When a crypto exchange fails

Singapore – When a digital-asset platform stops withdrawing, the first public language is almost always operational. “A wallet issue.” “A backlog.” “A chain congestion.” Sometimes that language is true. Sometimes it is the last ordinary sentence before the firm is an insolvency. The useful question for a customer in Bedok is not which founder flew where. It is: what am I, legally, the morning the withdrawals stop — and does a Monetary Authority of Singapore licence change that answer?

This briefing is a map of claims, not a reconstruction of any one failure and not a recommendation to leave assets on a platform or to take them off. Tokens can be lost in a hack, a fork, a frozen contract or a well-administered liquidation. For the consumer-access rules that apply while the platform is still a going concern, see MAS consumer safeguards on DPT platforms. For the custody fork that exists before any failure, see self-custody versus licensed platforms. The statutory neighbourhood is the regulation hub.

What a customer actually is

On a typical retail platform you do not hold a seed phrase. You hold an account. The screen shows a balance. Behind the screen, the firm is running a treasury: pooled addresses, an internal ledger, a withdrawal queue. What you have, in the first legal approximation, is a claim on the firm for the delivery of a token or a currency.

That claim can be a better or a worse claim depending on how the firm held the assets.

Commingled assets

If customer assets were commingled with the firm’s own property and treated as working capital, customers often stand in the queue with other unsecured creditors. That is the FTX-era picture people remember, even when they remember the wrong details. The estate is a pile. The customers are people with invoices.

Trust and segregation

If customer assets were held on trust and segregated, the starting position is different. Trust property is, in principle, not available to the firm’s ordinary creditors. The liquidator’s first job includes identifying that property and returning it, minus the mess, the shortfall and the cost of the mess. Segregation is the conduct rule that makes this picture possible. It is not a courier service that puts the coins back in your wallet on Tuesday.

Bad books

If the books are bad, neither sentence is clean. An omnibus wallet with no daily reconciliation, a lending desk that “borrowed” customer bitcoin, a treasury that cannot say which chain address is whose — those are the facts that turn a trust argument into years of litigation. A rule that says “keep proper books” exists because failures are decided by books.

A customer who used an offshore app may also be a customer of a foreign entity, in a foreign court, under a customer agreement they clicked through in English and never read. The Singapore licence on a sister company does not automatically pull that estate into a Singapore process.

A screen balance is a claim. A seed phrase is a key. A licence is permission for a firm to carry on an activity. Deposit insurance is a different statute that does not apply to digital payment token balances. Those four objects keep being treated as synonyms. They are not.

What MAS actually requires of licensed DPT platforms

From 2024 into 2025, the Authority turned a long-running policy preference — do not treat customer coins as inventory — into a set of regulations and guidelines that licensed digital payment token service providers must live with.

The legal spine is in the Payment Services Regulations. In substance, assets received from or on account of a customer are to be placed in a trust account, generally quickly after receipt, or returned. Trust assets are not there to pay the licensee’s own debts. A licensee may maintain that account itself or with a safeguarding person. MAS does not insist on an external custodian; it does insist on segregation that would still make sense if an insolvency practitioner arrived on a Monday.

The guidelines (PS-G03) add operational colour that a retail reader can translate:

• Different on-chain addresses for customer assets and for the firm’s own assets, where the firm maintains the trust account itself.
• Controls so that no single person can authorise a customer-asset movement alone.
• Books and reconciliations that identify who is owed what.
• Disclosures about how custody actually works — not a slogan about “bank-grade security”.
• A stated expectation that a large majority of customer tokens sit in cold storage, with the rest justified by genuine withdrawal and settlement needs.

Those measures are meant to facilitate return in a failure. The Authority has said as much in consultation responses. Facilitate is the honest verb. It is not “guarantee”. It is not “the government will top up a shortfall”. It is not the Singapore Deposit Insurance Corporation, which exists for specified bank deposits and does not exist for bitcoin on an exchange.

Safeguarding of money — the Singapore-dollar float a customer might hold to buy tokens later — sits in the older Payment Services Act rules for relevant money, with heavier duties on major payment institutions. Safeguarding of tokens is the DPT-specific cousin. Both are conduct rules. A shortfall can still happen: a hack, an operational error, a token that the chain itself cannot move, a court in another country that has frozen an omnibus address.

