BIS Warning: Cryptocurrency Exchanges Have Become "Shadow Banks"! User Funds Face Unsecured Risks

The Bank for International Settlements (BIS) has released a report warning that cryptocurrency exchanges are shifting toward becoming “Multifunction Crypto-asset Intermediaries,” and that, in the absence of regulatory firewalls, they are consolidating conflicting functions such as trading, custody, and proprietary trading.

From trading platforms to “all-in-one institutions,” MCIs are blurring financial boundaries

The Bank for International Settlements (BIS) recently issued a 38-page research report revealing that major global cryptocurrency exchanges are rapidly transforming into “Multifunction Crypto-asset Intermediaries” (Multifunction Crypto-asset Intermediaries, abbreviated as MCIs). Under a single corporate structure, these entities highly integrate multiple roles, including trading platforms, custody services, proprietary trading, brokerage, and token issuance.

Owned jointly by 63 central banks worldwide, the BIS report emphasizes that this operating model runs counter to the risk-isolation principles used in traditional financial markets. In the traditional financial system, in order to prevent conflicts of interest and the spread of risk, the roles mentioned above typically must be separated into different independent entities and subject to strict firewalls.

However, cryptocurrency exchanges tend to adopt a vertical integration model that deeply ties customer funds to the platform’s own operational risks. This structure lacks operational transparency, and in the absence of reserve requirements and regulations requiring separate custody of assets, these platforms effectively become “shadow banks” with extremely lax regulation.

The truth behind high returns: users’ assets turn into unsecured loans

Major cryptocurrency exchanges are currently actively marketing high-yield products to retail users, such as “Earn” or “wealth management plans,” packaging them as convenient passive income tools.

The BIS report bluntly states that the essence of these wealth management products is unsecured loans to the platform. When users deposit crypto assets in exchange for a yield, the platform typically “rehypothecates” these assets, recycling them into high-risk activities. These activities include margin lending, highly leveraged proprietary trading, and providing market liquidity.

Under this mechanism, users often unknowingly give up legal ownership or actual control over their assets. If the platform encounters a solvency crisis, users will directly face the platform entity’s debt repayment risk and become ordinary creditors at the end of the repayment order.

Unlike regulated traditional bank deposits, these assets are completely lacking deposit insurance protection, and there is no central bank acting as a lender of last resort to provide support. This practice of cyclically deploying customer assets into high-risk bets introduces major instability into the digital asset market.

Lessons from the FTX collapse to the $19 billion flash crash

The crypto currency flash crash that occurred in October 2025 clearly demonstrated the destructive power of leverage feedback loops. Within just 24 hours, driven by macroeconomic shocks impacting the broader economy, the total forced liquidation amount across the entire network reached as much as $19 billion. At the time, Bitcoin ($BTC) fell by more than 14% in a single day, leading to the liquidation risk faced by about 1.6 million traders, and causing the total market capitalization of the crypto market to evaporate by $350 billion within one day.

In the report, the BIS specifically calls out the collapse cases of Celsius Network and FTX, describing them as typical lessons built on leverage, opaque commitments, and a lack of risk management. The report notes that the crypto system relies heavily on automated liquidation engines, and trading depth is concentrated among a small number of large platforms.

When market confidence collapses, this structure can trigger severe chain reactions. In addition, as the crypto market becomes increasingly intertwined with banks and stablecoin issuers, failures in this shadow banking system could have serious spillover effects on the broader traditional financial industry.

Regulatory lag and hacking: the “infection path” of decentralized finance

The high integration between the crypto market and decentralized finance (DeFi) further increases the likelihood of risk contagion. A recent example is the KelpDAO protocol attack. Attackers minted approximately 116,500 $rsETH tokens through a vulnerability and used them as collateral to borrow large amounts of assets from major lending platforms such as Aave, ultimately resulting in an approximately 2.92 billion funding shortfall.

• Related news: Kelp DAO re-pledge protocol hacked! $290 million wiped out in one hour—take a look at what happened

These events show that a vulnerability in a single protocol can trigger a liquidity crisis across an entire ecosystem. Security analysis indicates that this attack is linked to North Korea’s Lazarus Group, where within 1.5 days the hackers converted 75,700 ether ($ETH) into Bitcoin, and contributed approximately 910,000 transaction-fee revenues to the THORChain platform.

To respond to increasingly complex challenges, BIS recommends adopting a dual-track approach of “entity-based” and “activity-based” regulation. Regulatory authorities are still facing challenges such as lagging legal frameworks, difficulties in cross-border coordination, and limited regulatory resources. If effective prudential regulation and cross-national supervision cannot be implemented, the crypto market’s hidden risks will continue to threaten global financial stability.