BIS Warning: Cryptocurrency Exchanges Have Become "Shadow Banks"! User Funds Face Unsecured Risks

The Bank for International Settlements (BIS) released a report warning that cryptocurrency exchanges are transforming into “Multifunction Crypto-asset Intermediaries,” integrating trading, custody, and proprietary functions without regulatory firewalls.

From trading platforms to “all-in-one institutions,” MCIs are blurring financial boundaries

The BIS, jointly owned by 63 central banks worldwide, recently published a 38-page research report revealing that major global cryptocurrency exchanges are rapidly transforming into “Multifunction Crypto-asset Intermediaries” (MCIs). These entities highly integrate multiple functions such as trading platforms, custody services, proprietary trading, brokerage, and token issuance within a single corporate structure.

The report emphasizes that this operational model runs counter to traditional financial market risk isolation principles. In conventional finance, roles are typically separated into independent entities with strict firewalls to prevent conflicts of interest and risk spillover.

However, cryptocurrency exchanges tend to adopt a vertically integrated model, deeply binding customer funds with the platform’s own operational risks. This structure lacks transparency in operations, and there are no requirements for reserves or segregated asset custody, effectively turning these platforms into “shadow banks” with extremely loose regulation.

The truth behind high yields: user assets become unsecured loans

Major crypto exchanges are actively marketing high-yield products like “Earn” or “DeFi plans,” packaging them as convenient passive income tools.

The BIS report bluntly states that these financial products are essentially unsecured loans to the platform. When users deposit crypto assets in exchange for returns, the platform often rehypothecates these assets, recycling them into high-risk activities. These include margin lending, highly leveraged proprietary trading, and market liquidity provision.

Under this mechanism, users often unknowingly relinquish legal ownership or actual control of their assets. If the platform faces a liquidity crisis, users will directly bear the platform’s debt repayment risk and become ordinary creditors at the end of the repayment hierarchy.

Unlike regulated traditional bank deposits, these assets lack deposit insurance protections and are not supported by central banks as lenders of last resort. This cycle of customer assets into high-risk gambles introduces significant instability into the digital asset market.

Lessons from the FTX collapse to the $19 billion flash crash

The crypto flash crash in October 2025 vividly demonstrated the destructive power of leverage feedback loops. Within just 24 hours, due to macroeconomic shocks, the total forced liquidation amount across the network reached $19 billion. Bitcoin ($BTC) dropped over 14% in a single day, liquidating approximately 1.6 million traders, and the total market capitalization evaporated by $350 billion in one day.

The BIS report specifically highlights the collapses of Celsius Network and FTX as typical lessons built on leverage, opaque promises, and poor risk management. It notes that the crypto ecosystem relies heavily on automated liquidation engines, with trading depth concentrated on a few large platforms.

When market confidence collapses, such structures can trigger severe chain reactions. Furthermore, as the crypto market becomes increasingly interconnected with banks and stablecoin issuers, the failure of this shadow banking system could have serious spillover effects on the broader traditional financial industry.

Regulatory lag and hacking: the “contagion pathways” of decentralized finance

The high integration of crypto markets and decentralized finance (DeFi) further amplifies the risk of contagion. A recent example is the KelpDAO protocol attack. Attackers exploited vulnerabilities to mint about 116,500 $rsETH and used it as collateral to borrow large amounts from platforms like Aave, ultimately causing a shortfall of approximately $292 million.

• Related news: Kelp DAO re-pledge protocol hacked! $290 million lost in one hour, understand the incident

These events show that a single protocol’s vulnerability can trigger liquidity crises across the entire ecosystem. Security analyses link this attack to North Korea’s Lazarus Group, which transferred 75,700 ETH into Bitcoin within 1.5 days and contributed about $910k in transaction fee revenue to the THORChain platform.

To address these increasingly complex challenges, BIS recommends adopting a dual-track regulatory approach combining “entity-based” and “activity-based” regulation. Currently, regulators face challenges such as lagging legal frameworks, cross-border cooperation difficulties, and limited resources. Without effective prudential regulation and international oversight, hidden risks in the crypto market could continue to threaten global financial stability.