Where to deposit: exchanges & DeFi protocols

The world's largest exchange, licensed in Dubai (VARA) and Abu Dhabi (ADGM), with a SAFU fund of ~USD 1 billion. From 1/7/2026 it stopped Earn and new deposits for EU customers as it lacks MiCA authorisation; the US DOJ is investigating (per Bloomberg, no charges yet).

Monthly proof of reserves (135% ratio), protection fund of ~USD 382 million held in BTC. Only an AUSTRAC registration, no major licence; no MiCA, so it does not accept new EU customers, and it is withdrawing from Japan.

Holds MiCA (Austria) and SCA (UAE) licences. Hacked for USD 1.46 billion in 2025 (the largest in history) but fully covered within ~72 hours, with no interruption to withdrawals. No dedicated user protection fund.

Monthly proof of reserves (verified by Hacken), fully covered the 2020 hack. Its MiCA (Austria) and Thailand licences are both under an operating ban / suspension, so in practice only the AUSTRAC registration remains; Dubai issued a cease order (3/2026). Pleaded guilty in the US in 2025.

A DCG-owned exchange focused on Africa and Southeast Asia: licensed by the FSCA (South Africa), SC (Malaysia), OJK (Indonesia), and BMA (Bermuda); monthly proof of reserves verified by Moore. It has closed accounts in some regions since 1/9/2026.

Holds MiCA (Malta), VARA (Dubai), MAS (Singapore) and multiple US state licences; monthly proof of reserves checked by Hacken. Does not disclose a user protection fund.

Operating since 2013 (formerly Bter), holds MiCA (Malta), VARA (Dubai), registrations in Japan and Australia, and licences in multiple US states. Proof of reserves was irregular in the first half of 2026; compensation for the 2015 and 2018 hacks could not be verified.

A long-established exchange (since 2013), with MiCA (Ireland), a Wyoming SPDI bank, and multiple other licences; quarterly proof of reserves by an independent accounting firm. It has never lost customer funds; Dubai is only a preliminary approval.

Centralised crypto lending platform: Nexo lends out deposited assets, so depositors take on additional credit risk. Published rates are for the Platinum tier (≥10% of the portfolio in NEXO), and the portfolio must exceed USD 5,000 to earn interest. Only an auditor's reserve attestation, no Merkle.

No licence from any major regulator; the Seychelles regulator (where the operating entity is based) took enforcement action for unlicensed activity and said it cannot help recover funds. Has monthly proof of reserves and a USD 100 million Guardian fund.

A US-listed exchange, with BitLicense (New York), MiCA (Luxembourg), and MAS (Singapore). It does not publish proof of reserves, only audited financial statements. It reimbursed scammed customers following the 5/2025 data breach.

Has MiCA (Malta), VARA (Dubai), and MAS (Singapore). There is no current proof of reserves: the only report was Mazars' 12/2022 report. It fully compensated the USD 34 million hack in 2022.

Sanctioned by the UK (5/2026) and banned from trading by the EU from 23/8/2026 under the Russia sanctions package. No licence from any major regulator; the press found proof of reserves that did not match on-chain balances.

The largest lending protocol in DeFi, audited by multiple firms. Two incidents in 2026 (CAPO oracle, bad debt from Kelp's rsETH) were both covered by the DAO and the DeFi United alliance, and markets returned to normal.

Each Compound III market lends only one base asset. It was affected by the collapses of deUSD (11/2025) and rsETH (4/2026); bad positions were liquidated and no depositor losses have been recorded.

A major liquid restaking protocol (eETH/weETH) since 3/2023, audited by multiple firms, with upgrades subject to a 10-day timelock. There have been no incidents involving eETH/weETH; the 9/2026 exploit affected only an old ether.fi Liquid contract, with losses of approximately USD 43 thousand.

JitoSOL liquid staking token on Solana, live since 11/2022, no incidents recorded.

The largest ETH staking protocol (stETH), live since 12/2020, audited by multiple firms. Only a few validator slashing events with very small losses recorded.

Decentralised ETH staking (rETH) since 11/2021; node operators must post a bond. No protocol incidents.

Sky (formerly MakerDAO) has issued DAI/USDS since 2017–2019. The only major incident was "Black Thursday" in 3/2020; DAI holders were not affected.

sUSDS/sDAI savings deposits via Spark, earning the Sky Savings Rate set by Sky governance. No incidents recorded.

A fork of Aave V3 with DAI/USDS liquidity from Sky, live since 5/2023. No incidents recorded; it removed rsETH before the Kelp incident.

USDe is a synthetic dollar (not a cash-backed stablecoin); sUSDe yield comes from perpetual futures funding. No contract incidents; live since 2/2024.

A Solana lending protocol built on the Fluid architecture, launched 8/2025 (over 1 year). No incidents recorded.

A large lending protocol on Solana, live since 11/2023, with no incidents or bad debt recorded.

Unsecured/secured lending to institutions (syrupUSDC/USDT). In 2022 borrower Orthogonal Trading defaulted on USD 36 million in an old pool, and lenders recovered only part.

Liquid SOL staking (mSOL) since 8/2021, no contract incidents. TVL is now about USD 260 million.

Morpho's core contracts have not been exploited; all incidents were in isolated markets/vaults managed by curators (Stream/xUSD 11/2025, USR 3/2026, rsETH 4/2026). Actual risk depends on the vault you choose.

A modular lending vault platform, launched in 8/2024, audited by many firms and offering a bug bounty of up to USD 7.5 million. Third-party curator vaults incurred bad debt from xUSD (11/2025); Euler v1 was hacked for USD 197 million in 2023, but users were fully reimbursed.

A shared liquidity layer for lending, vaults and DEX. Bad debt from the Resolv USR exploit (3/2026) was absorbed by the treasury, the team and Resolv; the reward distribution key leak (5/2026) was small and covered.

Morpho-style isolated lending markets on BNB Chain, launched 4/2025. The Resolv incident (3/2026) was repaid 1:1 with no losses.

The oldest lending protocol on BNB Chain, but it has repeatedly incurred bad debt from price manipulation of illiquid assets; it could not be confirmed that the THE incident (3/2026) has been fully covered.

Aave's new version under a Hub-and-Spoke model, running on Ethereum since 30/3/2026 (Avalanche since 7/2026), audited by multiple firms, with no incidents recorded. The new code is under 1 year old, and initial limits remain low.