How to Rate a Crypto Exchange's Security: A Methodology

By the Guardian team Updated November 2026 5 min read

Quick answer. Score seven categories on evidence, not claims: custody, withdrawal controls, proof of reserves, incident history, licenses, pentests and bug bounty, and account security. Weight them, cap the grade on any failed gate, and rescore when the facts change.

Watch: How to Rate a Crypto Exchange's Security: A Methodology 1:41

Video transcript

You cannot inspect an exchange, but you still have to compare them. The answer is to score evidence, not claims.

Public ratings weigh different things. CER.live scores pentests and bug bounty, CoinDesk Data weights security at twenty percent, and CertiK estimates reserves.

Every theft ends as a signed transaction, so custody and withdrawals weigh most. Licenses get ten, because a license sets a floor, not a ceiling.

Score each category zero to four. A website claim earns one, a dated document two, a recent independent report three, and four means you can check it yourself.

Then apply three gates: uncovered customer losses, no reserves check against liabilities, or no license for the entity holding your assets. Fail one, and it is Unacceptable.

PCAOB staff warned in 2023 that proof of reserve reports do not constitute an audit. Score a four only if liabilities are included and your balance is verifiable.

For incidents, look back at least three years, not ninety days, and score the response as well as the event.

Rescore after an incident, a license change, a missed reserves proof, or large outflows. Run a full review at least yearly.

Guardian's Risk Monitoring and Ratings applies these principles to your own surfaces, computed from engineer confirmed findings, never a questionnaire.

Read the full methodology, or talk to Guardian about a rating partners can take apart.

Allocators and risk officers keep assets at exchanges they cannot inspect. They still have to compare them.

Public ratings help, but each weighs different things. This is a method you can run yourself: seven categories, weights, the evidence to request and when to rescore.

The weights are our suggestion. Change them to fit your mandate, and keep them in the file with the score.

What Existing Ratings Measure

Three public ratings come up most. Here is how each describes its own method.

Rating	Scale	Security weight	Reserves
CER.live	AAA to E, from 100 points	Pentest and bug bounty, 25 each	A separate certification track
CoinDesk Data Exchange Benchmark	Grades from AA down, 150+ exchanges	Security, 20% of the total	In Transparency, 10%
CertiK Skynet	A score and letter grade	No exchange weights on the pages we read	Estimated from wallets CertiK collected

CER.live scores external checks and submitted documents. It says it is transitioning to CORE3, with “Probability of Loss scoring” replacing its security ratings.

CCData’s old benchmark link now leads to CoinDesk Data, which calls the report “bi-annual”. Its Security category covers certifications, cold storage ratios, key management, hack history and bug bounties.

CertiK launched exchange scores in 2023. Its launch post calls reserve figures “informed estimates rather than definitive amounts” and counts incidents from the last 90 days.

Each is a useful cross-check. A due diligence file needs the evidence behind every input, so build your own score and compare.

Seven Categories and Weights

Every theft ends as a signed transaction. As our exchange security guide shows, the largest exchange losses went through people and signing systems, not broken cryptography.

So custody and withdrawals carry the most weight:

Category	Weight	What earns full marks
Custody and wallet tiers	20	Disclosed cold share, quorum signing, an independent custody report
Withdrawal controls	15	Allowlists, new-address delays, limits enforced at the signer
Proof of reserves	15	Regular proofs that include liabilities, checkable by each user
Incident history	15	Post-mortems published, losses covered, root causes fixed
Pentests and bug bounty	15	Full-scope pentests with retests; a bounty with safe harbor
Regulatory licenses	10	A custody license from a named regulator
Account security	10	Passkeys or security keys, anti-phishing codes, session controls
Total	100

Licenses carry 10 because a license sets a floor, not a ceiling. Account security carries 10 because it protects single accounts, not the whole book.

Score the Evidence, Not the Claim

Score each category from 0 to 4 by the best evidence you hold. Multiply by its weight, divide by 4, and add up the seven.

