Missouri Calls Crypto ATMs Getaway Cars for Fraud. The Getaway Car Was Never the Part Worth Watching.

Four of the five exchanges I pulled let you deposit without ever proving who you are.

I went looking because of a headline. A state attorney general in Missouri sued the crypto-ATM operator CoinFlip and, in the framing that traveled the furthest, called crypto ATMs "getaway cars for fraud." It is a good line. It is the kind of line that gets a press release picked up. And it sent me back to a question I keep circling on this desk, which is not *how does the money leave* but *where does the money sit before and after it moves.*

Because here is the thing about a getaway car. It is the least interesting object at the crime scene. The car tells you how someone left. It tells you nothing about the vault they emptied, who held the keys, or whether anyone could have proven the vault was full in the first place.

So I stopped reading the lawsuit coverage and opened the data.

Methodology

I pulled five centralized exchanges from my working dataset — Binance, Bybit, Bitget, OKX, and MEXC — and measured them on the dimensions that actually decide whether your coins are recoverable when something goes wrong: proof-of-reserves status and audit recency, the CER security score, whether KYC is enforced at deposit, the maker/taker fee schedule, and the public Trustpilot rating as a crude proxy for how the retail base actually feels.

I did not measure marketing. I did not score user-interface polish or the number of meme coins listed. The dataset is a snapshot, not a live feed, so every figure here is dated to the audit it came from. Where a number was not in my grounding set, I left it out rather than guess — and I will flag the gaps as I hit them.

This is a storage-layer read, not a trading-layer one. The question underneath every finding is the same: if this venue went dark tomorrow, what could you prove, and what could you recover?

Finding #1: The exchange that demands your ID is the one nobody trusts

Start with the inversion, because it is the cleanest signal in the whole set.

Binance is the only one of the five that requires KYC at deposit. It is also the largest by a distance nobody else is close to — $18.5 billion in daily volume against Bybit's $9.2 billion, Bitget's $6.1 billion, OKX's $4.9 billion, and MEXC's $3.8 billion. It carries the highest CER security score in the group at 9.4. By every institutional metric, it is the most serious operation on the list.

Its Trustpilot rating is 2.3.

The four venues that do *not* force KYC at deposit — Bybit, Bitget, OKX, MEXC — score 4.5, 4.6, 4.2, and 4.4. That is not noise. That is a four-to-one gap between the most rigorously gated exchange and the four that let you in without a passport.

Now, I am not going to pretend Trustpilot is a solvency oracle. It is a sentiment puddle, gamed in both directions, weighted toward people angry about a frozen withdrawal. But the *direction* of the inversion is the point. The "getaway car for fraud" framing assumes that friction — ID checks, gates, KYC — is the thing protecting you. The retail data says the venue with the most friction is the one its own users trust least. The friction is not for you. It never was.

Finding #2: "Verified reserves" and proof of reserves are not the same sentence

This is the finding the custody world keeps trying to explain and the headlines keep missing.

Four of my five exchanges carry a reserve status of "verified": Binance, Bybit, Bitget, OKX. MEXC carries "partial." And the audit dates tell a second story underneath the labels. Bybit's last proof-of-reserves audit was 2025-03-12. Binance and OKX both landed 2025-03-01. Bitget came in a little earlier at 2025-02-20. MEXC's most recent was 2024-12-10 — months stale relative to the pack, and only partial when it landed.

Here is the part I need you to sit with. A proof-of-reserves attestation shows assets. It is a snapshot of what is in the wallets on the day someone looked. It does not show *liabilities* — what the exchange owes its users against those assets. An exchange can pass a reserves check at 11 a.m. with borrowed coins and be insolvent by dinner. We have watched this movie. We know how it ends.

So when four of five say "verified," what is verified is that someone counted the coins on a specific Tuesday in March. Whether the coins exceeded the obligations is a different audit, and it is not the one most of these labels describe. MEXC's "partial / 2024-12-10" is at least honest about being incomplete. The "verified" tags are the ones that should make you ask the follow-up question — verified *against what?*

Finding #3: The real getaway car is the leverage tier, and it is parked inside the exchange

If you want to find the mechanism that actually vaporizes retail money, you do not need an ATM. You need a futures tab.

MEXC offers up to 200x leverage on futures. Binance and Bitget both top out at 125x. Bybit and OKX cap at 100x. Read those numbers the way a liquidations dashboard reads them: at 200x, a 0.5% move against your position is a full wipe. At 125x, it is 0.8%. These are not investment products. They are structured to transfer your margin to the venue and the counterparty on the other side of a candle, and they live *inside* the regulated-sounding exchange, behind the same login that holds your spot balance.

MEXC also lists 2,400 trading pairs and supports 2,400 coins — by far the widest surface in the group, against Binance's 350 supported coins and OKX's 380. More pairs, more thin-liquidity tokens, more 200x leverage on instruments that can gap through a stop. That is not a getaway car. That is the vault and the getaway car welded into one machine, and you are invited to drive it.

