David Mercer runs LMAX. He has been arguing, in interviews and at industry conferences, that crypto's institutional layer should adopt the best of centralization — regulated matching engines, transparent order books, fair access for participants regardless of size — without throwing out non-custodial settlement. I think the argument is correct. I also think almost everyone responding to it is talking past him.
What follows is not a defense of CEXs. It is a debunk of six things people repeat about centralization in crypto that fall apart the moment you read the actual exchange data. Concede the strongest point — Mercer is right that the market microstructure of regulated venues works better than the spaghetti of CEX matching engines we have today — and then look at the receipts.
Myth: All Centralized Exchanges Carry Equivalent Risk After FTX
This one comes from the post-November-2022 trauma. FTX collapsed, ergo every CEX is one disclosure away from the same outcome. Risk is binary: custodial = unsafe, self-custody = safe.
The data does not support binary framing. CER security scores across the top five CEXs by volume range from 8.5 (MEXC) to 9.4 (Binance), with Bybit at 9.1, OKX at 9.3, and Bitget at 8.9. That is a one-point spread on a ten-point scale — a meaningful gradient, not a uniform red zone. Reserve status differs even more sharply. Four of the five carry "verified" Proof-of-Reserves attestations; MEXC's is flagged "partial." Last-audit dates: Binance 2025-03-01, OKX 2025-03-01, Bybit 2025-03-12, Bitget 2025-02-20, MEXC 2024-12-10. The freshest verified PoR is fifteen months old as you read this. The MEXC audit is approaching eighteen months stale.
If you treat all CEXs as equal-risk after FTX, you are flattening a real signal. The post-FTX disclosure environment did produce a sorting — exchanges that can demonstrate timely, fully-verified reserves versus exchanges that cannot. The sorting is loud once you look. The discourse pretends it does not exist.
Practical implication: when you map venues, do it by tier on the CER + PoR axis, not by "CEX or not."
Myth: A Licensed Exchange Is a Licensed Exchange
People hear "licensed in Dubai" or "licensed in Cyprus" and assume parity. Regulator names blur into a single bullet point in the marketing footer.
The grounding data shows that licensing is layered. Binance holds a full VARA license in Dubai (tier 2) and limited licenses with AMF France and OAM Italy (both tier 2). Bybit holds full licenses with CySEC and VARA — two tier-2 regimes, no limitations. OKX holds VARA only as a provisional license and a full Bahamas SCB license at tier 3. Bitget operates with full licenses in Lithuania (FCIS) and Poland (KNF), both tier 2. MEXC operates with a single Seychelles FSA offshore license at tier 3.
Read that again. "Licensed" covers everything from Bybit's two-jurisdiction full tier-2 footprint to MEXC's single offshore tier-3 registration. The label is identical. The substance is not.
The Mercer argument lands here. The reason regulated FX venues like LMAX can offer fair price discovery is that they run inside one regulatory perimeter that defines what fair means. Crypto has perimeters too — they just sit at very different levels of severity. Pretending they are interchangeable is the part of the discourse that mostly serves the venues with the weakest oversight.
Practical implication: when you read "regulated," ask which jurisdiction, which license type, and which tier. The footer rarely tells you.
Myth: Higher Leverage Means a More Sophisticated Platform
This one I see repeatedly in retail forums. "Bybit only offers 100x but MEXC goes to 200x, so MEXC is the more advanced platform." The reasoning treats leverage ceiling as a proxy for product depth.
The data inverts it. MEXC offers 200x maximum leverage on futures. It also has the lowest CER security score of the five (8.5), the only "partial" PoR status, and the only offshore-only license in the group. Binance and Bitget both cap futures at 125x — and both run verified PoR with multiple in-perimeter licenses. Bybit and OKX cap at 100x and carry the cleanest licensing footprints in the set.
The pattern is not sophistication correlates with leverage. The pattern is the opposite. Higher maximum leverage tracks weakest oversight. This is the data point nobody wants to print in their fee-comparison post because it implies that the venue advertising the most aggressive product is precisely the venue with the thinnest regulatory and reserve infrastructure to absorb the consequences when those positions blow up.
I will say this carefully. There are perfectly reasonable retail users for 100x or 125x venues. There are vanishingly few reasonable retail users for 200x exposure on a venue with a stale partial PoR.
Practical implication: leverage ceiling is a marketing number. Treat it as such, not as a quality signal.
Myth: Verified Proof of Reserves Means the Exchange Is Solvent
This is the one I want to nail. The phrase "Proof of Reserves" performs work it does not earn.
