Crypto Exchange & Digital-Asset Custody Platform
The industry — Securities and commodity exchanges
Base industry report for 5232 →- Establishments · CanadaA
- 65
- Under 10 employeesA
- 62%
- Establishments · USA
- 53
- Employment · USA
- 6,270
- Payroll · USA
- $1.6B
Of 65 Canadian establishments with employees, 62% have fewer than ten — mostly small operators.
Entry signal — what decides who wins here
One thing must be trueEntry turns on a single condition that can be named and tested before much is spent. Clear it and this becomes an execution question; fail it and no amount of operating skill helps.
Raise or borrow the entry ticket, or buy an operator who has already paid it. The barrier is money rather than permission, so it yields to a balance sheet — and an acquisition is usually cheaper than a start.
Measured, not forecast: the share of US establishments opening in one year that were still active later. It counts good operators and bad ones together, which is exactly why it is the honest answer to “what are the odds”. It is for the whole sector rather than this market, and the ten-year figure comes from an older cohort because no younger one has reached ten years.
This is not a probability of success, and it is not a verdict on you. No survival probability is published per market, and inventing one would be worse than saying so. What the bar reads is how much of the outcome sits inside an operator's control: green means the hurdles are ones a better operator clears, red means the binding constraint is capital, an asset or a permission rather than execution. Someone arriving with an advantage this screen did not assume can win a market shown in red.
Companies named in this market · 15
The binding constraint — entry cost + regulatory drag
A crypto platform looks like an exchange with a fatter margin, and the largest listed operator shows both halves of that. Coinbase took $7,181.3M of revenue in 2025 [A], but its fee lines move with coin prices: in Q3 2026 transaction revenue fell 44% to $590.2M as consumer spot volume fell 59%, and staking rewards fell 54% to $85.7M [A]. The steadier line is interest on customers' stablecoin balances ($306.9M in the quarter), and that goes to whoever already holds the balances. The cut is what has to be paid for before the first trade. In Canada a platform must register as an investment dealer and join CIRO (the CSA has ended the interim restricted-dealer route). In the EU it needs MiCA authorisation, and in the US money-transmitter licences plus New York's BitLicense. On top of that, it has to keep customers' coins safe from state-backed thieves. On 29 October 2026 about $6.36B left Binance's wallets, most of it in about 20 minutes [B]. The FBI blamed North Korea, and Binance said it would absorb the loss from company funds, its SAFU reserve and its futures insurance fund. Only a balance sheet that size survives a loss like that. Smaller victims did not get through intact: Mt. Gox's trustee is still repaying creditors, with the deadline now 31 October 2027 [A]; Coincheck was sold to Monex; and WazirX reopened only after a Singapore restructuring. Coinbase's own 10-K says customer assets 'are substantially more than our corporate assets and available insurance' [A]. So the sunk cost is regulatory capital plus a balance sheet able to absorb a tail loss, and licensed platforms change hands cheaply by comparison: Robinhood paid about $224M for Bitstamp and $178M for WonderFi [A]. An entrant can buy a licence for less than it costs to build one, but it still carries the tail risk. Conventional exchanges are covered in 5232-securities-exchange-operation.
Platforms compete for the same coins, liquidity and market makers worldwide; a bitcoin order book in one country is arbitraged against every other. But each platform can serve a customer only where it is licensed, and licences are national or regional: CIRO dealer membership in Canada, MiCA authorisation in one EU state that is then passported, state money-transmitter licences and a BitLicense in the US. The competition is international, while entry happens one jurisdiction at a time.
Who you would be competing with
The operators already at scale here, and whoever is buying these businesses. In most of these industries the competition an entrant meets is local, so this is who sets the terms rather than a list of everyone in the trade.
Financials & market size — sourced
Figures that came from a filing, a results release or reputable reporting, each carrying its evidence tier.
