The main difference is who holds the coins. On a centralized exchange (CEX) you deposit your assets with a company, and it holds them and matches your trades. On a decentralized exchange (DEX) you trade straight from your own wallet through smart contracts, so you keep control of the assets. Ethereum's DeFi documentation puts the difference this way: with a centralized exchange "you have to deposit your assets before the trade," while with a DEX "you never give up control of your assets." Most of the other differences, including risk, fees, identity checks and regulation, come from that one choice about custody.
How a centralized exchange works
A centralized exchange is run by a company. You open an account, move funds in, and the company holds them while you trade. Your balance on the platform is a claim on that company. The coins are not sitting in a wallet you control.
That arrangement has known strengths. A 2024 systematic literature review by Sascha Hägele of Saarland University, published in Electronic Markets (vol. 34), covers research from January 2019 to September 2023. It found that CEXs "offer higher liquidity, advanced trading features, and a more established track record."
The trade-off is trust in one operator. The U.S. SEC's investor bulletin "Crypto Asset Custody Basics for Retail Investors" (December 12, 2025) warns: "If the third-party custodian is hacked, shuts down, or goes bankrupt, you may lose access to your crypto assets." Ethereum's DeFi page also notes that "centralized exchanges are attractive targets for hackers." An older SEC bulletin, "Holding Your Securities," adds that some crypto intermediaries have gone through bankruptcy, and it is unclear how much of their holdings, if any, customers can get back.
How a decentralized exchange works
Ethereum.org's glossary defines a decentralized exchange as "a type of Ethereum app that lets you swap tokens with peers on the network." Trades run through smart contracts, which are programs on a blockchain that carry out the terms of a trade automatically. Many DEXs price trades with an automated market maker (AMM) instead of an order book. An AMM uses a liquidity pool, which ethereum.org describes as "a collection of funds locked in a smart contract and used to facilitate trading on a decentralized exchange." The Hägele review notes growing research on how AMM pricing functions are designed.
Because the coins stay in your wallet until the contract settles the swap, there is no company holding a pooled balance on your behalf. The review says DEXs "emphasize decentralization, user control, and resistance to censorship." Ethereum.org adds that limit orders, perpetuals and margin trading are all possible on decentralized platforms, so these features are no longer limited to centralized venues.
Self-custody brings its own risks:
- Keys. The SEC custody bulletin says: "If you lose your private key, you permanently lose access to the crypto assets in your wallet." No support desk can reset it.
- Code. Ethereum.org notes that DeFi products, "like any software, can suffer from bugs and exploits."
- Trade ordering. Pending transactions are public before they are confirmed. Ethereum.org's page on maximal extractable value (MEV) explains that searchers can buy just before a large DEX trade and sell just after it. This is called a sandwich attack, and "users who are sandwiched face increased slippage and worse execution on their trades."
Fees: trading fees vs network gas
Costs work differently on the two models. A centralized exchange sets its own trading fees, and moving coins off the platform is usually charged separately. On an Ethereum-based DEX you also pay gas, the network fee for running the transaction. According to ethereum.org, the fee equals the gas used multiplied by the base fee plus a priority fee. The base fee rises when blocks are fuller than the target, by up to 12.5% per block, and it is burned. When demand is high, users "must offer higher tip amounts to try and outbid other users' transactions." The gas fee is charged even if the transaction fails. The total cost of a small DEX trade therefore depends on how busy the network is when you send it.
Which exchange risks apply to you?
Answer a few questions about where your coins sit after a trade to see which risks from this explainer you should check first.
After the trade, who holds the coins?
- A company holds them in my account on the platform → next question
- They stay in my own wallet and I swap through smart contracts → next question
- I am not sure → Find out who holds the coins first
Have you found out whether the custodian insures against loss or theft, lends out deposited assets, or commingles customer holdings?
- Yes, I know the answer to all three → Your main risk is the operator
- Not yet → Ask the custodian three questions
Is your private key or recovery phrase backed up somewhere other than the device you trade from?
- Yes, and I know what I would do if the device were lost → next question
- No, or I am not sure → Back up your key before anything else
Before you send an on-chain swap, do you check the current gas cost and set a slippage limit?
