BitForex exchange: a review

This article is a substantial revision of the review we published in August 2020. In February 2024, BitForex froze withdrawals and its website went dark. BitForex itself has since confirmed that several team members were detained by Chinese authorities on 27 February 2024, and that withdrawal processing resumed on 24 July 2024. What followed was a two-year wind-down: withdrawals partially resumed, and BitForex told remaining users to complete KYC and withdraw by December 25, 2025. The platform now operates as a withdrawal-only "Asset Withdrawal System": trading, deposits, and new registration are suspended, KYC is mandatory, and since 25 December 2025 leftover balances accrue a 5 percent monthly management fee. Rather than delete the review, we have rewritten it to re-run its own checklist against the outcome. Every signal was on the page in 2020. We scored them wrong, and it is worth being precise about how.

The security score we explained away

The original review contained one hard, independently measurable data point, and here is what we did with it:

When testing BitForex’s cybersecurity with the Observatory by Mozilla, the result was an F. This is a result that is commonly seen in Crypto exchanges, albeit one that is below-average for a top exchange. That being said, no hacks have been reported on the exchange so far.

We even pull-quoted the comfort line:

No hacks have been reported on the exchange so far.

This is the anatomy of a bad risk call. We held one falsifiable measurement (an F) and one unfalsifiable reassurance (no reported hacks) and let the second cancel the first. "No hacks so far" is survivorship, not security; it describes every exchange right up until the day it fails. Grading the F on a curve because other exchanges also scored badly explained away the one negative signal we did have. To be clear about what that signal was and was not: an Observatory grade measures a website's security headers, not custody, solvency, or governance, so the F could not have predicted a withdrawal freeze. The lesson is not that the F forecast the collapse. It is that we reached for reasons to discount even a small, checkable negative while accepting large, uncheckable positives at face value.

The cold-wallet claim nobody could check

The review relayed the custody story with hedges intact:

To that end, they reportedly store 98% of funds in cold-wallet storage, requiring for approval of transfers the use of a multi-signature wallet with 5 signatures out of the 7 hardware security modules in possession by the globally-distributed team. BitForex claims to keep about 0.5% of funds in hot wallets as strictly necessary by the withdrawal queue in the platform.

"Reportedly" and "claims" were doing honest work in those sentences. The failure was that the hedges never reached the conclusion: the review treated an unverifiable custody claim as a positive rather than a blank. February 2024 exposed the gap. When withdrawals froze, the custody story could not be checked against reality. A platform that said it kept 98% of funds in cold storage and only 0.5% in hot wallets, then could not return user funds on demand, left a custody claim no outsider could reconcile with events. A frozen withdrawal queue does not by itself prove the cold-storage figure was false; loss of access, a liquidity hole, key mismanagement, or legal intervention could each freeze withdrawals. The narrower point holds either way: an unverifiable custody claim was never evidence of safety to begin with. The 5-of-7 multi-signature story was marketing copy, and it deserved the weight marketing copy deserves: zero. A custody claim you cannot verify is not a small positive. It is no information at all.

The volume ranking

CoinMarketCap has BitForex in the top 10 exchanges, in volume, traffic, and liquidity.

Reported volume measures what an exchange chooses to report, not what it holds or how it behaves under stress. By 2020 it was already public knowledge that most reported exchange volume industry-wide could not be trusted, yet the review used a top-10 ranking as its reliability anchor. Rankings built on self-reported throughput compound the same error as the custody claim: they launder a company's own statements into the appearance of third-party validation.

The promised returns and the absent regulator

Two passages from 2020 read very differently now. The first:

TURBO is BitForex’s premium IEO platform. BitForex claims an average historical return of 75x for the projects that have listed using TURBO.

The second:

As BitForex is not registered with the Commodity Futures Trading Commission or any other U.S. regulatory entity we cannot be certain, but it seems as if BitForex may accept U.S. citizens since it is not expressly forbidden.

Put together: a venue advertising 75x average returns and offering 200x leverage, with no registration we could find at any financial regulator, and our review floated that US citizens could probably use it because nothing expressly forbade it. An advertised historical return of 75x is not a feature to list under "special features". It is a promise of returns, the oldest signal there is. And having no supervising regulator we could identify was not a convenience for users; it was a central reason that when withdrawals froze in 2024, users had no clear supervisory authority to turn to and were left waiting on the platform's own wind-down process.

Which signals mattered

Re-run the checklist and the pattern is clear. Nearly every positive in the review was an unverifiable self-reported claim: cold-wallet ratios, the multi-signature ceremony, reported volume, 75x IEO returns, and we credited them anyway. The fact that carried real weight in hindsight was not a security grade but a structural one: a venue with no regulator we could identify leaves its users no supervisory authority to turn to when it fails, which is exactly what happened. The review's mistake was not gullibility in any single paragraph; the hedged language shows the doubts were there. The mistake was letting a pile of unverifiable positives outvote one verifiable negative.

That is the test we now apply, and the one we suggest to any founder evaluating a venue for treasury or listings: write down which of the platform's claims you could check without the platform's help, discard the rest, and look at what remains. For BitForex in 2020, two checkable facts remained: a failing website-security scan, and no supervising regulator we could identify behind the venue. Only the second told you what would happen to your money.