Where Client Assets Actually Sit at a Typical Exchange
The exposure is that your balance is an entry in a database and the assets behind it are held somewhere you have not been told about.
Your balance at an exchange is a number in that exchange’s ledger. The assets behind it are held in wallets the exchange controls, and the arrangement is rarely described.
The exposure
If the exchange fails, you are a creditor with a claim, not an owner with property. Whether that distinction protects you depends on arrangements made long before the failure.
The mechanism
Deposits are swept into pooled wallets. Your coins stop being yours in any identifiable sense the moment they arrive.
The exchange maintains an internal ledger showing what it owes you and holds a pool of assets against the total. There is nothing wrong with this structure; it is how almost every venue operates.
What varies between venues
Whether the pool is segregated from the exchange’s own assets. Whether it is held by the exchange or by a third-party custodian. How much sits in cold storage. Whether any of this is documented.
Four questions, and most venues answer none of them publicly.
What would have to be true for this to be safe
The pool exceeds the liabilities. It is segregated in a way that survives insolvency under the relevant law. Operational controls prevent internal misuse. And someone outside the exchange checks all three periodically.
All four, not any one. Venues that have failed usually satisfied two or three.
The reporting that exists
Proof of reserves shows assets at a moment. It usually does not show liabilities with the same rigour, and it never shows whether the assets are encumbered.
An attestation is better than nothing and considerably less than an audit.
What to look for instead
Explicit statements about segregation, a named regulator, and a named custodian where one is used. Exchanges that publish where client assets are held are making a statement that can be checked against a licence.
The practical position
Hold at an exchange what you need for transacting, not what you need to preserve. The amount, not the venue, is the main control available to most people.
Beyond that, prefer a venue with segregated client accounts and a regulator who can be contacted when the venue stops responding. Collect & Exchange, which is licensed in Cyprus, is answerable to a supervisor; an offshore venue is answerable to nobody you can reach.