Amna had used the same crypto wallet for three years. When she decided to try its built-in exchange for the first time, a friend sent her a link with a single line: “Check its CER rating first.” The page showed a letter grade, a score out of 100, and a list of tests with names she did not recognise — server security, penetration testing, proof of reserves, bug bounty. She did not know whether a good grade meant her money was safe, or what a bad grade would even look like. So she spent an evening learning what the rating actually measures. That evening is the reason this guide exists — because the CER.live Blockchain.com exchange rating is useful only if you know how to read it.
CER.live is a cybersecurity ranking platform for crypto exchanges, powered by the blockchain security firm Hacken. Its CERtified methodology scores exchanges on server security, user security, penetration testing, proof of reserves, and bug bounty programmes. Blockchain.com is one of the oldest names in crypto — founded in 2011, known first for its wallet and explorer, with an exchange attached. This guide explains what CER.live measures, what Blockchain.com actually offers on security and licensing, and how to use the rating without treating it as a guarantee. If you are new to exchanges themselves, our complete guide to crypto exchanges explains how to choose a platform, and our blockchain wallet guide explains the difference between Blockchain.com’s non-custodial wallet and its custodial exchange account — a distinction that matters for everything that follows.
Executive Summary
- CER.live grades exchanges on cybersecurity, not on trading quality. Its tests cover server security, user security, penetration testing, proof of reserves, and bug bounty programmes.
- The top grade is AAA, given for scores around 90 out of 100. In 2025, KuCoin and Flipster both earned AAA with 90% scores, placing them among the most secure exchanges ranked.
- Blockchain.com is a veteran platform. Founded in 2011, it holds licences in Malta (MiCA), the UK, Singapore, and the Cayman Islands, plus money transmitter licences in 35 US jurisdictions.
- Its security stack is strong on paper. About 95% of funds sit in cold storage, and it holds ISO 27001, SOC 2, and CryptoCurrency Security Standard Level 3 certifications.
- A rating is a snapshot, not a promise. CER scores change as exchanges are re-tested, and no rating can guarantee an exchange will never be hacked or never freeze withdrawals.
- Check the live CER.live page before you decide. This article explains the method and the facts; the current score for Blockchain.com should always be read on cer.live itself, because it moves.
What Is CER.live?
CER.live is an independent cybersecurity ranking platform for cryptocurrency exchanges, run with the blockchain security firm Hacken. It tests exchanges against a published methodology and gives each one a letter grade — AAA at the top — and a score out of 100.
The methodology, called CERtified, looks at five areas. Server security checks whether the exchange’s systems are hardened against attack. User security checks the protections offered to account holders, such as two-factor authentication and withdrawal controls. Penetration testing checks whether the exchange hires outside experts to try to break in — and fixes what they find. Proof of reserves checks whether the exchange can show it actually holds the assets it claims to hold for customers. Bug bounty checks whether the exchange pays independent researchers to report vulnerabilities responsibly.
That list matters because it is narrow on purpose. CER.live does not rate trading fees, customer support speed, coin listings, or app design. An exchange can be a pleasure to trade on and still score poorly on security — and the reverse is true too. When you read a CER grade, you are reading one thing only: how seriously this exchange takes cybersecurity, as measured by these five tests. Our plain-English blockchain guide explains why that separation matters: a blockchain can be secure while the company holding your coins is not.