Daily reconciliation is the unglamorous control. A firm that cannot say, each day, that customer liabilities match customer assets is not “temporarily behind”. It is already in the story that later becomes an insolvency narrative.

What an offshore book still is

An app that is not licensed to serve Singapore customers is not applying those regulations because you are sitting in Singapore. The customer agreement will name a foreign company. The insolvency law will be that country’s law. The segregation language, if any, will be whatever that regulator required, or whatever the marketing team wrote.

Some of those apps display a Singapore flag, a “regional headquarters”, or a licence number that belongs to a different entity in the group. After the 2025 digital token service provider clarification, a Singapore letterhead without a Singapore customer book is not comfort. It is a warning that the supervised perimeter and the account you opened may not be the same place.

Providing DPT services to customers in Singapore without the appropriate licence is an offence for the provider. This newsroom will not tell a reader whether to use an offshore app. We will say that the trust-account and consumer-access regime described above is a condition of a Singapore licence. It does not attach to a brand, travel because the interface is in English, or apply because the help article mentions MAS.

Recovery, if a failure comes, is then a matter of a foreign estate, a foreign court, and whatever bilateral cooperation exists. That can work. It can also take years and return cents on the dollar. FTX’s public lesson was not that every offshore platform is FTX. It was that a customer who cannot name the entity, the law and the custody arrangement is a customer who has already accepted a story in place of a claim.

FTX-era lessons, without the mythology

FTX collapsed in November 2022. The durable facts, for a Singapore reader, are narrower than the internet’s mythology.

Customer assets were not treated as sacred. They were available to an affiliated trading firm. The books did not survive contact with a run. Customers discovered that a screen balance was an unsecured claim on an estate being assembled in a US bankruptcy court. People who had treated a famous brand as a bank learned that branding is not a trust deed.

What does not follow, and what this desk will not repeat as if it did:

• That every platform failure is a fraud. Firms also fail because they were hacked, because they were incompetent, because a token they listed imploded and took their treasury with it, or because a run hit a genuinely illiquid book. Insolvency law has to handle all of those.
• That a licence would have made FTX’s customers whole. A licence is not a printer of replacement coins. It is a set of duties and a supervisor. Duties can be breached. Supervisors cannot reverse a hole that already exists.
• That self-custody is therefore the only adult option. Self-custody is a different risk register: seed phrases, approval drainers, no password reset. The companion piece exists because that register is real.
• That “not your keys, not your coins” is a legal analysis. It is a slogan that correctly names bearer control and incorrectly implies that a well-structured claim is worthless. Claims are how the rest of finance works. They are only as good as the structure and the books.

The operational lessons that do travel: know the legal entity on the agreement, not the brand on the icon; read the insolvency and custody clauses before you need them; treat overnight balances as a custody decision, including on a licensed platform. A withdrawal backlog can be a technical event. A backlog plus a deleted tweet plus an unavailable founder is a different event. Even then, this newsroom will not tell you to “get out now”. Speed of recognition is operational hygiene, and hygiene is not a trading strategy.

If a failure is real, the next person in the story is a professional — a judicial manager, a liquidator, a foreign equivalent. You may be asked to file a proof of claim and to wait while someone decides whether a wallet is trust property. A licensed Singapore firm should, if the rules were followed, hand that person a set of books. That is a large part of what the safeguarding regime is for. Complaints to MAS remain worth making. The Authority is not a cashier for token prices. It is the supervisor.

A slower conclusion than the genre wants

Platform failure is a legal process wearing an operational costume. Licensed DPT platforms in Singapore are supposed to enter that process with segregated assets, a trust account and books. Offshore platforms enter it with whatever their home law and their habits produced. Neither path makes the token conservative. Neither path is deposit insurance.

Readers who want the going-concern rules should stay with the consumer-safeguards briefing. Readers who want the other custody job should read self-custody versus licensed platforms. Readers who want the statutes in a row should start at the regulation hub.

Nothing here is an invitation to deal, to withdraw, or to deposit. A map of an insolvency is not a plan for your account.