Is your crypto safe? What UK rules do and don’t cover
Crypto exchanges get hacked, collapse and attract scammers. Here’s what the FCA actually regulates, why the FSCS won’t save you, and how to protect any coins you hold.
Reviewed, edited and approved by Editor-in-chief Daniel Sköld · Updated 4 November 2026
Contents
Every few months another crypto exchange makes the news for the wrong reasons. Sometimes it’s a hack, sometimes it’s a collapse, and sometimes it’s a run where customers all rush to withdraw at once. The headlines tend to come with a huge dollar figure attached and, increasingly, a mention of North Korea.
If you’ve put a few thousand pounds into bitcoin through an app, the obvious question is whether any of that could happen to you, and who would help if it did. The honest answer: rather less help than you’d get from a bank, at least for now.
AD
Why do crypto exchanges keep getting hacked?
A crypto exchange is a website or app where you buy and sell digital coins. Most people leave their coins sitting on the exchange afterwards, much as you’d leave shares with a stockbroker. That makes exchanges a very tempting target. They hold enormous piles of assets that can be moved across the world in minutes and are very hard to get back once they’ve gone.
The biggest heist so far hit Bybit, a Dubai-based exchange, in February 2025. Roughly $1.5bn in digital tokens was taken, and the FBI blamed North Korean state hackers. Security researchers have spent years tracking those same groups as they work through the crypto industry, usually by tricking staff rather than cracking code: fake job offers, booby-trapped software updates and convincing messages that get someone on the inside to approve a transaction.
Hacks aren’t the only risk. When FTX collapsed in 2022, customers found that the money they thought was safely held had been mixed up with the company’s own trading. Nobody had to break in. The problem was the people running the place.
How does the FCA regulate crypto in the UK?
Here’s the bit that surprises people. Right now the Financial Conduct Authority (FCA) regulates crypto firms only in a narrow way. Any firm offering crypto services in the UK has to register with the FCA under the money laundering rules. That means checking who its customers are and spotting dirty money. It doesn’t mean the FCA has checked that the firm is well run, holds enough capital or keeps your coins apart from its own.
Since October 2023 the FCA has also controlled how crypto can be advertised to you. Adverts must carry clear risk warnings. If you’re new to a platform, it has to give you a cooling-off period and check that you understand what you’re buying before you invest.
A much fuller regime is coming. Parliament made the Financial Services and Markets Act 2000 (Cryptoassets) Regulations 2026 in February 2026, and the FCA published its final rules on 30 June 2026. Exchanges, dealers, custodians (firms that hold coins for you), crypto lenders and staking services will need full FCA authorisation, the same kind of permission banks and brokers need. They’ll have to meet capital requirements, follow the client money and custody rules for keeping customer assets separate, and have named senior managers who are personally accountable. Firms could apply from 30 September 2026. The regime is expected to take effect on 25 October 2027.
That’s real progress. But it’s a regime for firms. It won’t stop prices falling.
Does the FSCS protect cryptocurrency?
No. The Financial Services Compensation Scheme (FSCS) is the safety net that pays out up to £85,000 per person per institution if a UK bank fails, with separate cover for some failed investment firms. It doesn’t cover crypto you hold on an exchange. If your exchange is hacked or goes bust, there’s no government-backed scheme waiting to repay you.
This catches people out because many crypto apps sit alongside, or inside, perfectly normal regulated businesses. Cash you hold with a bank in sterling may be protected. Once you convert that cash into coins, it almost certainly isn’t. The FCA’s standard warning is blunt for a reason: assume you could lose everything you put in.
Fuller regulation should make firm failures less likely and the clean-up more orderly. It doesn’t turn crypto into a protected deposit. Nothing announced so far brings ordinary crypto holdings under FSCS cover, so don’t assume it ever will.
Regulation can make a crypto firm better run. It can’t make the coins inside it safe.
AD
How to secure a crypto account
If you’re going to hold crypto, treat the account like your main bank account, because a thief certainly will.
Start with a long, unique password that you use nowhere else. A password manager makes this painless. Then turn on two-step verification using an authenticator app or a physical security key rather than text messages. SIM-swap fraud, where criminals talk your mobile network into moving your number to their SIM card, is a well-worn way into crypto accounts.
Use the exchange’s withdrawal allow-list if it has one. This means coins can only be sent to wallet addresses you’ve approved in advance, often with a waiting period before any new address can be used. It’s a nuisance for you and a much bigger one for a thief.
For larger sums, consider moving your coins off the exchange into a hardware wallet. This is a small device that keeps the private keys (the secret codes that control your coins) offline. The catch is that you become your own bank. Lose the device and its recovery phrase and nobody can get your money back. Write the phrase down, store it somewhere safe and never type it into a website or share it with anyone.
Before you sign up, check the firm on the FCA’s register and the FCA Warning List. Plenty of slick crypto apps have never registered at all.
The scams to watch for
For most people the bigger threat isn’t North Korean hackers. It’s someone friendly on WhatsApp.
The classic pattern goes like this. A stranger gets in touch, often after a ‘wrong number’ message or through a dating app, builds up trust over weeks, then introduces you to a trading platform where your balance appears to grow nicely. When you try to withdraw, there are suddenly fees or taxes to pay first. The platform was fake from the start.
Watch out too for videos of celebrities ‘endorsing’ crypto schemes, which are usually deepfakes (AI-generated fakes), and for ‘recovery’ firms that offer to get back money you’ve already lost. Those are typically the same criminals coming round for a second helping.
A few rules cover most of it. Nobody legitimate will ever need your recovery phrase. Real investments don’t guarantee returns. Pressure to act today is a red flag. Forward scam texts to 7726 and suspicious emails to report@phishing.gov.uk, and if you’ve sent money, call your bank straight away and report it to the police.
One last thing: HMRC expects you to pay Capital Gains Tax when you sell, swap or spend crypto at a profit above your annual allowance. Since 1 January 2026, UK crypto platforms have been collecting customer details to report to tax authorities under new international rules, so assume the taxman can see what you’re doing.
In short
Crypto exchanges aren’t as safe as banks. At the moment the FCA mainly checks them for money laundering, and the FSCS won’t repay you if an exchange is hacked or collapses. A tougher FCA regime is expected from October 2027, which should make firms better run, but your coins still won’t be protected. If you hold crypto, lock down the account, keep larger sums in a hardware wallet, check the FCA register and only invest money you can afford to lose.
Alex Innes explains technology for men 45 and over who have seen every gadget since the ZX Spectrum and are not easily impressed. AI and ChatGPT, phones, cars, the smart home, the subscriptions worth keeping and staying safe online – what it does, whether it's worth the money, and whether you need it at all.
One of Midcent's writers. Spotted something? Write to alex@midcent.uk.
Passkeys are safer than passwords, but if your phone vanishes on holiday they can lock you out of your own life. Here’s how to set up your way back in first.
Forgotten accounts and recycled passwords are open side doors for fraudsters. Here is a one-hour clear-out using free UK tools, done before the Christmas scam season starts.
AI has moved into the office. It is good at summarising meetings and drafting emails. Here is what it is really doing to UK jobs, and how to stay ahead of it.
Google links more of its services than ever, including Gmail, Drive, Photos and its Gemini assistant. Here’s how UK users can check what shapes their ads and switch it off.
