BIS Warning: Crypto Exchanges Have Become "Shadow Banks"! User Funds Face Unsecured Risks

Bank for International Settlements issues report warning that cryptocurrency exchanges are transforming into “Multifunctional Crypto-asset Intermediaries,” integrating trading, custody, and proprietary functions without regulatory firewalls.

From trading platforms to “all-in-one institutions,” MCIs are blurring financial boundaries

The Bank for International Settlements (BIS) recently released a 38-page research report revealing that major cryptocurrency exchanges worldwide are rapidly transforming into “Multifunction Crypto-asset Intermediaries” (MCIs). These institutions, under a single corporate structure, highly integrate multiple functions such as trading platforms, custody services, proprietary trading, brokerage, and token issuance.

BIS, owned jointly by 63 central banks globally, emphasizes that this operational model runs counter to traditional financial market risk isolation principles. In conventional finance, roles are typically separated into different independent entities with strict firewalls to prevent conflicts of interest and risk spillover.

However, cryptocurrency exchanges tend to adopt vertical integration, deeply tying customer funds to the platform’s own operational risks. This structure lacks transparency in operations, and is not subject to reserve requirements or asset segregation regulations, effectively making these platforms a form of “shadow banking” with extremely loose regulation.

The truth behind high yields: user assets become unsecured loans

Major crypto exchanges are actively marketing high-yield products such as “Earn” or “DeFi plans,” packaging them as convenient passive income tools.

BIS reports bluntly state that these financial products are essentially unsecured loans to the platform. When users deposit crypto assets in exchange for returns, the platform often engages in “rehypothecation,” recycling these assets into high-risk activities. These include margin lending, highly leveraged proprietary trading, and market liquidity provision.

Under this mechanism, users often unknowingly relinquish legal ownership or actual control of their assets. If the platform faces a liquidity crisis, users will directly bear the platform’s debt repayment risk and become ordinary creditors at the end of the repayment hierarchy.

Unlike regulated traditional bank deposits, these assets lack deposit insurance protections and are not supported by central banks as lenders of last resort. This cycle of customer assets into high-risk gambles introduces significant instability into the digital asset market.

Lessons from the FTX collapse to the $19 billion flash crash

The crypto flash crash in October 2025 clearly demonstrated the destructive power of leverage feedback loops. Within just 24 hours, impacted by macroeconomic shocks, the entire network experienced forced liquidations totaling up to $19 billion. Bitcoin ($BTC) dropped over 14% in a single day, causing about 1.6 million traders to face liquidations, and the total crypto market cap evaporated by $350 billion in one day.

BIS specifically highlights the collapses of Celsius Network and FTX as typical lessons built on leverage, opaque promises, and lack of risk management. The report notes that the crypto ecosystem heavily relies on automated liquidation engines, with trading concentrated on a few large platforms.

When market confidence collapses, this structure can trigger severe chain reactions. Moreover, as the crypto market becomes increasingly intertwined with banks and stablecoin issuers, the failure of this shadow banking system could have serious spillover effects on the broader traditional financial industry.

Regulatory lag and hacking: the “infection path” of DeFi

The high integration of crypto markets and decentralized finance (DeFi) further amplifies the risk of contagion. A recent example is the KelpDAO protocol attack. Attackers exploited vulnerabilities to mint about 116,500 $rsETH, which they used as collateral to borrow large amounts from major lending platforms like Aave, ultimately causing a shortfall of approximately $292 million.

• Related news: Kelp DAO re-staking protocol hacked! $290 million lost in one hour, understand the incident

These events show that a single protocol’s vulnerability can trigger liquidity crises across the entire ecosystem. Security analyses link this attack to North Korea’s Lazarus Group, which within 1.5 days converted 75,700 ETH into Bitcoin and contributed about $8B in transaction fee revenue to the THORChain platform.

To address these increasingly complex challenges, BIS recommends adopting a dual-track approach combining “entity-based” and “activity-based” regulation. Regulatory agencies currently face challenges such as lagging legal frameworks, cross-border cooperation difficulties, and limited resources. Without effective prudential regulation and international oversight, the hidden risks in the crypto market will continue to threaten global financial stability.