The exchange: where you buy, and what happens if it goes down

Hi trader,

last lesson we left off on a sentence that now needs explaining properly: on an exchange the keys are theirs.

If you missed the earlier pieces, keys and wallets is what you need to make sense of this one.

Today we look inside the box. What an exchange actually is, what happens when you click buy, and what happens to your money the day it shuts down. Because it is not a theoretical scenario: it has already happened, more than once, and people lost everything.

Ok, vamos.

The thing almost nobody has clear

An exchange is not the blockchain.

It is a company. With servers, employees, a legal department and, above all, a database.

And that is not a pedantic distinction, because it has an enormous consequence: when you buy on an exchange, nothing happens on the blockchain.

Zero. No row gets written on the public ledger. No network fee. No confirmation to wait for.

Two numbers change in their database: the euro one goes down, the bitcoin one goes up. And the bitcoin it shows you are not “yours”: they are a share of a pile the exchange keeps for all its customers together, and it holds the keys.

Inside, though, it is a real market

And this is where it gets interesting for somebody who trades, because you already know the mechanism.

Inside the exchange there is an order book, exactly like on futures: a list of who wants to buy and at what price, and who wants to sell and at what price.

And there are the two ways of being in the market we covered in the order flow series: there is the one who places a limit order and waits at their price, and the one who sends a market order and pays to get in now.

If that feels familiar it is because it is: it is the exact same dynamic as bid/ask candles, aggressive against passive.

There is also a practical detail worth money, and it has to be stated precisely because it gets told badly out there.

Many exchanges apply two different fees: a lower one for whoever adds liquidity to the book and a higher one for whoever removes it. The jargon calls them maker and taker.

Careful though, because they do not coincide with limit and market. If you place a limit order inside the spread, it executes immediately against the book and pays the expensive fee, exactly like a market order. You only get the cheap fee if your order sits there waiting and somebody else executes against it.

And it is not a universal rule either: on some exchanges, including the most used one in the world, the two fees at base tier are identical, so that advantage does not exist at all. On others the gap is double. Go and look at your own fee table, it is a boring page that tells you what you are actually paying.

Why sending to another user is free

This also explains something that confuses a lot of people.

If you send crypto to somebody on the same exchange, it is often instant and costs nothing. If you send it out, you pay and you wait.

By now you know why: in the first case you are not using the blockchain at all. Two rows are just changing in their internal database, which costs them nothing.

In the second case the transaction really does have to be written on the ledger, and that is where you pay.

Custodial, and what it means for you

The exchange holds everybody’s keys, and it keeps them in two places: some in vaults connected to the internet, so it can serve withdrawals quickly, and most of it in vaults kept offline, far harder to drain.

As long as everything works, this does not concern you at all.

The day it stops working, this is the only thing that concerns you.

What happens if it goes down

Here we get to the serious part, and I will say it without dancing around it.

You are not a depositor. In practice you are much closer to a creditor.

When a bank fails, in Europe there is a deposit guarantee up to a hundred thousand euros. On an exchange that safety net does not exist: no guarantee fund, no compensation scheme, and it is not me saying it, it is the European authorities themselves in a consumer warning.

The European rules that came into force in recent years did introduce a real protection though, and it would be dishonest to leave it out: anybody authorised in Europe is required to keep client crypto separate from its own, so that its creditors cannot get their hands on it if it fails.

It is serious protection, and it did not exist before. But it depends on two things: that the provider really is authorised in Europe, and that it really did follow the rules. If it did not, you find out on the day of the collapse, and at that point you join the queue and wait for a court to decide who gets what, and over how many years.

Outside Europe there is often not even that. In the United States, in 2023, a judge ruled that the crypto deposited by customers of a failed platform belonged to the company and not to them: those customers ended up in line like every other creditor.

And it is not theory.

Mt. Gox, which in 2014 handled most of the world’s bitcoin trading, collapsed losing hundreds of thousands of customer bitcoin. Creditors waited more than ten years to see part of their money again.