- Yes, both → Your remaining risk is the code
- Not always → Check gas and slippage on each swap
Custody decides most of the other differences. If you deposited assets with a company, your balance is a claim on that company. If the coins stay in your own wallet until a smart contract settles the swap, you hold them yourself. Answer this before comparing fees or features.
The SEC custody bulletin warns that if a third-party custodian is hacked, shuts down or goes bankrupt, you may lose access to your crypto assets. It suggests asking whether the custodian insures against loss or theft, whether it lends out deposited assets, and whether it commingles customer holdings.
With those answers in hand, the risk that remains is the operator itself: a hack, a shutdown or a bankruptcy. An SEC bulletin notes that when crypto intermediaries have gone bankrupt, it is unclear how much, if anything, customers can get back. Moving coins off the platform is usually charged separately from trading fees.
The SEC custody bulletin says that if you lose your private key, you permanently lose access to the crypto assets in your wallet. No support desk can reset it. Decide where the key or recovery phrase is backed up and what happens if the device is lost.
On an Ethereum-based DEX you pay gas, and it is charged even if the transaction fails. When demand is high, users must offer higher tips to outbid others. Pending transactions are public, so a large swap can be sandwiched, leaving you with more slippage and worse execution.
With the key backed up and gas and slippage checked, the risk that remains is the software. Ethereum.org notes that DeFi products, like any software, can suffer from bugs and exploits. Whether identity checks apply depends on whether someone controls the service.
This checklist covers only the general risks named in the explainer: it does not assess any specific platform, give current fee levels or incident rates, or say which model you should use.
DEXs are non-custodial: cryptocurrency remains in each user’s wallet.
Identity checks and regulation
The Hägele review found that Know Your Customer (KYC) and anti-money laundering (AML) requirements feature prominently in the research and shape which exchange traders and policymakers choose. Centralized platforms usually verify customers' identity. Whether a decentralized service has to do the same depends on who, if anyone, controls it:
- FATF. The Financial Action Task Force's updated guidance on virtual assets (October 28, 2021) says a DeFi application, meaning the software itself, is not a virtual asset service provider (VASP). Creators, owners and operators who keep control or sufficient influence over the arrangement may still count as VASPs. Calling a project "decentralized" does not settle the question. (This summary comes from Davis Polk's published analysis of the guidance. The FATF document itself could not be retrieved for this update.)
- EU (MiCA, Regulation (EU) 2023/1114). Recital 22 says that "where crypto-asset services are provided in a fully decentralised manner without any intermediary, they should not fall within the scope" of the regulation. Services where only part of the activity is decentralised remain in scope, and the regulation does not define "fully decentralised."
In practice, many products sit between the two models. The Hägele review notes that the literature names hybrid exchanges as an option but describes them only loosely.
Side-by-side comparison
| Topic | Centralized exchange | Decentralized exchange |
|---|---|---|
| Custody | Company holds your deposited assets | Assets stay in your wallet until the swap settles |
| Main failure risk | Hack, shutdown or bankruptcy of the operator (SEC) | Lost keys, smart-contract bugs, sandwich attacks (SEC, ethereum.org) |
| Fees | Platform trading fees | Protocol fees plus network gas, which moves with demand |
| Identity checks | KYC/AML usually required | Depends on whether someone controls the service (FATF, MiCA) |
| Stated strengths | Liquidity, advanced features, track record (Hägele 2024) | Decentralization, user control, censorship resistance (Hägele 2024) |
Questions to ask before using either
- After the trade, who holds the coins: you or a company?
- For a custodian: the SEC bulletin suggests finding out whether it insures against loss or theft, whether it lends out deposited assets, and whether it commingles customer holdings.
- For self-custody: where is your private key or recovery phrase backed up, and what happens if that device is lost?
- For an on-chain swap: what is the gas cost right now, and what slippage limit have you set?
Related explainers: what KYC is, how a non-custodial wallet keeps keys and backups, how Ethereum smart contracts work and why crypto prices differ between exchanges.
Limitations: this explainer covers general models, not any specific platform, and it gives no current fee levels or incident rates.