How CER.live Grades Work
| Grade | What it signals | Example |
|---|---|---|
| AAA | Top tier: near-perfect marks across the tested areas | KuCoin and Flipster, both 90% in 2025 |
| AA / A | Strong security with some gaps | Many large established exchanges |
| BBB / BB | Average: basics covered, notable weaknesses | Mid-size exchanges with thin testing |
| B and below | Weak: missing tests, poor reserves proof, or no bug bounty | Small or opaque platforms |
| Unrated | Not enough public evidence to grade | New or secretive exchanges |
Two real examples show what AAA looks like in practice. In June 2025, KuCoin earned a AAA rating with a 90% security score and perfect 100 out of 100 marks in server security, user security, penetration tests, and its bug bounty programme — placing it among the top six most secure exchanges in the world at the time, as reported in CoinMarketCap’s report on KuCoin’s AAA rating. In September 2025, Flipster earned AAA with the same 90% overall score and perfect marks in the same four areas, placing it among the top 13. Both announcements stressed the same point: the grade reflects tested practices, not marketing claims. For background on why proof of reserves became the test everyone watches, our Bitcoin bear-market analysis and our guide to how blockchain works explain what exchanges actually hold and how the chain records it.
CER.live’s rankings also feed into CoinGecko’s Trust Score, which is how many ordinary users first meet them. When you see a Trust Score on a CoinGecko exchange page, part of that number comes from CER’s security work. That gives the rating real weight: it shapes where traders go, and exchanges compete to improve it.
Blockchain.com: The Platform Behind the Rating
Blockchain.com started in 2011 as a Bitcoin block explorer and wallet — one of the first companies most crypto users ever heard of. Today it runs three things under one brand: a non-custodial wallet, a blockchain explorer, and a custodial exchange. The wallet and the exchange are not the same product, and confusing them is the most common mistake people make about this company.
The non-custodial wallet is yours. Blockchain.com cannot access your balances, freeze your wallet, or move your funds. You hold the keys. The exchange is custodial: when you deposit there, Blockchain.com holds the funds and you trust the company to return them. A CER.live rating applies to the exchange — the custodial part — because that is where the company’s servers, reserves, and security practices are what stand between you and your money. Our blockchain explorer guide explains how to check the explorer side of the business yourself, transaction by transaction.
On the exchange, the coin list is thin compared with the biggest global platforms. You will find Bitcoin, Ethereum, Dogecoin, and the other large, well-known assets, but not the long tail of small tokens. Fees are on the higher side for retail traders — independent reviews put typical trading fees around 0.4% to 0.45% — and support is frequently described as slow. Those are real drawbacks, but they are not what CER.live measures. A platform can charge high fees and still be secure, or charge almost nothing and be reckless with custody. Keep the two judgements separate.
Blockchain.com Security: What Is Actually in Place
| Security measure | What Blockchain.com does | Why it matters |
|---|---|---|
| Cold storage | About 95% of funds in offline, geographically distributed cold wallets | Stolen keys cannot reach most funds |
| Two-factor authentication | Required for logins, withdrawals, and account changes | A stolen password alone is not enough |
| Certifications | ISO 27001, SOC 2, CCSS Level 3, PCI DSS compliance | Independent audits of systems and processes |
| Bug bounty | Programme inviting researchers to report flaws | Weaknesses found before criminals find them |
| Encryption | SSL for connections, cryptographic software throughout | Data in transit is protected |
| KYC / AML | Identity checks on exchange accounts | Required by regulators; slows fraud and theft |
The cold-storage figure is the most important line in that table. Around 95% of user assets sit offline, spread across locations, with only about 5% in hot wallets for trading and withdrawals. That is standard practice among serious exchanges, and it is exactly what a proof-of-reserves check is meant to verify: that the cold wallets actually contain what the exchange says they contain.
The certifications are also worth understanding. ISO 27001 is an information-security management standard. SOC 2 Type II audits how a company actually operates its controls over time, not just what it claims on paper. CCSS Level 3 is a crypto-specific security standard for key management. None of these is a guarantee against a hack. All of them mean an outside auditor has looked at the systems and found them adequate at the time of the audit. That is useful evidence, and it is the kind of evidence CER.live weighs.