Security incidents: the largest thefts from exchanges and crypto platforms
Ordered by amount at the time of theft. Attribution and cause are given as officially stated, and where official and analyst accounts differ, both are shown. Two rows (Poly Network and Ronin) are DeFi or bridge thefts, not exchanges, and are included for scale.
| Date | Venue | Amount | Attribution | Stated cause | Recovery · sources |
|---|---|---|---|---|---|
| 2026-10-29 | Binance (global; largest exchange by reserves) B | About US$6.36B by TRM Labs (value of each transfer when taken; about $6.23B at later prices), across ten blockchains, most of it in about 20 minutes from 20:05 UTC. Binance: 'estimated total impact' about $6.3B. Chainalysis: $5.912B at the time of theft | FBI: North Korea, activity it calls 'TraderTraitor' (statement of 31 October 2026, reported by NBC News, AFP and CoinDesk; the FBI's own page could not be opened). TRM Labs: TraderTraitor, 'with high confidence'. Chainalysis also tied it to the group. Binance named no culprit | The two accounts differ. Binance first said a compromised DevOps engineer's laptop may have let an attacker into a service container to submit unauthorised withdrawals. It later said it had 'uncovered additional points of breach' and found 'no evidence of any wallet private key leak'. TRM Labs: 'a compromise of Binance's hot wallet signing infrastructure', because wallets on ten chains with different signing schemes all produced valid signatures within about half an hour. Binance has promised a root-cause report | About $3B frozen by Binance's count (TRM counted about $2.7B by 00:30 UTC on 30 October: Tether about 1.77B USDT, Circle about 825M USDC, Ripple 40.5M RLUSD, World Liberty Financial 27.8M USD1, Arbitrum Security Council about $30M). The attacker still held more than 420,000 ETH and 18,270 BTC (about $2.4B), which no issuer can freeze. Binance set aside $6.34B of company funds ($5B already held in the stolen tokens), said 'Binance will absorb the financial impact of the stolen funds, not users', and by 31 October had replenished 90%. Withdrawals were paused and set to resume on Sunday 1 Novembertrmlabs.com · thenextweb.com · cointelegraph.com · cointelegraph.com · cointelegraph.com |
| 2025-02-21 | Bybit (Dubai-based exchange) A | About US$1.5B in virtual assets (FBI). The previous record | FBI: North Korea, activity it calls 'TraderTraitor' (IC3 public service announcement PSA250226). TRM Labs: Lazarus Group | Safe, the multisig wallet provider, said a developer's laptop was compromised. Malicious JavaScript was then served from Safe's infrastructure, not Bybit's (Safe and Mandiant findings, reported by Decrypt) | Bybit offered a bounty of 10% of any assets frozen or recovered (TRM). Rival firms gave bridge loans, and Bybit's CEO said its reserves could cover the shortfall. Kaiko found Bybit's liquidity back at pre-hack levels within 30 days (Cointelegraph). Bybit's own announcements could not be reached from this agentic3.gov · trmlabs.com · decrypt.co · cointelegraph.com |
| 2021-08-10 | Poly Network (cross-chain DeFi protocol, not an exchange) B | About US$610M | An anonymous attacker who returned the funds; no state attribution in the sources opened | Exploit of the protocol's smart contracts (reported); details not re-verified for this record | Fully recovered by 25 August 2021. The attacker handed over the key to the wallet holding the stolen coins, and Tether released 33,431,200 USDT it had frozendecrypt.co |
| 2022-03 | Ronin bridge (Axie Infinity sidechain, not an exchange) B | About US$600M | The US Treasury tied North Korea's Lazarus Group to it by sanctioning an Ethereum address linked to the theft (April 2022, via TRM Labs). The FBI's own statement was not opened | Not re-verified in a primary source for this record | Not sourced for this recordtrmlabs.com |
