How a centralized exchange works

A centralized exchange looks like a trading screen, but behind it sits a custodian, a bank-like ledger, a payments operation and a risk engine. Most of the losses customers have suffered in this industry came not from bad trades but from failures in these back-office layers, so a professional needs to know how they fit together and where to look when assessing a venue.

Onboarding and account controls

Before anyone can trade, the exchange runs customer due diligence: identity verification, screening against sanctions and politically exposed persons lists, a risk score based on country, occupation and expected activity, and, for companies, identification of beneficial owners. The result decides the account tier, which sets limits on deposits, withdrawals and products such as derivatives or lending.

Onboarding is also where the exchange collects the data it will later need for transaction monitoring, for the Travel Rule when crypto is sent to another provider (covered in the lesson FATF standards and the Travel Rule) and for tax reporting. A weak onboarding process shows up later as frozen accounts, regulator findings and correspondent banks closing the exchange's fiat accounts.

Omnibus wallets and the internal ledger

The most important fact about a centralized exchange is that customer balances are entries in the exchange's own database, not coins sitting in individual blockchain addresses. This database is the internal ledger. When Alice sells 1 BTC to Bob on the platform, nothing happens on the Bitcoin blockchain: the exchange debits Alice's BTC balance and credits Bob's, and does the opposite with the cash leg. Only deposits and withdrawals touch the chain.

Most exchanges hold customer assets in omnibus wallets: a set of addresses that pool the coins of all customers, with the ledger recording who is owed what. The alternative is segregated wallets, where each client's assets sit in addresses dedicated to that client. Segregated wallets are common for institutional custody but expensive to run for millions of retail users, because every movement costs a network fee and every address must be managed.

Because the ledger, not the blockchain, defines each customer's claim, the exchange must reconcile the two every day: total on-chain holdings per asset against total customer liabilities per asset. If customers are owed 50,000 BTC and the exchange controls 49,200 BTC, there is an 800 BTC hole whatever the trading screen shows. Pooling also means pooled losses: after the August 2016 hack of Bitfinex, in which about 120,000 BTC were stolen from its wallets, the exchange applied a 36% haircut to all customer balances, not only to the accounts whose coins had been taken.

The matching engine

The matching engine is the software that pairs buy and sell orders. Almost all exchanges run a central limit order book with price-time priority: the best price trades first, and at the same price the earliest order trades first. Orders that rest on the book add liquidity and are called maker orders; orders that execute immediately against the book take liquidity and are taker orders. Order types and price discovery are covered in the lesson Trading venues, order books and price discovery.

Before an order reaches the book, a pre-trade risk check confirms that the account has the funds and locks them. Because matching and settlement happen in the same database, a trade settles the instant it is matched. This is very different from traditional markets, where a trade is followed by clearing and settlement days later, and it is why an exchange is at once a trading venue, a clearing house and a custodian.

Deposits, withdrawals and confirmation policy

For deposits, the exchange gives each customer a unique deposit address (or, on some chains, a shared address plus a memo or tag that identifies the customer). It watches the chain and, once a deposit is detected, waits for a set number of confirmations before crediting the ledger. Periodically it sweeps deposit addresses into its main wallets.

The confirmation policy is a risk decision. Crediting too early exposes the exchange to a chain reorganization that reverses the deposit after the customer has traded or withdrawn the funds. Small proof-of-work chains are most exposed: Ethereum Classic suffered several 51% attacks in August 2020, in which attackers reversed transactions that exchanges had already credited.

Withdrawals run the other way: the customer requests a transfer, the exchange runs risk checks (address screening, unusual behavior, new device, velocity limits), debits the ledger, and sends the coins from a hot wallet, often batching many withdrawals into one transaction to save fees.

Hot, warm and cold wallets

Exchanges split their holdings by how quickly they can be moved. Hot wallets have keys on internet-connected systems and pay out withdrawals automatically. Warm wallets need some human approval. Cold wallets keep keys offline and require a slow, multi-person process. A common target is to hold only a few percent of each asset in hot wallets, refilled from cold storage as withdrawals drain them.

The split is a trade-off between security and service: too little in hot wallets and withdrawals queue during a busy market; too much and a single compromise can be very costly. How signing policies, quorums and allowlists enforce the split is covered in the lesson Wallet tiers, transaction policy and signing workflows.

How exchanges make money

Revenue matters to risk analysis because it shows where the exchange's incentives lie. A venue earning most of its income from leveraged products, or from lending customer assets, carries very different risks from one earning plain spot trading fees.

Insurance funds and loss buffers

Derivatives exchanges keep an insurance fund to absorb losses when a leveraged position is liquidated at a price worse than its bankruptcy price; if the fund runs out, the exchange uses auto-deleveraging (both mechanisms are explained in the lesson Derivatives: futures, perpetual swaps and options). Some exchanges also keep a reserve funded from trading fees to compensate customers after a hack, and some buy crime insurance, which usually covers only a fraction of hot-wallet holdings and excludes many loss types.

These buffers are only as real as their verification. At the 2023 trial of FTX's founder, co-founder Gary Wang testified that the insurance fund figure shown on FTX's website was generated by multiplying daily trading volume by a random number around 7,500 and dividing by one billion, and did not match the real balance. A professional should treat any self-reported buffer as a claim to be checked, not as a fact.

Exam focus: customer balances on an exchange are internal ledger entries and only deposits and withdrawals touch the chain; omnibus versus segregated wallets and why pooling can mean shared losses (Bitfinex 2016); daily reconciliation of on-chain holdings against ledger liabilities; price-time priority, maker and taker, and instant ledger settlement; confirmation policy as protection against reorganizations, especially on small proof-of-work chains; the hot, warm and cold split as a security-versus-service trade-off; the main revenue lines and the incentives they create; insurance funds and why self-reported buffers need verification (FTX).