One honest gap: Blockchain.com does not publish a standard, user-verifiable proof of reserves in the way some rivals now do. Independent reviewers note the absence of a regular proof-of-reserves publication — see the Blockchain.com safety review that records no standard proof-of-reserves publication. That does not mean funds are missing — it means the public cannot verify the backing the way they can on an exchange with a live proof-of-reserves page. If proof of reserves is one of CER.live’s five tests, a missing or thin publication is the kind of thing that holds a score down. It is also the kind of thing that changed the whole industry’s expectations after the Binance incident — our Bitcoin options expiry explainer shows how traders combine several data sources instead of trusting one, and our blockchain mining guide explains how the chain itself records what an exchange does.
Licences and Regulation
Blockchain.com holds licences and registrations in several jurisdictions: Malta, the United Kingdom, Singapore, and the Cayman Islands, plus money transmitter licences in 35 US jurisdictions. In October 2025 it secured a MiCA (Markets in Crypto-Assets) licence from the Malta Financial Services Authority, allowing it to offer custody and exchange services across all 30 European Economic Area countries.
Licences matter for a different reason than security grades. A licence means a regulator has checked the company’s fitness, its capital, and its anti-money-laundering systems, and can punish it if it misbehaves. It does not mean the regulator guarantees your deposits. In most jurisdictions, crypto deposits are not covered by the deposit insurance that protects bank accounts. A licensed exchange is a safer bet than an unlicensed one — but “licensed” and “risk-free” are not the same words, and no honest guide should pretend they are.
How to Read Blockchain.com’s CER.live Rating Step by Step
Step 1: Open the live CER.live page
Go to cer.live and find Blockchain.com in the exchange ranking. Do not rely on a screenshot or an old article — scores are re-tested and they move. The grade you see today is the only one that counts.
Step 2: Read the score, then the breakdown
Look at the overall score out of 100 and the letter grade, then open the breakdown. Which of the five areas is weakest? A low proof-of-reserves mark means something different from a low server-security mark, and your decision should reflect that.
Step 3: Check the date of the last test
A grade from a year ago is stale evidence. Security is a moving target: teams change, systems change, and new vulnerabilities appear. If the last assessment is old, treat the grade as background, not as current news.
Step 4: Cross-check with two other sources
Compare the CER grade with CoinGecko’s Trust Score, which incorporates CER data, and with an independent review such as Coincub’s Blockchain.com review or WikiBit’s Blockchain Exchange page (which scores Blockchain Exchange at 8.06 out of 10 and records its US and Cayman licences). If all three point the same way, you have a consistent picture. If they disagree, find out why before you deposit. For a sense of how engineers think about the systems behind an exchange, our blockchain engineer guide and our blockchain node guide are useful background.
Step 5: Decide what the rating does not cover
Ask the questions CER does not answer: Are the fees acceptable for how often you trade? Is your country supported? Is the coin you want listed? Is customer support reachable if something goes wrong? A AAA security grade never answers those questions. Our Bitcoin Fed-decision analysis is a reminder that market risk and platform risk are different things — a secure exchange does not protect you from a falling market.
Case Studies: Ratings in Real Life
Case study 1 — Amna’s first exchange deposit. Problem: Amna wanted to trade on Blockchain.com’s exchange but did not know whether to trust it with a deposit. Strategy: She checked the CER.live rating, then read the breakdown instead of stopping at the letter grade. Execution: She confirmed the cold-storage figure and the certifications, noted the thin proof-of-reserves publication, and cross-checked the licences. Results: She deposited a small test amount first, withdrew it successfully, and only then moved a larger sum. Lesson: A rating is a starting point for your own checks, not a substitute for them. A small test deposit costs almost nothing and proves more than any grade.
Case study 2 — the fund manager’s checklist. Problem: A small fund needed to choose an exchange for client money and had to document the decision. Strategy: The manager used CER.live as one of three sources, alongside licence records and proof-of-reserves pages. Execution: Exchanges without a current CER assessment were removed from the shortlist. The rest were scored on fees, liquidity, and support as well as security. Results: The fund picked an exchange that was not the cheapest, but the decision survived an audit because every factor was documented. Lesson: For other people’s money, a rating is evidence in a file. Keep the screenshot, the date, and the breakdown.
