Crypto Exchanges Make Buying Coins Easy but Weighing Risks and Fees Hard, Consumer Reports Finds

All of the crypto exchange apps CR evaluated are effective when it comes to enabling the basics of crypto trading. Buying, selling, viewing balances, and other core transactional functions were intuitive and easy to use, with clear transaction flows and notifications when trades were complete. 

“It’s not surprising that these platforms are designed to make trading as easy and seamless as possible,” says CR’s Hand. “That’s central to how they operate and compete. But in a market that’s highly volatile and still evolving from a regulatory standpoint, that ease needs to be matched with clear, accessible information about risks, costs, and protections, so consumers can make informed decisions.”

CR found that during the onboarding and account creation process, none of the exchanges clearly disclosed key risks such as the lack of Federal Deposit Insurance Corporation (FDIC) protection for coins, or provided information regarding the custody arrangement for crypto assets held in wallets managed by the exchange.

These details are important for consumers because in the event of a bankruptcy or hacking theft (both common occurrences in the crypto world), investors may find that their crypto assets have limited protections. Even conventional currency assets (such as U.S. dollars) may be held in pooled accounts at partner institutions, which can make it difficult for consumers to understand whether those funds are eligible for FDIC insurance, or how they would be treated in the event of a bankruptcy or other failure.

Although these risks weren’t clearly disclosed by any of the exchanges during signup, all of them do offer such disclosure in their legal documentation, where CR did find meaningful differences among the exchanges in how they treat customer assets. Gemini stood out for its clear description of a “trust-based” custody structure for cryptocurrency. Trust-based custody models keep investor assets separate from those of the exchange, managed by an outside entity on behalf of customers. 

Disclosure was also inconsistent when using the apps to purchase crypto. Right before a transaction is typically the best time to alert people to the risk of scams and the irreversible nature of crypto transactions because it’s the last possible moment to stop a potentially fraudulent transfer. In CR’s analysis, Binance.US, Coinbase, and Crypto.com alert users to these risks before finalizing the transfer, but only with a single alert box that users could easily dismiss without reading. Kraken did not provide notice of these risks at all in the transfer flow. Only Gemini asks users to agree to multiple acknowledgements of fraud risk before allowing them to proceed to the transfer. 

The risk is significant. According to crypto infrastructure and research firm Chainalysis, crypto investors faced a record $17 billion in losses from scams and fraud in 2025, with impersonation scams surging 1,400 percent. And because criminals can perpetrate these scams from anywhere around the world, your assets can instantly disappear to a jurisdiction where you have no legal recourse. 

All of the exchanges listed prices and fees to users at the point of purchase, but none of them explain in detail what the fees were for or, for many, how they were calculated. Binance.US, for example, discloses a “Binance.US fee,” but if you want to learn how the fee is calculated, you must dig through the company’s support pages, where you’ll learn that “fee calculations differ based on factors such as the digital asset itself, transaction type, payment method, and market conditions such as liquidity and volatility.” Other exchanges, such as Coinbase and Kraken, do allow you to see details about their “Coinbase fee” and “Kraken fee” during the transaction flow, but their explanations have a similar lack of specificity about how they are calculated.

CR’s evaluation also considered how exchanges communicated the “spread”—the difference between the amount you’ll get paid when you sell cryptocurrency and the higher amount you’ll pay when you buy it—to consumers using their apps. Only Coinbase displayed a specific spread value during the transaction (1 percent for the transactions completed during CR’s evaluation). Others, including Binance.US, Crypto.com, Gemini, and Kraken, did not disclose their spreads within the transaction flow, but if you click on their fee explanations, they do acknowledge the possibility that the spread on your transaction could cause the price to change.

“Even when a platform shows a low or zero fee, the spread can still represent a meaningful cost to the user,” says Hand. “Because it’s embedded in the price and not always clearly disclosed, consumers may not realize how much they’re actually paying to complete a trade.”

All the exchange apps support multifactor authentication, which supplements a password with verification via a text message, biometric information such as fingerprints or facial recognition, or an authenticator app. However, Kraken didn’t prompt users to set up multifactor authentication during onboarding in CR’s evaluation. All exchanges required complex passwords except Crypto.com, which required only a six-digit PIN, which doesn’t meet CR’s standards for password strength.

To test for security notifications, CR’s evaluators changed the password or other critical account information for all five apps. All five sent security alerts, although only Binance.US and Coinbase had SMS as an option for security notifications. (Compared with SMS alerts, email or in-app alerts can more easily be missed, particularly in the case of urgent account changes.) Crypto.com and Kraken did not provide any SMS delivery options for security notifications, and we were unable to find any security notification settings in Gemini. Also, only Binance.US and Coinbase give users the option to lock their accounts from within the app in case of any security concerns.

Like other financial service providers, crypto exchanges are subject to certain federal requirements around identity verification and anti-money-laundering controls. Crypto exchanges collect significant amounts of personal and financial data as part of account setup and the “know-your-customer” process required of money service businesses under an amendment to the Bank Secrecy Act, which applies to cryptocurrency exchanges operating in the U.S. Given the sensitivity of such information, experts say it’s critical that financial businesses practice good data privacy hygiene.

Unfortunately, CR’s review of their privacy policies revealed that none of the exchanges fully practices data minimization, a policy whereby institutions purposely limit data collection to that which is absolutely necessary to provide the promised level of service. 

Also, all of the exchanges reserve the right to share data with marketing partners and affiliated companies. Only Coinbase and Kraken make clear commitments not to sell data. 

