Will you get your money out? What exchange reliability actually means.

Everything in the score serves a single question: how reliably do customers get their money out? It deliberately does not measure trading-volume legitimacy — volume-based trust scores already do that well. The two are complements: theirs says the volume is real, ours says the withdrawal works.

The composite is a weighted sum of six components, 0–100. Each carries its reason and sources on the venue page:

• 25%Withdrawal reliability — recorded withdrawal halts and freezes, weighted by severity and recency
• 20%Proof of reserves — existence, freshness, auditor, on-chain verifiability
• 20%Regulatory standing — licences and registrations, curated per rubric
• 15%Security history — recorded hacks and breaches; a fully reimbursed hack is curated one severity step lower
• 10%Support quality — public complaint-pattern proxy, scored conservatively where data is suppressed
• 10%Operational maturity — age, scale, documented outage pattern over 24 months

Withdrawal reliability carries the largest weight on purpose — it is the closest proxy for the question the score exists to answer.

Recorded incidents lose weight linearly over 24 months, so the score reflects the venue of today, not of two years ago — a fully decayed incident no longer moves the number at all. The incident timeline below each score keeps the full history visible regardless: the score forgets on schedule, the record never does. Severity runs 1–5; a hack fully reimbursed to users is curated one severity step lower.

A proof-of-reserves attestation shows that assets backing customer balances existed at a point in time. That is genuinely valuable — and it is one component at 20%, not the whole score. What a reserves snapshot cannot show: whether withdrawals actually work under operational stress. Our curated record contains documented withdrawal halts that had nothing to do with solvency — for example, an outage of roughly eight hours including halted withdrawals at Coinbase during the May 2026 AWS thermal event, documented in an official postmortem.

Solvency and operational reliability are different failure modes. A score that collapses them into one badge would miss the more common of the two.

Every negative datapoint must be dated, factual and sourced — incidents of severity 3 or higher are rejected by the pipeline without a source URL. Where data does not exist, the component says so instead of guessing. Corrections with sources are applied and dated. And the hard rule underneath it all: no venue can pay to change a score, and affiliate links — clearly labelled — never enter the scoring.

To the Reliability Scores → · full methodology