BIS Warning: Crypto Exchanges Have Become "Shadow Banks"! User Funds Face Unsecured Risks

The Bank for International Settlements (BIS) released a report warning that cryptocurrency exchanges are transforming into “Multifunctional Crypto-asset Intermediaries,” integrating trading, custody, and proprietary functions without sufficient regulatory firewalls.

From trading platforms to “all-in-one institutions,” MCIs are blurring financial boundaries

The BIS recently published a 38-page research report revealing that major global cryptocurrency exchanges are rapidly transforming into “Multifunction Crypto-asset Intermediaries” (MCIs). These entities, under a single corporate structure, highly integrate multiple functions such as trading platforms, custody services, proprietary trading, brokerage, and token issuance.

Owned jointly by 63 central banks worldwide, the BIS report emphasizes that this operational model runs counter to traditional financial market risk isolation principles. In conventional finance, to prevent conflicts of interest and risk contagion, these roles are typically separated into different independent entities with strict firewalls.

However, cryptocurrency exchanges tend to adopt a vertical integration model, deeply binding customer funds with the platform’s own operational risks. This structure lacks transparency in operations, and is not subject to reserve requirements or asset segregation regulations, effectively making these platforms a form of “shadow banking” with extremely loose regulation.

The truth behind high yields: user assets become unsecured loans

Major crypto exchanges are actively marketing high-yield products such as “Earn” or “DeFi plans,” packaging them as convenient passive income tools.

The BIS report bluntly states that these financial products are essentially unsecured loans to the platform. When users deposit crypto assets in exchange for returns, the platform often engages in “rehypothecation,” recycling these assets into high-risk activities. These include margin lending, highly leveraged proprietary trading, and market liquidity provision.

Under this mechanism, users often unknowingly relinquish legal ownership or actual control of their assets. If the platform faces a liquidity crisis, users will directly bear the platform’s debt repayment risk and become ordinary creditors at the end of the repayment hierarchy.

Unlike regulated traditional bank deposits, these assets lack deposit insurance protections and are not supported by central bank as the lender of last resort. This cycle of customer assets into high-risk gambles introduces significant instability into the digital asset market.

Lessons from the FTX collapse to the $19 billion flash crash

The crypto flash crash in October 2025 vividly demonstrated the destructive power of leverage feedback loops. Within just 24 hours, driven by macroeconomic shocks, the entire network experienced forced liquidations totaling up to $19 billion. Bitcoin ($BTC) plummeted over 14% in a single day, liquidating approximately 1.6 million traders, and wiping out $350 billion in market capitalization in one day.

The BIS report specifically highlights the collapses of Celsius Network and FTX as typical lessons built on leverage, opaque promises, and lack of risk management. It notes that the crypto ecosystem relies heavily on automated liquidation engines, with trading depth concentrated on a few large platforms.

When market confidence collapses, such structures can trigger severe chain reactions. Moreover, as the crypto market becomes increasingly intertwined with banks and stablecoin issuers, the failure of this shadow banking system could have serious spillover effects on the broader traditional financial industry.

Regulatory lag and hacking: the “infection pathways” of decentralized finance

The high integration of crypto markets and decentralized finance (DeFi) further amplifies the risk of contagion. A recent example is the KelpDAO protocol attack. Attackers exploited vulnerabilities to mint about 116,500 $rsETH, which they used as collateral to borrow large amounts from platforms like Aave, ultimately causing a shortfall of approximately $292 million.

• Related news: Kelp DAO re-pledge protocol hacked! $290 million lost in one hour, understand the incident

These events show that a single protocol’s vulnerability can trigger liquidity crises across the entire ecosystem. Security analyses link this attack to North Korea’s Lazarus Group, which within 1.5 days converted 75,700 ETH into Bitcoin and contributed about $8B in transaction fees to the THORChain platform.

To address these increasingly complex challenges, the BIS recommends adopting a dual-track regulatory approach combining “entity-based” and “activity-based” regulation. Regulatory agencies currently face challenges such as lagging legal frameworks, cross-border cooperation difficulties, and limited resources. Without effective prudential regulation and international oversight, the hidden risks in the crypto market could continue to threaten global financial stability.