| 2018-01-26 | Coincheck (Japan) B | 523M NEM, about US$534M at the time | None officially stated in the sources opened | Not re-verified in a primary source for this record (Coincheck's 2018 pages are closed to crawlers by its robots.txt) | Coincheck refunded all 260,000 affected users from its own capital at ¥88.549 per NEM, starting in March 2018. Japan's FSA issued business-improvement notices to eight exchanges. Monex Group bought Coincheck in April 2018cointelegraph.com · cointelegraph.com · cointelegraph.com |
| 2014-02 | Mt. Gox (Japan) C | Widely reported as about 850,000 BTC missing at the collapse. That figure was not re-verified in a primary source for this record | None stated in the sources opened | Not re-verified for this record | Still in civil rehabilitation in Japan. The trustee has moved the deadline for the base, early lump-sum and intermediate repayments from 31 October 2026 to 31 October 2027, and has made repayments in bitcoin and bitcoin cashmtgox.com |
| 2026-09 | Bitget B | About US$352M (Cointelegraph headline) | Bitget's CEO said he suspected North Korea, citing IP clues. ZachXBT reported that funds from the Bitget and Binance thefts were mixed at the same address. No official attribution | Hot wallets (TNW) | Not sourced for this recordthenextweb.com · cointelegraph.com |
| 2024-05 | DMM Bitcoin (Japan) B | 4,502.9 BTC, about US$308M at the time (FBI) | FBI, the US Defense Department's Cyber Crime Center (DC3) and Japan's National Police Agency: North Korea's TraderTraitor (joint statement of 23–24 December 2024) | Per the FBI: social engineering of an employee at Ginco, a Japanese wallet-software company, through a fake recruiter on LinkedIn. The attackers then 'likely used this access to manipulate a legitimate transaction request by a DMM employee' | The exchange then wound down (Cointelegraph: 'DMM Bitcoin exchange liquidates')cointelegraph.com |
| 2024-07-18 | WazirX (India) B | About US$234M (Decrypt). TRM Labs gives US$235M | TRM Labs: North Korean state-sponsored hackers. No government statement was opened for this record | A multisig wallet held under a third-party custody arrangement. WazirX and its custody provider dispute the cause; neither account was verified in a primary source | A Singapore court approved a restructuring scheme. Trading restarted on 24 October 2025, with BitGo as custodian and zero trading fees. Some users reported receiving only about 30% of their funds (Decrypt)decrypt.co · trmlabs.com |
| 2016 | Bitfinex B | Not re-verified for this record | Not sourced | Not sourced | In February 2022 the US Justice Department said law enforcement, including the FBI, had helped seize 94,000 BTC (US$3.6B at the time) linked to the hack (as reported by Cointelegraph)cointelegraph.com |
| 2025-05 (disclosed in an 8-K on 15 May 2025) | Coinbase: 'Data Theft Incident' (customer data, not a wallet theft) A | No crypto taken from Coinbase wallets. Coinbase paid $311.2M in cash during 2025 for voluntary customer reimbursements and direct legal costs | 'A threat actor' (10-K). No state attribution | The threat actor obtained information about certain customer accounts and internal documents and used it for social-engineering attempts | Reimbursements are counted in the $311.2M. Litigation and government investigations are ongoing (10-K)sec.gov |
This is a business and market record, so the table covers losses, attribution, stated causes and recovery only. 'Frozen' means stablecoin issuers or networks blocked tokens on-chain; it is not the same as recovered, and Binance's replacement of stolen coins from its own funds is separate from the frozen amounts. The figures for Mt. Gox and Bitfinex, and the causes for Coincheck, Ronin and WazirX, were not re-verified in primary sources and are marked so in the table.
Market size, derived
Built from the competitor set upward rather than quoted from a forecast. Published TAMs in these categories are frequently reverse-engineered from each other, so any published figure is checked against the vendor arithmetic rather than trusted on its own.
Disclosed revenue from 5 of 15 named vendors. The market is at least this large.
No vendor has both a disclosed revenue and a published share.
Only a revenue floor is known — the true market is larger by whatever the undisclosed vendors earn.
