How Crypto Exchanges Work: A Plain-English Guide

A crypto exchange is a marketplace, or a broker that fronts one, where people trade crypto assets for national currency or for other crypto assets. Every price quoted in a “crypto market today” report is, at bottom, a record of trades matched on one or more of these venues. Understanding how an exchange takes an order, holds assets and settles a trade explains most of what readers of a daily crypto news digest see: why prices differ slightly between venues, why withdrawals sometimes pause, and why regulators care about who holds customer assets.

In brief

• An exchange matches buyers and sellers, usually through an order book, and records the result.
• Centralized exchanges are companies that hold customer assets; decentralized exchanges are software that settles trades on a blockchain.
• Who holds the private keys is the central question for customer risk.
• Oversight depends on the activity: money transmission, securities, commodities and derivatives each fall under different agencies.

What an exchange actually does

The SEC’s investor education site defines a crypto asset as an asset that is generated, issued or transferred using a blockchain or similar distributed ledger network, and notes that terms such as “tokens,” “digital assets,” “virtual currencies” and “coins” are used for the same family of assets. It also stresses that characteristics and design vary significantly, so different crypto assets carry different benefits and risks.

An exchange gives those assets a place to change hands. It performs four jobs:

1. Onboarding. The customer opens an account, normally after identity checks, and links a bank account or other funding source.
2. Matching. The venue collects buy and sell interest and pairs orders that agree on price.
3. Settlement. The venue updates who owns what. On a centralized exchange this is often a change in the company’s internal ledger. On a decentralized exchange it is a blockchain transaction.
4. Custody and withdrawal. The venue holds assets for customers, or lets customers move them to a wallet they control.

The order book

Most large venues run a central limit order book. Buyers post “bids,” the prices they will pay. Sellers post “asks,” the prices they will accept. The gap between the best bid and the best ask is the spread. A trade happens when a buyer and seller agree, which usually means someone is willing to cross the spread.

Two order types account for most activity:

• A limit order sets a price. It rests in the book until someone accepts it or the customer cancels it.
• A market order asks to trade immediately at the best available prices. It fills against resting limit orders, and a large market order can move through several price levels. The difference between the expected price and the average fill price is called slippage.

Depth matters as much as the headline price. A thin book, with few orders near the current price, lets a modest trade move the market. A deep book absorbs the same trade with little effect. That is why liquid pairs for the largest assets tend to quote tight spreads, while smaller tokens can jump on a single order.

A worked example

Suppose a hypothetical token has these resting orders: buyers bid 99.90 for 500 units and 99.80 for 800 units; sellers ask 100.10 for 400 units and 100.30 for 900 units. The spread is 0.20. A customer who sends a market order to buy 600 units fills 400 at 100.10 and 200 at 100.30. The average price is a little above the best ask, and the last trade price printed on the screen is now 100.30. Those figures are illustrative only, but the mechanics are what every venue’s trade history reflects.

Centralized exchanges

A centralized exchange is a company. It runs the matching engine, keeps the customer ledger and, in most cases, holds the private keys to customer assets. The SEC’s custody bulletin explains that a wallet does not store crypto assets themselves; it stores the private keys or passcodes that control them. When a customer leaves assets on a centralized exchange, the bulletin classes the exchange as a third-party custodian, which manages and controls access to the keys.

That arrangement is convenient. Customers get a familiar login, customer support and fiat on-ramps. It also concentrates risk. If the company is hacked, mismanages assets, or fails, customers may face delays or losses. The SEC bulletin tells readers to understand how a custodian holds and protects assets before choosing one, and it contrasts third-party custody with self-custody, where the customer alone controls the keys and bears sole responsibility for losing them.

Centralized venues usually offer:

• spot trading, meaning immediate exchange of one asset for another;
• fiat deposits and withdrawals through bank rails or payment cards;
• custody and, at some firms, staking or lending products that carry their own risks;
• in some jurisdictions, derivatives such as futures, which are a separate regulatory category.

Decentralized exchanges

A decentralized exchange, or DEX, replaces the company with software. Trades settle directly between users’ wallets through smart contracts, which are programs deployed on a blockchain. Many DEXs do not use an order book. They use liquidity pools: users deposit pairs of assets into a contract, and a formula sets the price based on the pool’s balance. A trader swaps against the pool rather than against another person.

The trade-offs run the other way from a centralized venue. Customers keep control of their keys, and there is generally no account to open. But the customer carries the operational risk. A mistyped address or a malicious contract can mean permanent loss, and no support desk can reverse a confirmed blockchain transaction. Fees are paid in the network’s own token and rise when the network is busy.

