balances at partner banks are FDIC-insured up to $250,000 only if the bank fails.2 sources
Has Crypto.com been hacked?
In January 2022 Crypto.com paused withdrawals after unauthorised activity. Its own January roundup lists press reports of about US$34 million taken from roughly 400 accounts. We could not find Crypto.com’s own incident report online, so we do not confirm the figures.1 source
Is the Crypto.com Onchain wallet the same as the App?
No. The App is custodial: Crypto.com stores your crypto and you do not control the keys. Onchain is a separate self-custody wallet: you hold the keys, you do not need a Crypto.com account and you pay network fees.1 source
Sources
Every platform fact on this page comes from these official pages. Each “sources” marker on this page links to pages from this list.
help.crypto.com
- US states where the App is available (Crypto.com Help)
- Crypto.com App geo-restrictions (Crypto.com Help)
- Encerramento da Conta em BRL (Crypto.com Help)
- Crypto.com App protection policy (Crypto.com Help)
- How to set up Crypto.com App 2FA (Crypto.com Help)
- 24h withdrawal lock (Crypto.com Help)
- All about: Data Privacy (Crypto.com Help)
- Differences between the Crypto.com App and Onchain (Crypto.com Help)
crypto.com
kraken.com
help.coinbase.com
support.kraken.com
blog.kraken.com
How we research · Educational content, not investment advice. Cryptoassets are high risk and you could lose all the money you invest. Rules and availability vary by country.