Score	Best evidence held
0	Nothing disclosed
1	A claim on a website or in a call
2	A dated document from the exchange
3	An independent report from the last 12 months
4	Independent, current and checkable by you

Map the total to a band. We borrow the scale on Guardian’s Capital Allocators page, where it applies to protocol positions.

0-49: Unacceptable
50-69: Elevated
70-84: Acceptable
85-100: Strong

As that page puts it: “A band is a decision, not a grade: what you hold, at what size.”

Then apply three gates. Failing any one puts the exchange in the Unacceptable band, whatever the total.

Customer losses from an incident left uncovered.
No way to check reserves against liabilities.
No license anywhere for the entity holding your assets.

Evidence by Category

Custody and withdrawals

The cold, warm and hot split, and the policy behind it.
Signing quorum, devices, and who can release cold funds.
Allowlists, new-address delays and limits enforced by the signing system.
Any path that reaches the signer outside the withdrawal policy.

Our guide to exchange withdrawal security walks the pipeline from request to signature.

Proof of reserves

PCAOB staff warned in 2023 that proof of reserve reports “do not constitute an audit” and verify assets “at a particular moment in time”.

The procedures “likely do not address” liabilities, the staff added. Score a 4 only when liabilities are included and you can verify your own balance.

Incident history

Look back at least three years, not 90 days. Score the response, not just the event:

A published post-mortem with a root cause.
Customer losses covered, and how fast.
Evidence the root cause was fixed, such as a retest.

Licenses

Name the legal entity that will hold your assets. Find its license on the regulator’s public register, and check that it covers custody.

Pentests and bug bounty

Ask for the latest pentest scope, date and retest results. For the bounty, read the published maximum, the scope and the safe harbor terms.

Our exchange bug bounty benchmark compares the top programs.

Account security

The FIDO Alliance says “passkeys are phishing resistant and secure by design.” A code a person reads and retypes can be captured by a fake site.

So score passkeys or security keys highest, then anti-phishing codes, session lists and address allowlists. For one regulator’s deadline, see the SFC passkey requirement.

Keeping the Score Current

A score is a snapshot. Rescore when any of these happens:

An incident at the exchange, or at a vendor it uses.
A license granted, restricted or withdrawn.
A missed proof of reserves, or a new firm doing the work.
Large outflows from the exchange’s known wallets.
Bug bounty terms cut, or a program closed.
A change of control, or of security leadership.

Run the full review at least yearly. Keep each input’s evidence and date in the file, so the score holds up in front of a committee.

How Guardian Helps

Guardian’s Risk Monitoring and Ratings applies the same principles to a team’s own surfaces: contract configuration and external exposure.

The rating is computed from findings an engineer has confirmed. Nothing is scored on a self-assessment questionnaire, and every deduction opens into the finding behind it.

It is tracked over time, and built to be shown to an exchange, a bank partner or an institutional allocator.

For exchanges and fintech platforms, Guardian pentests the flows that authenticate users, authorize actions and approve withdrawals. A trust center turns that work into one page partners can read.

Frequently Asked Questions

What is a crypto exchange security rating?

A score comparing how well exchanges protect customer assets. Public examples include CER.live, CoinDesk Data’s Exchange Benchmark and CertiK Skynet. Each weighs categories differently, so read the method before relying on a grade.

Is proof of reserves enough to rate an exchange?

No. PCAOB staff warned in 2023 that proof of reserve reports are not audits, cover a single moment and likely do not address liabilities. Score it highly only when liabilities are included and you can verify your own balance.

What matters most in an exchange security rating?

Custody and withdrawal controls, because every theft ends as a signed transaction. Ask who can make the keys sign, and whether anything can reach the signer outside the withdrawal policy.

How often should an exchange rating be updated?

Rescore on triggers such as an incident, a license change, a missed reserves report or large wallet outflows. Run a full review at least yearly; CoinDesk Data publishes its benchmark in May and November editions.

Sources

Give partners a rating they can take apart

Guardian keeps one rating over your contracts and external exposure, with every deduction traced to a finding an engineer confirmed.

Talk to Guardian Explore Risk Monitoring