How the Reliability Score earns trust.

Withdrawal reliability (25%) · Proof of reserves (20%) · Regulatory standing (20%) · Security history (15%) · Support quality (10%) · Operational maturity (10%). Composite = weighted sum, 0–100. The two incident components are computed from our curated, sourced incident record; the other four are curated values with published rubrics — each carries its reason and sources on the exchange page.

This score answers one question: how reliably do customers get their money out? It deliberately does NOT measure trading-volume legitimacy — that is what volume-based trust scores (e.g. CoinGecko’s) already do well. The two are complements, not competitors: theirs says the volume is real, ours says the withdrawal works.

Recorded incidents lose weight linearly over 24 months, so the score reflects the exchange of today — a 2022 incident no longer moves the number. The incident timeline below each score keeps the full history visible regardless. Severity runs 1–5; full reimbursement of an incident is curated one severity step lower.

Every negative datapoint must be dated, factual and sourced — incidents of severity 3 or higher are rejected by our pipeline without a source URL. Support quality uses public Trustpilot ratings as a complaint-pattern proxy (imperfect, but uniform and public — and where Trustpilot has suppressed an exchange’s rating over fake reviews, we score conservatively and say so). Where data does not exist, the component says so instead of guessing.

No exchange can pay to change a score. Affiliate links appear, clearly labelled, on exchange pages — they never enter the scoring, and the cost ranking on the True-Cost table never reads the Reliability Score either. Both rules are enforced in code and covered by tests. Scores are information, not recommendations: we show facts, you decide.

Scores recompute daily (decay) and whenever the curated record changes; a snapshot history drives the trend markers. Detection is continuous: we monitor the exchanges’ official status APIs around the clock — confirmed major incidents enter the record after human verification, never automatically (publishing an unverified claim about a named company would violate our own data rules). Found an error or a missing incident? Write to the operator — corrections with sources are applied and dated. Built in Vienna by OptiRisk Consulting e.U.