These kinds of data-sharing arrangements are relatively common for financial services companies, which routinely share data with affiliates and marketing partners, says CR’s Hand. But while traditional financial institutions do so under the Gramm-Leach-Bliley Act, which requires consumer notice and opt-out rights for non-affiliated marketing sharing, crypto exchanges are not subject to the same framework. “Given the sensitivity of the behavioral and asset data they hold, the case for clear disclosure and meaningful consumer controls is especially strong here,” she says.

Ideally, exchanges would give new customers a clear overview of privacy practices during the new-account onboarding phase. However, none of the exchanges did so, and instead offered only links to lengthy privacy policies elsewhere. All the exchanges allow users to adjust how much marketing they receive via the app, but only Coinbase enables users to delete or request access to their stored data from within the app. Other exchanges either didn’t offer such options or required customers to contact customer support.

“The more data a company collects, and the more broadly it is shared, the greater the risk if something goes wrong,” says Hand. “Consumers deserve to understand those trade-offs before they sign up.”

One of the most concerning findings was that all the exchanges used some form of gamification or trading incentive, though the intensity of these tactics varied significantly. Crypto.com’s daily "missions" reward users with points for hitting trading targets; Kraken offers a spin-to-win feature; Binance.US runs "Boost events" tied to specific coins. (Coinbase’s approach—a sweepstakes offering up to $2,000 in bitcoin [BTC] for users who buy $50 in crypto—was more limited but still qualified as a feature designed to encourage trading activity in our evaluation. Gemini also uses a relatively mild form of gamification, offering $10 in BTC for linking a payment method and buying crypto, and using a "celebratory animation" of a rocket ship launching after users make a purchase.)

These features, which are similar to those found in online sports gambling apps, amplify the risk of an already volatile investment. Frequent trading by investors books more fees for exchanges, but it also adds to the overall volatility of crypto trading and can incentivize individual investors to trade more frequently and with less deliberation, amplifying losses and adding a tax burden of short-term capital gains.

“The gamification of digital asset trading is a worrying phenomenon,” says Prasad. “This practice generates revenues for crypto exchanges but with customers often not fully realizing that the costs and risks of frequent trading activity generally outweigh any incentives they receive for such activity.”

When CR offered the exchanges an opportunity to respond to our findings, they expressed a deep commitment to user security, privacy, and transparency, and enumerated specific ways in which their apps address our concerns about those areas. In several cases, they pointed to information, warnings, and disclosures that could be found by clicking on links or reading lengthy terms-of-use or user-education documents. CR’s testing typically credited those materials but gave more credit when critical messages were clearly and prominently presented to the user at key moments, such as during sign-up and immediately before executing a transaction, and could not be easily dismissed without reading.  

Binance.US wrote that it “offers secure and transparent digital assets trading with a focus on compliance and security” and that its customers “benefit from an industry-leading approach to low-fee crypto trading as well as education and scam prevention measures embedded throughout the platform.”

Coinbase wrote that it prioritizes clarity and trust, invests in educational resources and protective guardrails for users (many of which it felt CR’s testing overlooked), gives customers control over their privacy beyond disclosures, and works closely with lawmakers to create a “robust market structure framework.” 

Crypto.com highlighted its scam- and fraud-protection protocols, which include pop-up messages and automated monitoring for high-risk transactions; all-inclusive transaction pricing; and layered security technologies, which includes multifactor authentication for sensitive actions.  

Gemini declined to comment on the record. 

Kraken highlighted ways in which it supports clients though security, transparency, and education, including two-factor authentication tools that deter fraud, third-party verified reports that enable clients to verify their funds are held safely, and educational materials that explain crypto concepts and help users recognize signs of fraud.  

First, let’s start with what experts have consistently told Consumer Reports reporters and researchers: Cryptocurrency is a complex marketplace with high volatility and considerable risk for investors. Before buying crypto assets, do your research and assess your risk tolerance. To help, CR has published several articles explaining the technology, the various ways to invest in it, and the regulatory environment and risks.  

Also, consumers should understand that crypto assets held on exchanges are not protected by the FDIC (the federal insurance program that covers banking deposits) or the Securities Investor Protection Corporation (SIPC), which protects securities such as stock and mutual funds in the case of a brokerage bankruptcy. 

And the risk of fraud, bankruptcies, and large-scale hacks is significant. Exchanges and other crypto trading and lending platforms such as FTX, Celsius Network, and Voyager Digital Holdings have collapsed in recent years, causing consumers to lose money or fight through the bankruptcy process for years to reclaim what they can. Chainalysis research shows that $3.4 billion was stolen from exchanges last year, much of it by North Korea-linked hackers. A lack of federal consumer protection laws makes it unclear what happens to pooled crypto assets in such circumstances—leaving it up to the companies themselves, or to the courts if it comes to that.

Crypto exchanges may not always do a great job explaining these risks, but consumers who are interested in investing with crypto assets can and should study up on them, and treat crypto holdings as a limited, high-risk part of their investment portfolio. 

Investors can also avoid pooled crypto asset exposure by transferring the cryptographic keys to any coins they own into a self-hosted wallet. That insulates your coins from any bankruptcies or hacks of the exchange, but it also makes you solely responsible for the safety and security of your crypto, which raises its own set of issues (you can read more about self-hosted wallets in this CR explainer article). 

Finally, if you’re interested in investing in crypto assets and want the benefit of strong federal regulatory oversight and consumer protections, you can avoid exchanges and spot trading altogether and invest in either crypto ETFs or index mutual funds. These types of funds collect crypto holdings into tradable baskets of coins managed by the fund on behalf of investors, and are offered by many large brokerages, such as Fidelity, Robinhood, and Schwab. These funds are subject to oversight by the Securities and Exchange Commission (SEC) and are protected by SIPC insurance. 

But read carefully what you’re signing up for—many brokerages are starting to set up spot trading operations of their own, which may not be subject to the same protections. So, as always when investing in crypto, pay attention to the fine print.