Why prices differ between venues

Each exchange has its own order book, so each has its own last-trade price. Differences are usually small for widely traded assets, because traders who spot a gap buy on the cheaper venue and sell on the dearer one, a practice called arbitrage that pulls prices together. Gaps can widen when withdrawals are halted, when a venue is cut off from banking, or when a thinly traded token has little depth. Data sites that publish a single price usually compute a volume-weighted average across venues, and the method differs by provider.

Fees and other costs

Exchanges earn money in several ways. The most visible is the trading fee, often split between “makers” who add liquidity with resting orders and “takers” who remove it. Others include spreads on simple “buy” buttons, withdrawal fees, and charges for card purchases. On a DEX, network transaction fees and the pool’s built-in fee take the place of the exchange commission. Fee schedules change, so the venue’s own published schedule is the reference to use.

Who regulates exchanges

There is no single crypto regulator in the United States. Which agency applies depends on what is being offered.

Money transmission. FinCEN’s guidance, issued March 18, 2013, explains that a person who administers or exchanges virtual currency can be a money services business under the Bank Secrecy Act, specifically a money transmitter, unless a limitation or exemption applies. That brings registration, reporting and recordkeeping duties, including anti-money-laundering programs. The same guidance says a mere user of virtual currency is not a money services business.

Securities. When a crypto asset is offered or sold as a security, SEC rules on registration, exchanges and broker-dealers can apply. Whether a given asset is a security turns on the facts and circumstances of the offering, which is why the SEC publishes investor materials on crypto assets and why court and agency actions on individual tokens draw attention.

Commodities and derivatives. The CFTC maintains a digital assets hub and oversees derivatives markets, including futures, under the Commodity Exchange Act. Spot venues that are not trading derivatives generally sit outside CFTC registration, though the agency has antifraud and anti-manipulation authority in commodity markets.

States. State regulators license money transmitters and, in some states, issue crypto-specific licenses.

Readers should treat the above as a general map. Rules change, agencies sometimes differ, and the same company can be subject to several regimes at once. The agency pages listed under sources are the place to check current positions.

Key terms

• Order book: the live list of bids and asks for a trading pair.
• Spread: the difference between the best bid and the best ask.
• Liquidity: how easily an asset can be traded without moving its price.
• Slippage: the gap between the expected and actual execution price.
• Maker and taker: a maker adds a resting order; a taker fills one.
• Custody: how and where the keys controlling an asset are held.
• Private key: the secret credential that authorizes spending; per the SEC bulletin, losing it means permanently losing access to the assets.
• Seed phrase: a sequence of words that can restore a wallet.
• KYC and AML: know-your-customer identity checks and anti-money-laundering controls.

Common misconceptions

“If my coins are on the exchange, they are insured like a bank deposit.” Bank deposit insurance covers deposits at insured banks. Assets held at a crypto exchange are not bank deposits, and the protection that applies depends on the arrangement and the legal structure. Customers should read the venue’s terms and not assume coverage.

“A price on one site is the market price.” It is the price on that venue, or a blend that depends on the data provider’s method.

“Decentralized means unregulated.” Developers, front-end operators and users can still face obligations under securities, commodities and anti-money-laundering law, depending on the facts.

“The exchange owns my crypto.” Terms differ. Some agreements give the venue broad rights to use customer assets, and others segregate them. The terms of service say which.

A short checklist before using any exchange

1. Read how the venue describes custody, and whether customer assets are held separately from company funds.
2. Check which regulators the firm says it is registered or licensed with, and verify that on the regulator’s own site.
3. Review the fee schedule and withdrawal limits.
4. Turn on two-factor authentication, and keep seed phrases offline and private.
5. Expect impersonation attempts. Fake exchange sites and apps are a common route for fraud, so verify the web address before entering credentials.

None of this is investment advice. It describes how the machinery works so that market reports are easier to read.

FAQ

What is the difference between an exchange and a wallet?

An exchange is a marketplace, and on a centralized venue it also holds assets for you. A wallet is a tool that stores the private keys controlling assets. With a self-custody wallet you hold the keys; with an exchange account, the company generally does.

Can an exchange freeze my account or halt withdrawals?

Yes, under the terms of service. Venues may pause activity for security incidents, legal orders, compliance reviews or technical problems. Reading the terms before depositing funds shows what rights the venue reserves.

Why do two exchanges show different prices for the same coin?

Each runs its own order book. Differences are usually narrow for liquid assets and can widen when a market is thin, a venue restricts withdrawals, or demand is lopsided on one platform.

Is a decentralized exchange safer than a centralized one?

Neither is safe by default. A DEX removes company custody risk but adds smart-contract risk, user error and the lack of a support desk. A centralized exchange reduces user error but adds counterparty risk. The right question is which risks a person is prepared to manage.

Who do I contact if something goes wrong?

Start with the venue’s support and records. For suspected fraud, the SEC, the CFTC and the FTC accept complaints, and local law enforcement can take reports. Keep transaction hashes, screenshots and correspondence.