How Crypto Exchanges Actually Work: Where Your Coins Really Are
The balance on your exchange screen feels like coins sitting in your wallet. It is not. An exchange balance is a number in the exchange's internal ledger, not a blockchain record. Understand this structure and you will never look at exchanges the same way.
What happens inside
A centralized exchange (CEX) runs on three layers.
- The order book: buy and sell orders stack by price while a matching engine executes thousands per second. None of these trades touch a blockchain. Only ledger numbers change.
- The internal ledger: a database of member balances. However heavy the trading, there is no on-chain transfer, which is exactly why trading is fast and cheap.
- Custody wallets: the actual coins deposited by all members sit commingled in a small set of exchange-controlled wallets, hot and cold. These are the addresses on-chain analysts label "exchange wallets."
A real on-chain transfer happens only when you hit withdraw. Trading is bookkeeping; withdrawal is the only real movement.
The risk in this design: what FTX demonstrated
Ledger and custody being separate means the ledger can show coins that custody does not hold. In 2022 FTX misused customer deposits and collapsed, showing the world exactly what "numbers without coins" looks like.
The industry response that became standard is proof of reserves (PoR).
What proof of reserves proves, and what it cannot
PoR typically has two halves.
- Proof of assets: the exchange discloses custody addresses or proves ownership by signing, verifiable by anyone on-chain.
- Proof of liabilities: member balances are committed into a Merkle tree, letting each user verify their balance is included in the total.
Together they show that assets matching ledger liabilities existed at the verification moment. The limits are just as clear.
- Snapshot problem: valid only at that instant; borrowed coins could theoretically dress up the moment.
- Hidden liabilities: debts that live off-chain never appear in a Merkle tree.
- Who verifies: self-published attestations without external auditors carry less weight.
By 2026, major jurisdictions moved beyond disclosure to mandated segregation: MiCA in Europe requires segregated client assets, and Korea's investor-protection law imposes segregated custody and cold-wallet ratios.
What a user should actually check
- Which regulatory regime the exchange operates under, and whether client-asset segregation is required there
- Whether PoR is published regularly and with external verification, and how recent the last one is
- Any moment withdrawals become slow or conditional - the single strongest warning sign there is
- If large funds have no reason to sit on an exchange, keep only trading capital there and move the rest to self-custody
Summary
An exchange balance is a promise in a ledger; withdrawal is the promise being kept. PoR and segregation rules made the promise more credible, but a promise still is not possession. Trade on exchanges, store in your own wallet. That division of labor is the post-FTX common sense.