Centralized Exchanges vs DEXs: Custody Risk and What FTX and Mt. Gox Taught

Who holds what

The word "decentralized" is not a safety rating. It moves the risk from the exchange's honesty to your own key management and the code you are interacting with.

Mt. Gox: the first lesson

Mt. Gox was a Tokyo exchange that filed for bankruptcy protection in early 2014\. In its filing it said it had lost nearly all the 850,000 bitcoins it held, 750,000 belonging to customers and 100,000 to the exchange itself. It also said $28 million was missing from its Japanese bank accounts. About a week after the filing, it announced it had found roughly 200,000 bitcoins in an old-format wallet used before June 2011\.

Twelve years later, the creditors' case is still open. The rehabilitation trustee has extended the repayment deadline several times, and the most recent deadline we found is 31 October 2026 (Japan time). The trustee's March 2025 announcement put the holdings at 34,689 BTC and said about 19,500 creditors had already been repaid in bitcoin and Bitcoin Cash. A September 2026 report citing Arkham analytics put the figure at around 34,500 BTC. Check the trustee's site for the current position, because the deadline has moved before.

What Mt. Gox demonstrated is that custody failure is slow as well as expensive. Even for creditors who are repaid, the money arrives years later.

FTX: the second lesson

FTX failed in November 2022\. The US Attorney's Office for the Southern District of New York says Sam Bankman-Fried was found guilty after a month-long trial on seven counts, including wire fraud, conspiracy to commit securities fraud, commodities fraud and money laundering, and was sentenced to 25 years in prison. The DOJ's account is that more than $8 billion of customer funds was stolen, along with more than $1.7 billion defrauded from FTX investors and more than $1.3 billion from Alameda lenders. It also reports a forfeiture order of more than $11 billion. The indictment alleged customers were repeatedly told their deposits would not be used by FTX, which turned out to be false.

The recovery numbers are better than for most failures, and they hide a second problem. The FTX Recovery Trust's March 2026 release reports a fourth distribution of about $2.2 billion, which took the cumulative distribution on Dotcom Customer Entitlement Claims to 96% and convenience claims to 120%. A further distribution was scheduled for 31 July 2026\.

But those percentages are measured against claims that were valued in cash at the time of the bankruptcy filing on 11 November 2022\. In December 2023 The Block reported that bitcoin was around $17,000 then and trading above $42,000. A customer who held bitcoin at FTX is paid a share of the November 2022 dollar value, not a share of the bitcoin. The Block's report said creditors would receive only the November 2022 valuation however much prices rose afterwards, and one creditor pointed out that this clashed with FTX's terms of service, under which customers owned their digital assets.

The lesson is narrower than "exchanges steal". Once your coins are on someone else's balance sheet, your recovery depends on a legal process and on how a court values what you held.

What a DEX changes

Take Uniswap as an example. Its support page says the protocol is defined by immutable, non-upgradable smart contracts on Ethereum, which makes it self-custodial. Users supply token pairs to liquidity pools and receive fees. The prices come from an automated market maker (AMM) instead of an order book.

In that design, your tokens never sit on an exchange's balance sheet. A DEX operator going bankrupt does not strand your wallet. That is the real advantage, and it is a structural one.

The costs are different but real:

A worked example of price impact. The figures are hypothetical and use a simplified constant-product pool with no fees. A pool holds 100 ETH and 300,000 USDC, so the starting price is $3,000 per ETH. You buy 1 ETH. The pool must keep the product of its two reserves constant, so it ends with 99 ETH and 303,030.30 USDC. You paid $3,030.30, which is 1.01% above the starting price. Buying 10 ETH leaves 90 ETH and 333,333.33 USDC, so you paid $33,333.33, an average of $3,333.33 per ETH, which is 11.11% above the starting price. On a thin pool, size costs real money. Order-book exchanges with deep liquidity can fill the same trade with less impact.

• Your keys, your risk. There is no support desk to reset a lost seed phrase or reverse a transfer to the wrong address.
• Contract risk. The code is the counterparty. A flaw in a contract can drain a pool. Not every DEX is built like the example above, so check whether a protocol's contracts can be upgraded.
• Phishing and approvals. Many losses come from signing a malicious transaction, not from the exchange itself.
• Price impact. AMM prices move with trade size.

Both sides can be hacked

Chainalysis data, reported by The Block, shows how theft split in 2025\. Between January and early December 2025, crypto theft totalled over $3.41 billion. The $1.5 billion hack of the exchange Bybit alone accounted for about 44% of the year's losses, and the top three hacks together made up 69%. Private key breaches at centralized platforms accounted for 88% of stolen amounts in the first quarter, while DeFi hack losses stayed comparatively low in that quarter.

At the same time, personal wallet compromises reached 158,000 cases involving at least 80,000 unique victims, with $713 million stolen. So the picture is two-sided. Large exchanges are large targets, and individuals who hold their own keys are targets too, in far smaller amounts per victim.

A practical way to split custody

This article is general information, not personal advice. The pool example uses hypothetical figures.

1. Keep on an exchange only what you are actively trading. Treat the balance as an unsecured claim on a company.
2. Move long-term holdings to a wallet whose keys you control, and learn how to back it up before you need to.3. Test a DEX with a small amount first. Check the contract address from the project's official source, and read what a transaction asks you to approve.
3. Check the size of your trade against the pool. Compare the quoted price with the market price before confirming.
4. Do not rely on proof-of-reserves headlines alone. They show assets at one moment, not what is owed.
5. Know the withdrawal rules and the legal entity before you deposit, and check for a recent history of delays.