Phemex review: can a mid-size futures exchange recover from a $73M hack?
Phemex advertises 150x leverage and 0.01% maker fees, but January 2025 brought a $73 million hot wallet breach. We opened an account, checked the proof-of-reserves dashboard, and weighed the fee schedule against what happened after the attack.
6.4out of 106.4
Our verdict
Phemex covered every dollar lost in the January 2025 hack and restored withdrawals within three days, which is a genuinely strong recovery by exchange-hack standards. That does not erase the fact that a hot wallet holding tens of millions was compromised in the first place, and Phemex remains unregulated with no deposit protection scheme behind it. The fees are competitive and the reserve dashboard is unusually transparent for its size, but this is a venue for traders who can absorb another incident, not a first futures account.
Best for: Experienced futures traders who already diversify custody across exchanges
On January 23, 2025, someone drained Phemex hot wallets across sixteen blockchains for roughly $73 million. We funded a test account four months later specifically to see what a mid-size derivatives exchange looks like on the other side of its own worst day.
Phemex has run since 2019 as a Singapore-based futures venue, pitched at traders who want leverage and low contract fees without the scale of Binance or the compliance overhead of Coinbase. That positioning was already a harder sell before January. It is a different conversation now.
The fee sheet that got us in the door
Phemex markets contract maker fees as low as 0.01%, with takers at 0.06% before VIP discounts. Spot trading sits at a flat 0.1% for both sides, standard for the category. VIP tiers push taker fees down toward 0.0325% and eliminate maker fees entirely, numbers that beat Kraken and sit close to Binance for anyone clearing serious volume.
The published fee page ties every discount to a VIP tier, not a flat public rate
The fee page itself shows dashes where your actual rate would appear, a detail worth knowing before you assume the headline number applies without logging in. Leverage runs up to 150x on select futures pairs, well past what a regulated broker would offer a retail account, and worth respecting rather than chasing. A liquidation at that multiple takes a fraction of a percent move against you, and Phemex's own risk documentation says as much in its margin calculator disclosures.
What actually happened in January
Attackers gained access to hot wallets and moved funds across Ethereum, BSC, Polygon, Optimism, Base, Arbitrum and ten more chains in over 125 transactions. Hacken's analysts, and separate reporting pointing to North Korea-linked actors, described losses of roughly $20 million on Ethereum, $17 million on Solana, $13 million in XRP and $5.3 million in Bitcoin. The likely root cause: compromised private keys, possibly stored together across multiple hot wallets, a design choice that turns one breach into many. Stolen stablecoins were converted quickly into ETH, a common move that makes blacklisting the funds far harder once they leave the original chain.
Phemex suspended deposits and withdrawals immediately. What separates this incident from most exchange hacks is what came next: Phemex covered every dollar of the loss from its own balance sheet and had withdrawals fully restored within three days, a recovery speed that outpaces most comparable breaches in the sector.
The reserve dashboard we actually checked
Live reserve ratios by asset, each backed by a listed cold wallet address
Post-hack, Phemex moved custody to Fireblocks MPC and published a proof-of-reserves page that lists per-asset ratios alongside cold wallet addresses you can verify independently. At the time we checked, BTC sat at 104%, ETH at 121.5%, and stablecoin reserves (labeled USD*) at 103.15%, all above full backing. Smaller assets showed even wider buffers: SOL at 148.40%, XRP at 153.55%, SUI at 196.04%. This is more granular than what most exchanges of Phemex's size publish, and it is the kind of transparency that should have existed before the hack, not only after it. We cross-checked one BTC cold wallet address against a public block explorer and the listed balance matched what the dashboard claimed.
Where the trading floor holds up
The futures terminal in dark mode, with the margin panel open beside the chart
Away from the security story, the terminal itself is a normal, competent futures interface: order book, margin panel and chart in the layout traders on Bybit or OKX would recognize immediately. Nothing about the trading experience explains the fee advantage or the risk; both are separate decisions. Order execution on our test trades filled within a second on BTC/USDT during normal hours, with no unusual slippage against the visible book.
Who this actually suits
A trader running a market-neutral basis strategy across several venues has a use for Phemex's fee tier once volume clears the VIP threshold. Someone parking a full trading balance in one place, without a plan for what happens if withdrawals freeze again, does not.
Verdict
Phemex passed the test that matters most after a breach: it made every affected user whole and moved fast. It failed the test that matters before one: a hot wallet holding tens of millions across that many chains should never have been reachable through a single compromise, and Phemex remains outside any regulatory compensation scheme if a second incident goes differently. The fees are genuinely competitive and the reserve dashboard is a real transparency upgrade worth checking before you fund an account. Use Phemex for a defined slice of futures exposure you can afford to lose access to for a few days, never as the only exchange holding your capital.
What we liked
Contract maker fee as low as 0.01%, undercutting most mid-size rivals
Public proof-of-reserves page listing wallet addresses and per-asset ratios above 100%
Covered the full $73 million lost in the January 2025 hack from its own funds
Withdrawals restored within three days of the breach, faster than most comparable incidents
Upgraded to Fireblocks MPC custody after the attack
What held it back
Hot wallets holding tens of millions were compromised across sixteen chains in January 2025
Phemex is not regulated, so there is no statutory compensation scheme behind its own guarantee
Spot fees sit at a flat 0.1% maker and taker, no discount tier without VIP volume
