BIS Warning: Cryptocurrency Exchanges Have Become "Shadow Banks"! User Funds Face Unsecured Risks

Bank for International Settlements issues report warning that cryptocurrency exchanges are transforming into “Multifunctional Crypto-asset Intermediaries,” integrating trading, custody, and proprietary functions without regulatory firewalls.

From trading platforms to “all-in-one institutions,” MCIs are blurring financial boundaries

The Bank for International Settlements (BIS), owned jointly by 63 central banks worldwide, recently released a 38-page research report revealing that major global cryptocurrency exchanges are rapidly transforming into “Multifunction Crypto-asset Intermediaries” (MCIs). These entities highly integrate multiple functions such as trading platforms, custody services, proprietary trading, brokerage, and token issuance within a single corporate structure.

The report emphasizes that this operational model runs counter to traditional financial market risk separation principles. In conventional finance, to prevent conflicts of interest and risk spillover, these roles are typically separated into different independent entities with strict firewalls.

However, cryptocurrency exchanges tend to adopt a vertical integration approach, deeply tying customer funds to the platform’s own operational risks. This structure lacks transparency in operations, and without reserve requirements or rules for segregated asset custody, these platforms effectively become “shadow banks” with extremely loose regulation.

The truth behind high yields: user assets become unsecured loans

Major crypto exchanges are actively marketing high-yield products such as “Earn” or “DeFi plans,” packaging them as convenient passive income tools.

The BIS report bluntly states that these financial products are essentially unsecured loans to the platform. When users deposit crypto assets in exchange for returns, the platform often engages in “rehypothecation,” recycling these assets into high-risk activities. These include margin lending, highly leveraged proprietary trading, and market liquidity provision.

Under this mechanism, users often unknowingly relinquish legal ownership or actual control of their assets. If the platform faces a liquidity crisis, users will directly bear the platform’s debt repayment risk and become ordinary creditors at the end of the repayment hierarchy.

Unlike regulated traditional bank deposits, these assets lack deposit insurance protections and are not supported by central banks as lenders of last resort. This cycle of customer assets into high-risk gambles introduces significant instability into the digital asset market.

Lessons from the FTX collapse to the $19 billion flash crash

The crypto flash crash in October 2025 vividly demonstrated the destructive power of leverage feedback loops. Within just 24 hours, driven by macroeconomic shocks, the entire network experienced forced liquidations totaling up to $19 billion. Bitcoin ($BTC) plummeted over 14% in a single day, liquidating approximately 1.6 million traders, and the total crypto market cap evaporated by $350 billion in one day.

The BIS report specifically highlights the collapses of Celsius Network and FTX as typical lessons built on leverage, opaque promises, and lack of risk management. It notes that the crypto ecosystem relies heavily on automated liquidation engines, with trading depth concentrated on a few large platforms.

When market confidence collapses, this structure can trigger severe chain reactions. Moreover, as the crypto market becomes increasingly intertwined with banks and stablecoin issuers, the failure of this shadow banking system could have serious spillover effects on the broader traditional financial industry.

Regulatory lag and hacking incidents: the “infection path” of decentralized finance

The high integration of crypto markets and decentralized finance (DeFi) further amplifies the risk of contagion. A recent example is the KelpDAO protocol attack. Attackers exploited vulnerabilities to mint about 116,500 $rsETH and used it as collateral to borrow large amounts from major lending platforms like Aave, ultimately causing a shortfall of approximately $292 million.

• Related news: Kelp DAO re-pledge protocol hacked! $290 million lost in one hour, understand the incident

These events show that a single protocol’s vulnerability can trigger liquidity crises across the entire ecosystem. Security analyses link this attack to North Korea’s Lazarus Group, which within 1.5 days converted 75,700 ETH into Bitcoin and contributed about $8B in transaction fees to the THORChain platform.

To address these increasingly complex challenges, BIS recommends adopting a dual-track approach combining “entity-based” and “activity-based” regulation. Regulatory agencies still face challenges such as lagging legal frameworks, cross-border cooperation difficulties, and limited regulatory resources. Without effective prudential regulation and international oversight, hidden risks in the crypto market will continue to threaten global financial stability.