A PoR attestation, in every public methodology I have seen, demonstrates assets. It does not demonstrate liabilities. An exchange can hold a billion dollars of customer-attributable Bitcoin in cold storage and still owe customers two billion dollars net of off-balance-sheet positions. The attestation does not catch the gap. FTX, infamously, would have failed a real liabilities audit. The asset side did not look that bad until the very end.
Now look at the freshness. Binance's last audit is 2025-03-01. OKX 2025-03-01. Bybit 2025-03-12. Bitget 2025-02-20. The newest of the verified set is fifteen months old. MEXC's is "partial" and dates to 2024-12-10 — eighteen months stale. PoR is a point-in-time snapshot of one side of the balance sheet. Eighteen months is a long time for the unaudited side to move.
Mercer's argument applies precisely here. The reason traditional regulated venues do not need to perform PoR is that their solvency is continuously supervised by an actual regulator with subpoena power. Crypto's PoR is a workaround for the absence of that supervision — useful, partial, not equivalent.
Practical implication: read the audit date. Treat anything past twelve months as informational, not protective.
Myth: Lower Fees Always Mean a Better Deal
The fee comparison is where most exchange listicles live and die. MEXC charges 0% maker and 0.02% taker on spot, which is the lowest in the set by a wide margin. Binance, Bybit, and Bitget all charge a flat 0.1%/0.1%. OKX runs 0.08%/0.1%.
A naive deal-shopper goes to MEXC. Easy call.
Now layer on what you already know. MEXC: tier-3 offshore-only license, partial PoR last audited 2024-12-10, CER 8.5. Bybit at 0.1%/0.1%: two full tier-2 licenses (CySEC + VARA), verified PoR audited 2025-03-12, CER 9.1. OKX at 0.08%/0.1%: VARA provisional plus Bahamas SCB full tier 3, verified PoR audited 2025-03-01, CER 9.3.
The fee spread between MEXC and Bybit on a $10,000 spot trade is two dollars. Two dollars. That is the price of the regulatory and reserve infrastructure delta you are buying — or skipping. The "lower fee = better" framing assumes the products are otherwise identical, which they are demonstrably not.
This is the part of the Mercer thesis that hits hardest. Centralized infrastructure costs money to maintain properly. Venues that have built it charge for it. Venues that have not undercut on price because that is the only lever they have left.
Practical implication: when you compare fees, comparison-shop the licensing, PoR freshness, and CER score in the same view. A spreadsheet with three columns, not one.
Myth: More Listed Pairs Means Deeper Liquidity
The last one is structural and almost nobody runs the math. The assumption is that more listed pairs equal a richer venue.
Look at pairs per dollar of volume. Binance: 1,850 pairs against $18.5B daily volume — roughly $10M per pair per day. OKX: 720 pairs, $4.9B volume — roughly $6.8M per pair. Bybit: 970 pairs, $9.2B volume — roughly $9.5M per pair. Bitget: 830 pairs, $6.1B — roughly $7.3M per pair.
MEXC: 2,400 pairs, $3.8B volume — roughly $1.6M per pair per day.
MEXC lists more pairs than any other venue in the set and has the thinnest per-pair liquidity by a factor of four to six. The 2,400-pair number is doing marketing work, not market-microstructure work. For any pair outside the top fifty most-traded, the spread on a tiny-volume venue gets ugly fast — and that is exactly where retail tends to hunt for the next 10x.
Mercer's argument about centralization-done-right is fundamentally a market-microstructure argument. Fair price discovery requires depth. Depth requires concentration of order flow, not dispersion of it across thousands of dead pairs. The venue counts that retail uses to evaluate "selection" are inversely related to the property that actually matters.
Practical implication: ignore pair count. Look at daily volume divided by pair count, and read it as a proxy for the average book you will actually trade against.
What to Actually Believe
Mercer's underlying point is that crypto adopted the worst parts of decentralization (slow settlement on unaudited venues, opaque liabilities, leverage ceilings calibrated by marketing rather than risk teams) while skipping the parts of centralization that actually work (continuous solvency supervision, regulated matching, fair access). The discourse has spent three years arguing about whether centralization is good or bad as a binary. That is the wrong axis. The right axis is which centralized infrastructure components — and which decentralized ones — actually serve the user.
The five exchanges in this analysis tell that story. They share the label "centralized." They diverge on every variable that decides whether the centralization helps you or hurts you: license tier, PoR audit recency, reserve coverage status, CER score, leverage discipline, fee-versus-infrastructure ratio, and pair-count-versus-volume sanity. A user who reads only the label is choosing blind.