FTX, in November 2022, was one of the three largest exchanges in the world, with sports sponsorships and famous faces. It collapsed in a week when it came out that customer money had gone where it should not have. The founder was convicted.

Neither of them looked at risk the day before. That is exactly the point.

And now the detail that can actually save you

When these things happen, the site does not shut down. Something sneakier happens: first they freeze withdrawals, and only then comes the bankruptcy. In between there are days or weeks in which your balance is right there on the screen, you can see it, and you cannot touch it.

It is not an impression, it is the documented sequence of every 2022 collapse: withdrawals frozen on 8 November, bankruptcy filing on the 11th. Another platform froze in June and failed in July, a month later.

So if one day you read that an exchange has “temporarily suspended withdrawals for maintenance”, that is not maintenance. It is the last warning, and it usually arrives when it is already late.

How to choose one, and how to sit on it

I will never tell you which one to use, and be wary of anybody who does it lightly, because they almost always have an affiliate link in their pocket.

Here are the criteria.

Look at where it is regulated. Europe now has a framework of rules for anybody offering crypto services, and we covered it when it came into force, in the piece on MiCA and stablecoins. A provider authorised in Europe is not bulletproof, but it has obligations that one registered on an island does not.

Proof of reserves is not a promise of solvency. Many exchanges publish a check showing how much they hold. Careful though: it shows what they own, not what they owe, and at one precise instant. A company can have the reserves and have debts bigger than the reserves. It is useful, it is not a guarantee.

Turn on two step verification, but with an app, not with SMS. A phone number can be stolen by convincing the mobile operator to move it to another SIM, and it is a scam that has been going on for years.

And above all: keep on the exchange only what you need to operate. The rest you take out, where the keys are yours. This is the practical consequence of all three lessons so far.

Two clarifications though, because people make two opposite mistakes with this advice.

The first: it does not only apply to bitcoin. The balance almost everybody leaves sitting on an exchange is in euros or stablecoins, and the reasoning there is identical, with the added risk of whoever issues the stablecoin. Taking your crypto out and leaving the bulk inside in stablecoins is not securing anything.

The second: taking it out moves the risk, it does not delete it. Outside, the keys are yours, and so are the ways of losing them we saw last week. If you throw away the recovery phrase, there is not even a queue at the courthouse.

What you do from tomorrow morning

Two things, and the first one is a calculation that takes a minute.

Look at how much you have on the exchange and ask yourself: if they shut the site tomorrow morning, would this amount ruin me? If the answer is yes, that amount is too high, no matter how reliable the company seems to you.

Then make a small withdrawal to your own wallet. Not to move the money: to learn the procedure with pocket change, when you are not in a hurry and not scared. The day you actually want to do it will probably be a day when everybody is withdrawing at once, and that is not a good moment to learn.

And since it is the only irreversible thing I am asking you to do, three hard rules while you do it. Copy the address from the wallet, do not type it by hand. Check that the network selected on the exchange is the same one your wallet expects, because sending on the wrong network is the number one way money disappears on a first withdrawal. And after pasting, read the first and last characters again: there is malware that swaps the address in your clipboard while you copy it.

Where we go next time

So far we have talked about infrastructure: the ledger, the keys, the place where you buy. Next time we move on to what is inside, and to the first distinction that matters: bitcoin and ethereum are not two versions of the same thing, they are two different jobs.

Let me close with the thing that convinced me to take out the money I do not use.

It was not fear of a collapse, and it is not distrust of any company in particular.

It was a question I asked myself looking at the screen: if this site does not open tomorrow, what do I have in my hands?

The answer was: a screenshot. And the screenshot is not yours.

Suerte Amigo!

Tiziano Brunno

Tradingblog

---

Disclaimer: purely informational and educational content. It does not constitute financial advice or an invitation to trade. Trading involves the risk of capital loss.