Exchange Asset Rehypothecation Risk: Your Coins on Deposit May Already Be Lent Out

1. Custody vs. Claim: What a Rehypothecation Clause Actually Turns Your Assets Into

Understanding rehypothecation risk starts with distinguishing two entirely different legal and economic relationships: "asset custody" and "a claim against the exchange." Under pure custody, the exchange merely holds a user's native assets on their behalf, and those assets should at any moment be clearly identifiable as belonging to a specific user, with the exchange unable to repurpose them. Under rehypothecation, the assets a user deposits enter a pooled fund, and the exchange has the right to lend assets from that pool to market makers, institutional clients, or use them for its own other business activities — the balance shown in a user's account becomes a "payable" promise from the exchange to the user, no longer corresponding to a specific, segregated batch of assets. This distinction is nearly imperceptible during normal operation — under either model, user withdrawals typically process immediately. But the difference gets sharply amplified when an exchange hits a liquidity crisis: if assets have already been lent out, and the borrower (a market maker or institutional borrower) can't repay on time, or the exchange itself diverts pool funds to cover losses in another business line, a mass withdrawal event could leave the exchange without enough immediately available assets to honor every request.

A verifier should clearly recognize that the vast majority of centralized exchange terms of service grant the platform some degree of asset usage right by default — clauses that fully prohibit the exchange from using user assets in any way are actually the minority, typically appearing only in product lines specifically marketed as "segregated custody" or "non-custodial accounts." This means "my coins are on the exchange" by itself doesn't let you infer that your assets haven't been rehypothecated — a verifier needs to actively check the specific clause wording and product options.

• Under pure custody, assets should be clearly identifiable as belonging to a specific user; under rehypothecation, the user balance becomes a payable promise from the exchange.
• The two models are nearly indistinguishable during normal operation, but whether lent-out assets can be recovered directly determines whether users can withdraw promptly during a liquidity crisis.
• Most exchange terms of service grant the platform some degree of asset usage right by default — clauses fully prohibiting asset use are a relatively rare, specialized product line.

2. Verification Method One: Check the Specific Wording of Asset Usage Rights in Terms of Service

A verifier should directly check an exchange's terms of service (typically in the account and assets section of the "user agreement" or "terms of service" document) for language along the lines of "the user understands and agrees the platform may use assets in the account for lending, market-making, or other business activities," and whether that authorization has clear scope limits — for instance, applying only to assets in "earn" or "wealth management" products the user opted into, versus defaulting to apply to all spot account balances. The key detail to verify: whether the authorization scope explicitly excludes balances in a regular spot trading account that haven't been proactively enrolled in any yield product. Some exchanges draw this distinction — only assets tied to savings, wealth management, or staking products the user actively subscribed to are used for lending or rehypothecation, with plain spot balances subject to stricter segregation; but other exchanges use relatively broad clause wording that, in theory, covers all assets in the account regardless of whether the user opted into any yield-generating product. A verifier should read this section word by word rather than assuming "the terms are probably all similar."

• The key check is the specific scope covered by rehypothecation authorization, not merely the binary question of whether such a clause exists.
• Some exchanges only authorize rehypothecation for assets tied to actively-subscribed yield/staking products, keeping plain spot balances more strictly segregated.
• Other exchanges use broader wording that in theory covers all assets in the account — this needs to be verified word by word rather than assumed.

3. Verification Method Two: Proof of Reserves Can Verify "Total Sufficiency," Not Necessarily "Not Lent Out"

Proof of Reserves is often treated as the core trust credential for exchange asset security, but a verifier needs to understand exactly what such proofs verify. The core logic of most proof-of-reserves schemes is: proving the on-chain assets an exchange holds are not less than the sum of users' account balances. This verification rules out the most basic funding-gap risk — "the exchange simply doesn't hold enough assets" — but it doesn't, by default, answer a different question: whether the assets counted toward reserves have already been pledged as collateral in a lending protocol, or lent out to a third party via an OTC arrangement, requiring a repayment period to elapse before they can actually be recalled. If an exchange counts assets that have already been lent out — and won't be recoverable for another 30 days — as "held assets" in its proof of reserves, the total looks "sufficient" on paper, but this batch of assets doesn't have immediately usable liquidity at the moment the proof is published; in a large-scale bank run, this portion of assets can't be liquidated when needed.

A verifier should check whether a proof-of-reserves report explicitly distinguishes "immediately available assets" from "assets already lent out but theoretically owed back" — ideally an audit report would separately list the size and proportion of each category, rather than giving a single blanket "total asset coverage ratio" figure. If a report doesn't mention asset pledging or lending status at all, a verifier should treat that as an information gap, rather than assuming "not mentioned means it doesn't happen."