Case study 3 — the trader who learned the hard way. Problem: A trader kept all his funds on a small unrated exchange because its fees were the lowest he could find. Strategy: He had never checked a security rating at all. Execution: When the exchange paused withdrawals, he discovered it had no bug bounty, no penetration-test record, and no proof of reserves. Results: His funds were frozen for weeks. He eventually recovered most of them, but the stress and the missed trades cost more than years of fee savings. Lesson: The cheapest exchange is not the cheapest if it cannot return your money. Check the rating before the deposit, not after the problem. Our Ethereum ETF outflow report shows how quickly sentiment turns when trust breaks — the same logic applies to a single exchange.
Case study 4 — the reviewer who found the gap. Problem: A blogger writing about Blockchain.com noticed that every security claim on its website was real, yet one major transparency item was missing. Strategy: She compared what Blockchain.com published against what CER.live tests. Execution: She found strong cold storage and certifications, but no standard public proof of reserves. Results: Her review said the platform was credible and veteran, but marked it down on transparency — and readers told her that single observation was the most useful part of the article. Lesson: What a platform does not publish is information too. A missing proof of reserves is not proof of missing funds, but it is a reason to ask questions.
Tools for Checking Any Exchange
One rating is never enough. The tools below let you cross-check security, reputation, and market data before you deposit anywhere.
1. CER.live. Pros: focused security methodology, published criteria, feeds CoinGecko Trust Score. Cons: covers security only, scores change between assessments. Pricing: free to browse. Best for: the security-first check on any exchange.
2. CoinGecko Trust Score. Pros: combines CER security data with liquidity and trading activity, covers hundreds of exchanges. Cons: a single number hides the reasons behind it. Pricing: free. Best for: a quick first comparison.
3. CoinMarketCap exchange rankings. Pros: volume, liquidity, and market share in one view. Cons: volume figures can be gamed, security detail is thin. Pricing: free. Best for: seeing where an exchange stands in the market.
4. Hacken. Pros: the security firm behind CER, publishes audits and research. Cons: technical reports take time to read. Pricing: free reports, paid audits. Best for: understanding what a penetration test actually checks.
5. Coincub exchange reviews. Pros: scores regulation, security, costs, assets, and support separately. Cons: scores are one firm’s opinion, not a test. Pricing: free. Best for: a balanced review with a clear breakdown.
6. WikiBit. Pros: licence records, regulatory status, and a numeric score (8.06 for Blockchain Exchange). Cons: data quality varies by exchange. Pricing: free. Best for: verifying licences and regulatory claims.
7. Blockchain.com Explorer. Pros: check any transaction or address yourself, free, no account needed. Cons: shows chain data, not exchange custody. Pricing: free. Best for: verifying payments independently, as our explorer guide explains.
8. Coinbase. Pros: large, listed company, strong compliance record, widely rated AAA-adjacent by reviewers. Cons: higher fees, limited coin list in some regions. Pricing: trading fees vary by tier. Best for: a benchmark to compare any other exchange against.
9. Kraken. Pros: long security record, regular proof-of-reserves audits, strong reputation. Cons: interface can feel complex for beginners. Pricing: maker-taker fees from 0.16% / 0.26% on Kraken Pro. Best for: a security-first alternative.
10. Binance. Pros: deepest liquidity, most coins, mature proof-of-reserves system with zero-knowledge proofs. Cons: complex regulatory history, overwhelming for beginners. Pricing: low spot fees from 0.1%. Best for: comparing proof-of-reserves practice at scale — see our corporate treasury analysis for how large holders think about custody.
Common Mistakes When Reading Exchange Ratings
Mistake 1: Treating a grade as a guarantee. AAA means the exchange passed these tests well. It does not mean it cannot be hacked, cannot fail, or cannot freeze your account. No rating in any industry promises that.
Mistake 2: Reading the letter and skipping the breakdown. Two exchanges can share a grade for opposite reasons — one weak on reserves, the other weak on bug bounties. The breakdown tells you which risk you are actually taking.