Concede the obvious: nobody is forced to touch 200x, and a disciplined trader can use a high-leverage venue at 2x and never notice the ceiling. Fine. But the ceiling tells you who the product is *designed* for. And a fraud framing that fixates on a kiosk in a gas station, while ignoring a 200x retail futures ladder reachable from any phone, is looking at the wrong machine.

Finding #4: The fee schedule rewards exactly the behavior that drains accounts

Watch where the costs are lowest, because that is where the volume is being pulled.

MEXC runs a maker fee of 0.0% and a taker fee of 0.02%. Everyone else in the set sits at the category-standard 0.1% maker / 0.1% taker — except OKX, which shaves the maker side to 0.08%. So MEXC is charging effectively nothing to make liquidity and a fifth of the standard rate to take it.

Here is the delta-receipt move, and here is where I have to be honest about the gap: MEXC's 0.02% taker against the 0.1% standard is roughly an 80% discount to the rest of the group *as of this dataset.* What I could not pull is the date that schedule changed or what it was before — my grounding has the current numbers, not the history. So I will not pretend to a "they cut it from X on Y date" receipt I cannot back. The cross-venue delta is real and grounded; the time-series is a gap, and I am flagging it rather than inventing it.

But think about what a near-zero fee schedule pairs with. It pairs with 200x leverage and 2,400 pairs. Low friction to trade, maximum leverage to trade with, maximum surface of thin tokens to trade into. The fee design is not generosity. It is the on-ramp to the highest-velocity, highest-burn corner of the whole set. The cheapest venue to trade is the most expensive place to be wrong.

What This Does NOT Prove

None of this is evidence that any exchange in the table is insolvent, fraudulent, or about to fail. A "partial" reserve status and a stale audit date are yellow flags, not verdicts — MEXC may have stronger internal controls than a March attestation elsewhere papers over. And a 9.4 CER score with a 2.3 Trustpilot might just mean a large, regulated venue annoys a lot of people while keeping their coins perfectly safe. Both can be true.

What I also cannot speak to is the CoinFlip lawsuit itself. I did not pull the filing, the dollar figures, or the specific fraud mechanics the Missouri AG alleged, so I am not citing them — the headline was the prompt for this audit, not a source inside it. This piece is a custody-and-reserves read on five exchanges, not a legal analysis of a crypto-ATM operator. Treat it as the thing it is: a map of where the money sits, not a ruling on who took it.

The Takeaway

The getaway car was never the part worth watching. Watch the vault, watch who holds the keys, and watch whether anyone can prove the vault is full *and* paid up — because on this data, four of five say "verified" and not one of them is saying it about liabilities.

FAQ

Does a "verified" proof-of-reserves badge mean my coins are safe on that exchange?

No. Verified reserves means an auditor confirmed the exchange held certain assets on the audit date — Bybit's was 2025-03-12, Binance's and OKX's were 2025-03-01. It does not confirm liabilities, meaning what the exchange owes its users against those assets. A venue can pass a reserves snapshot while being insolvent on obligations. The badge proves coins existed on one specific day. It does not prove they exceeded what was owed, and it says nothing about tomorrow.

Why does Binance score 2.3 on Trustpilot if it is the most secure exchange listed?

Binance carries the highest CER security score in my set at 9.4 and the largest volume at $18.5 billion a day, yet its Trustpilot sits at 2.3 while the four no-KYC venues average around 4.4. Trustpilot measures retail sentiment, not solvency — it skews toward users angry about frozen withdrawals or KYC friction. The gap likely reflects that Binance enforces KYC at deposit and operates at a scale that generates more disputes, not that it is less secure than higher-rated peers.

Is using a no-KYC exchange safer than one that demands my ID?

Not in the way the trust scores suggest. Four of the five exchanges — Bybit, Bitget, OKX, MEXC — let you deposit without KYC and score higher on Trustpilot, but lower friction at the door is convenience, not custody safety. The deciding factors are reserve verification, audit recency, and whether the venue can prove solvency against liabilities. KYC status tells you about regulatory posture and your own privacy exposure. It tells you almost nothing about whether your coins are recoverable if the exchange fails.

What does 200x leverage actually mean for my account?

At 200x, which MEXC offers on futures, a 0.5% move against your position liquidates it entirely. At Binance's and Bitget's 125x ceiling, roughly a 0.8% move does it; at Bybit's and OKX's 100x, about 1%. These tiers exist inside the same exchange that holds your spot balance, reachable from the same login. High leverage is the mechanism that drains retail accounts faster than any external fraud vector — the ceiling tells you who the product was designed for, even if you choose to trade well below it.

Should I keep funds on any of these exchanges at all, or self-custody?

That is the real tradeoff, and it is not one-size-fits-all. An active trader needs balances on a venue with deep liquidity — Binance leads on that at $18.5 billion daily. A long-term holder gains little from exchange custody and inherits every solvency risk this audit flags. The middle path most operators land on: trade on the exchange, but sweep idle balances to hardware self-custody (Ledger, Trezor, GridPlus) or a qualified custodian (Coinbase Custody, Fidelity Digital Assets, Anchorage) where the keys and the liabilities are not the same entity's problem.