• Most proof-of-reserves schemes verify "is the total asset amount sufficient," not "have these assets been pledged or lent to a third party."
• Assets that have already been lent out and await a repayment period, even if counted toward the reserve total, don't have immediately usable liquidity during a bank run.
• An ideal audit report separately lists immediately available versus already-lent-out assets — failure to mention disposition status should be treated as an information gap, not assumed safety.

4. Hidden Risk Checklist: Lending Business Scale, Segregated Custody Options, and Wording Traps in Terms

Beyond clause wording and proof of reserves itself, several related risks are easily overlooked. First, the scale of an exchange's own lending business: if the exchange itself operates a crypto lending business for institutional clients, a verifier should check whether the funding source for that lending business includes user spot account assets, or draws entirely from the exchange's own capital — the latter carries significantly lower risk exposure. Second, availability of a segregated custody option: some exchanges additionally offer a "qualified custody" product or partner with an independent third-party custodian, and holding assets in that type of account typically clearly rules out rehypothecation risk, though it often comes with extra fees or reduced fund-usage convenience — a verifier needs to weigh, based on their own risk tolerance, whether that layer of protection is worth paying for. Third, the wording of "bankruptcy priority" clauses in terms of service: even if asset usage is normal day-to-day, once an exchange enters bankruptcy proceedings, the priority users' assets receive in the liquidation process is something a verifier should check — some clauses explicitly state user assets don't form part of the bankruptcy estate and should be returned with priority, while others treat user assets as ordinary unsecured claims on par with other creditors, a distinction that decisively affects how much users can recover in an extreme scenario.

• Check whether the exchange's own lending business draws its funding from user spot assets or entirely from its own capital.
• Segregated or qualified custody options typically rule out rehypothecation risk clearly, but may come with extra fees — worth weighing against personal risk tolerance.
• The wording of bankruptcy-priority clauses determines whether user assets get returned with priority or share the same standing as ordinary unsecured creditors in an extreme scenario.

5. Cross-Exchange Comparison Framework: Clause Transparency, Segregated Custody, and Lending Business Disclosure

When evaluating multiple candidate exchanges, a verifier can compare across the following dimensions. First, clause transparency: whether the terms of service state asset usage rights clearly and specifically, or use vague, sweeping language that makes the actual scope hard to judge. Second, availability of a segregated custody option: whether an account type that clearly rules out rehypothecation risk is offered, and the practical barrier to using it (minimum amount, extra fees, whether it affects trading convenience). Third, disclosure of the funding source for in-house lending business: whether the exchange proactively discloses the composition of its lending business's funding source, or doesn't mention the relationship between that business and user assets at all. Fourth, clarity of bankruptcy-priority clauses: whether user assets' legal standing in an extreme scenario is stated clearly. Combining these four dimensions produces a well-grounded judgment of an exchange's level of user-asset protection, rather than concluding from a single metric like "does it publish proof of reserves."

• Clause transparency, segregated custody availability, lending-business funding disclosure, and bankruptcy-priority clarity are the four key comparison dimensions.
• The practical barrier to using a segregated custody account (fees, convenience impact) needs to be weighed against one's own risk tolerance.
• "Publishes proof of reserves" cannot substitute for checking these four dimensions individually — they verify entirely different layers of risk.

6. Verification Checklist and Conclusion

Distilling the sections above into a reusable checklist: first, has the specific asset-usage-rights wording in the terms of service been read word by word, and has it been confirmed whether the authorization scope covers plain spot balances? Second, has it been verified whether the proof-of-reserves report distinguishes immediately available assets from already-lent-out assets, rather than relying on a single total coverage ratio? Third, has it been checked whether the funding source for the exchange's own lending business includes user assets? Fourth, is it known whether this exchange offers a segregated custody option, and what the practical barrier to using it is? Fifth, has the specific wording of bankruptcy-liquidation priority clauses been verified? Working through these five questions gives a well-grounded judgment of an exchange's level of user-asset protection, rather than defaulting to assume "coins on the exchange" is equivalent to "the coins are still mine." The entire piece discusses abstract mechanism categories only, names no real exchange, and is for learning and research purposes only, not investment advice.

• Five-question checklist: is the asset-usage-rights clause checked, does proof of reserves distinguish available from lent-out assets, is the lending-business funding source verified, is the segregated custody option understood, is the bankruptcy-priority clause checked.
• Where a rehypothecation clause exists, "assets on the exchange" is fundamentally a claim against the exchange, not direct ownership of a specific batch of native assets.
• The entire piece is a discussion of verification methodology, names no real exchange, and is not investment advice.