Competitor set · 15 named · 5 disclose revenue
| Name | Revenue | Share | Note |
|---|---|---|---|
| BinanceB | not disclosed | — | Privately held; publishes no audited revenue. $134B total assets by reserves (DefiLlama via Cointelegraph). Lost about $6.36B on 29 October 2026 |
| CoinbaseNasdaq: COINA | $7.2B | — | FY2025 total revenue (10-K) |
| KrakenB | $2.2B | — | 2025 adjusted revenue, company-reported and unaudited (Payward; via Cointelegraph) |
| RobinhoodNasdaq: HOODA | $354M | — | Cryptocurrency transaction revenue, nine months to 30 September 2026 (10-Q); owner of Bitstamp and Coinsquare |
| GeminiNasdaq: GEMIA | $180M | — | FY2025 revenue (10-K); net loss $582.8M |
| BybitB | not disclosed | — | Privately held; no revenue published. Lost about $1.5B in February 2025 (FBI). Holds MiCA authorisation through Bybit EU GmbH (Austria) |
| OKXC | not disclosed | — | Privately held; no revenue opened. MiCA authorisation through OKX Europe Limited (Malta) |
| BitstampA | not disclosed | — | Owned by Robinhood since 2 June 2025 (about $224M); not broken out |
| BitGoNYSE: BTGOA | $28M | — | Subscriptions and services revenue, Q2 2026 (10-Q). Total revenue of $4,329.4M is mostly gross digital-asset sales |
| Anchorage DigitalC | not disclosed | — | Privately held. Anchorage Digital Bank N.A. is a national trust bank chartered by the OCC on 13 January 2021 (its own site). No revenue published |
| FireblocksC | not disclosed | — | Privately held custody and wallet technology sold to exchanges and banks; no revenue published |
| WealthsimpleC | not disclosed | — | Toronto; privately held; crypto revenue not broken out |
| CoinsquareA | not disclosed | — | Coinsquare Capital Markets Ltd. is a CIRO dealer member and a wholly owned Robinhood subsidiary through WonderFi (about $178M, June 2026) |
| NewtonC | not disclosed | — | Toronto; a CIRO dealer member and FINTRAC-registered money services business (its own site); no revenue published |
| NDAXC | not disclosed | — | Calgary; describes itself as a CIRO-regulated platform; no revenue published |
Evidence
Evidence. Tier A, read in filings: Coinbase's FY2025 total revenue comes from its SEC XBRL facts (10-K filed 12 February 2026). The Q3 2026 revenue breakdown, volume changes and assets on platform come from its 10-Q filed 29 October 2026. The hot-wallet policy, crime insurance, BitLicense and money-transmitter text and the $311.2M Data Theft Incident cash cost come from the FY2025 10-K. Robinhood's crypto revenue, crypto notional volume and the Bitstamp (~$224M) and WonderFi (~$178M) purchase prices come from its Q3 2026 10-Q. BitGo's revenue breakdown comes from its Q2 2026 10-Q. Gemini's revenue and losses come from SEC XBRL facts. The MiCA counts are from ESMA's interim CASP register CSV, counted by this agent on 31 October 2026. The Bybit attribution is the FBI's IC3 PSA250226. The Mt. Gox repayment deadline is from the trustee's own site. Tier B: the Binance theft figures, timeline and freezes are from TRM Labs' 29 October 2026 analysis, cross-read against TNW and Cointelegraph. Binance's own statements (laptop, 'additional points of breach', no private-key leak, $6.34B set aside, 90% replenished, SAFU and insurance fund) are as quoted by those outlets; Binance's announcement pages returned a bot challenge and were not opened. The FBI's 31 October attribution of the Binance theft to North Korea was seen only in headlines from NBC News, AFP/France 24, CoinDesk and ABC. Those sites' robots.txt files bar this agent, fbi.gov returned 403, and no IC3 PSA for it was listed when checked, so the FBI's exact wording was not read. Kraken's revenue is company-reported adjusted revenue (via Cointelegraph). The DMM, Coincheck, Poly Network, Ronin, WazirX and Bitget rows rest on Cointelegraph, Decrypt and TRM. Not sourced: Binance's, Bybit's and OKX's revenue (none publish audited figures); any fee-rate comparison; the CIRO application fee; the cost of an insurance policy; the Mt. Gox loss figure and the causes for Coincheck and Ronin. ciro.ca returned 403 and the CSA's authorised-platform list sits behind a firewall challenge, so the Canadian registration rule comes from the 2024 CSA/CIRO joint notice (via bcsc.bc.ca) and the firms' own disclosures. NAICS: 5232 was chosen for the marketplace function; see naicsNote. The Statistics Canada count describes conventional marketplaces and does not measure crypto platforms. The cut factor, and the argument that only a very large balance sheet survives a state-actor theft, are analyst judgment.
Software serving this industry
Vertical software markets filed along the same branch of NAICS — who sells to these businesses, and who an entrant would have to displace.
No vertical software market has been recorded along this branch yet. The base industry report says what the subsector typically runs on.