Mistake 3: Using a stale screenshot. Ratings are re-tested. A grade from last year may not describe the exchange today. Always open the live page.
Mistake 4: Confusing the wallet with the exchange. Blockchain.com’s non-custodial wallet is not rated by CER.live, because there is no company holding your money to rate. The rating covers the custodial exchange. If you only use the wallet, the rating is mostly irrelevant to you — and that is a good reason to understand which product you are actually using.
Mistake 5: Ignoring what is not rated. Fees, coin listings, support, and withdrawal speed are not in the CER score. An exchange can be AAA and still be a bad fit for you. Judge fit and security separately, and only deposit when both pass.
Frequently Asked Questions
What is CER.live?
CER.live is a cybersecurity ranking platform for crypto exchanges, powered by Hacken. It tests exchanges on server security, user security, penetration testing, proof of reserves, and bug bounty programmes, and gives each a letter grade and a score out of 100.
What does the CER.live Blockchain.com rating measure?
It measures the security of Blockchain.com’s custodial exchange — its servers, user protections, penetration testing, proof of reserves, and bug bounty — not its trading fees, coin list, or customer support.
What is a good CER.live score?
Scores around 90 out of 100 earn the top AAA grade. KuCoin and Flipster both scored 90% when they earned AAA in 2025. Most large established exchanges sit in the A to AA range.
Is Blockchain.com safe?
It is a veteran platform with strong security practices: about 95% cold storage, ISO 27001, SOC 2, and CCSS Level 3 certifications, plus licences in Malta, the UK, Singapore, and the Cayman Islands. It does not publish a standard public proof of reserves, which is a transparency gap worth knowing about. No exchange is risk-free.
Does Blockchain.com have proof of reserves?
It does not publish a standard, user-verifiable proof of reserves in the way some rivals do. That is a noted gap in independent reviews, not evidence that funds are missing — but it is a reason to keep deposits modest and to check the live CER.live breakdown.
What is the difference between Blockchain.com’s wallet and its exchange?
The wallet is non-custodial: you hold the keys and Blockchain.com cannot touch your funds. The exchange is custodial: the company holds your deposits. The CER.live rating applies to the exchange.
What fees does Blockchain.com charge?
Typical trading fees are around 0.4% to 0.45% according to independent reviews — higher than the largest global exchanges. Confirm current fees on Blockchain.com’s own site before trading, as they change.
Is Blockchain.com regulated?
Yes, in several jurisdictions. It holds a MiCA licence from Malta (October 2025), covering the European Economic Area, plus licences in the UK, Singapore, and the Cayman Islands, and money transmitter licences in 35 US jurisdictions.
Where can I check the current CER.live rating?
On cer.live itself, on the exchange ranking page. Cross-check with CoinGecko’s Trust Score, which incorporates CER data, and with an independent review before you deposit.
Should I trust a CER.live rating alone?
No. Use it as one of three checks: the CER security rating, the exchange’s licences, and its proof of reserves. Then add a small test deposit and a successful withdrawal before you commit larger sums.
Conclusion
The CER.live Blockchain.com exchange rating is a useful tool, and like every tool it is only as good as the person using it. It tells you how one veteran exchange performs on five specific security tests, judged by an independent firm. It does not tell you whether the fees suit you, whether your coin is listed, or whether the market will go up tomorrow. The right way to use it is the slow way: open the live page, read the breakdown, note the weakest area, cross-check the licences, and then prove the exchange with a small deposit and a real withdrawal.
Blockchain.com earns its reputation as a veteran — old, licensed in several places, careful with cold storage, and certified by outside auditors — and it also carries a real transparency gap on proof of reserves that a careful reader should not ignore. Hold both facts at once. That is what a rating is for: not to make the decision for you, but to show you exactly where to look before you make it yourself. When did you last check the security rating of the exchange holding your money?
