When an exchange or custodian may carry legal responsibility

Start with the service, not the label

Platforms use terms such as exchange, broker, custodian and wallet provider, but liability turns on what the entity actually undertook. Did it hold private keys, execute instructions, select tokens, provide advice, operate an order book or merely supply software? The customer agreement, interface and marketing must be compared with the operational reality.

Potential claims may arise from unauthorised transfers, security failures, account restrictions, misleading statements, conflicts, market conduct, negligent operations or breach of custody obligations. Regulatory duties may inform the standard expected, but they do not automatically determine private civil liability in every forum.

Causation is often contested

A platform may argue that credentials were compromised on the customer’s device, that instructions were valid, or that a token’s collapse was a market event outside its control. The claimant must preserve login records, authentication messages, device evidence, support tickets, transaction history and the exact sequence of warnings and actions.

Custody structures also affect recovery. Assets may be held in omnibus wallets, delegated to another custodian or subject to insolvency terms. Clients should understand whether they own identifiable assets, have a contractual claim, or face a trust and segregation question if the provider fails.

Regulation is jurisdiction-specific

Dubai, DIFC and ADGM operate distinct virtual-asset and financial-services frameworks. A business model lawful in one perimeter may require different authorisation, assessment and controls in another. Before asserting or resisting liability, identify the entity, regulator, activity, customer category and version of the rules applicable at the relevant time.