If you trade on a CEX, pick the one whose centralization is doing real work — supervised, current, audited, reasonably priced for what you are buying. If you self-custody, do so for reasons that survive the math, not for reasons that pattern-match to the FTX trauma. Both can be the right call. Neither is automatic.
Watch four signals over the next twelve months: (1) PoR audit frequency moving from annual to quarterly across the top-tier set, (2) VARA Dubai license upgrades — provisional to full — landing on OKX and any new entrants, (3) any tier-2 regulator publishing a real liabilities audit standard for licensed CEXs, and (4) the per-pair volume ratio at MEXC either compressing toward peer averages (organic depth catching up to listings) or continuing to widen (pair count as pure marketing). Each one updates the picture. None of them will move the discourse — but that is the point of the discourse this publication exists to argue against.
FAQ
How fresh do exchange Proof-of-Reserves audits actually need to be to mean anything?
Industry consensus has not landed on a standard, but practitioners typically treat anything past twelve months as informational rather than protective. As of mid-2026, the cleanest PoR dates in the top-five set are Bybit at 2025-03-12 and OKX at 2025-03-01 — both around fifteen months stale. MEXC at 2024-12-10 with "partial" coverage is the outlier. If your venue's last audit is approaching the eighteen-month mark, the attestation is a historical document, not current evidence.
Does a Dubai VARA license mean an exchange is fully regulated?
Not by itself. VARA issues distinct license types — full, provisional, limited — at different tiers. Binance and Bybit both hold full VARA licenses at tier 2. OKX holds a provisional VARA license, which carries narrower operating scope. The phrase "licensed in Dubai" in marketing copy compresses all of these into one bullet point. Always look at license type and supervisory tier, not just the regulator name.
Why do exchanges with higher leverage tend to have weaker regulatory footprints?
The pattern in the data is consistent: MEXC at 200x runs on a single Seychelles offshore tier-3 license with partial PoR. Binance and Bitget at 125x carry tier-2 licenses with verified PoR. The mechanism is not mysterious — tier-1 and tier-2 regulators impose product restrictions on leverage marketed to retail. Offshore venues face no such restriction and use leverage ceiling as a competitive lever, especially against retail traders who read ceiling as a quality signal.
Is paying 0% maker / 0.02% taker on MEXC actually cheaper than 0.1% on Bybit?
On the fee line alone, yes — by roughly $2 per $10,000 spot trade. But the comparison is not apples to apples. Bybit at 0.1%/0.1% carries two full tier-2 licenses (CySEC and VARA), a verified PoR audit from March 2025, and a CER score of 9.1. MEXC's spread saves you cents per trade and costs you a meaningful step down in regulatory and reserve infrastructure. The fee delta is the price of that infrastructure, not arbitrary markup.
What does "verified" Proof of Reserves not show?
Liabilities. Every PoR methodology I have read attests to the asset side of the balance sheet — wallets, balances, customer-attributable holdings. None of them, on their own, demonstrate that the exchange does not owe more than it holds. An attestation can be fully verified and the venue can still be insolvent on a net basis. This is why regulated financial venues require liability audits, not asset attestations. PoR is partial information presented in language that suggests it is more.
How should I read pair count when choosing an exchange?
Read it against daily volume, not in isolation. MEXC lists 2,400 pairs against $3.8B daily volume — about $1.6M of volume per pair per day. Binance lists 1,850 pairs against $18.5B — about $10M per pair. The Binance book on any given mid-tier pair is roughly six times deeper. For anything outside the top fifty most-traded pairs, this difference dominates execution cost. Pair count alone is a selection illusion.
Where does Coinbase fit in this picture compared to the Asia-headquartered venues?
Coinbase operates in a fundamentally different regulatory regime — US BitLicense, FinCEN, FCA in the UK — which imposes very different product, leverage, and disclosure constraints than VARA, CySEC, or Seychelles FSA. Direct cross-comparison on fee or pair-count axes misses the structural difference. For a US or UK user, the relevant comparison is usually Coinbase versus Kraken, both inside the same supervisory perimeter. The five venues analyzed here compete primarily for users outside those jurisdictions.
Is Mercer's argument an argument against self-custody?
No, and reading it that way is the most common misread. The argument is about market microstructure — how price discovery, matching, and settlement work at the venue layer — not about who holds the keys. A regulated matching engine with non-custodial settlement is conceptually possible and arguably the structure the industry should be building toward. The myth-debunk above is about the venue layer; the custody question sits orthogonal to it.