{"investigation":{"slug":"deribit","entity_name":"Deribit","trust_score":72,"severity_base":null,"score_modifier":20,"confidence":0.82,"status":"published","content_type":"investigation","summary":"Deribit is a crypto options and futures exchange founded in 2016 in the Netherlands by John and Marius Jansen, historically operated through a Panama-registered entity and now licensed under Dubai's VARA framework as Deribit FZE. The exchange suffered a $28 million hot wallet compromise on November 1, 2022, covering the loss entirely from its own balance sheet. Coinbase completed the acquisition of Deribit for approximately $2.9 billion on August 14, 2025, making it a subsidiary of a publicly traded, NASDAQ-listed U.S. company.","sections":[{"content":"Deribit was founded in June 2016 by brothers John Jansen and Marius Jansen, along with co-founder Sebastian Smyczinski. John Jansen was previously an options trader on the Amsterdam Exchange and began exploring Bitcoin in 2012. The platform initially focused on Bitcoin futures and options and was incorporated through DRB Group B.V., a Dutch-registered holding company, with an operating entity DRB Panama Inc. incorporated in Panama. Early investors included crypto investment firms XBTO and 10T Holdings. Three Arrows Capital (3AC) held an indirect stake of approximately 16% via a Singapore Special Purpose Vehicle starting around February 2020, though 3AC's collapse in 2022 left Deribit as a creditor owed approximately $80 million in unpaid loans and negative trading account balances. Deribit grew to become the dominant global venue for crypto options by volume. In 2024 it processed approximately $1.2 trillion in trading volume, a 95% year-over-year increase. As of January 1, 2025, the exchange migrated its primary operations to Deribit FZE, a Dubai entity licensed by VARA. On August 14, 2025, Coinbase completed the acquisition of Deribit for approximately $2.9 billion in cash and stock, making Deribit a wholly-owned subsidiary of Coinbase Global, Inc.","heading":"Background","sources":[{"url":"https://blog.mexc.com/wiki/who-is-deribit-founder/","name":"","type":"other","credibility":3},{"url":"https://www.coindesk.com/business/2022/07/01/blockchaincom-deribit-among-creditors-that-pushed-for-3ac-liquidation-report","name":"","type":"other","credibility":3},{"url":"https://www.coindesk.com/business/2025/05/08/coinbase-buys-deribit-for-usd2-9b","name":"","type":"other","credibility":3},{"url":"https://www.theblock.co/post/366957/coinbase-completes-2-9-billion-cash-and-stock-acquisition-of-deribit","name":"","type":"other","credibility":3}],"severity":"medium"},{"content":"On November 1, 2022, just before midnight UTC, Deribit's hot wallet server was compromised by an unauthorized party. Hackers gained access to the exchange's wallet server, enabling them to initiate withdrawals from Deribit's hot wallets. Approximately $28 million in BTC, ETH, and USDC was drained. The exchange immediately halted all withdrawals — including those via third-party custodians Copper Clearloop and Cobo Loop — pending security review. On-chain analysts subsequently observed that the compromised assets did not move until November 5, 2022, when funds began flowing to the cryptocurrency mixer Tornado Cash. Deribit confirmed that client assets held in cold storage were not affected, consistent with the company's stated policy of keeping 99% of user funds offline. The full $28 million loss was covered from Deribit's own balance sheet assets, distinct from its separate $40 million insurance fund. The exchange stated it remained 'in a financially sound position' and that ongoing operations would not be impacted. Normal on-chain withdrawals resumed by November 2, 2022. Post-incident, Deribit migrated its entire hot wallet infrastructure to Fireblocks and implemented a requirement that all hot wallet withdrawals receive manual human confirmation by a Deribit administrator. The exact attack vector was not publicly disclosed; the company appointed three specialist forensic firms to investigate.","heading":"The Hot Wallet Hack","sources":[{"url":"https://www.coindesk.com/business/2022/11/02/crypto-exchange-deribit-loses-28m-in-hot-wallet-hack","name":"","type":"other","credibility":3},{"url":"https://insights.deribit.com/exchange-updates/1-november-incident-report-and-next-steps/","name":"","type":"other","credibility":3},{"url":"https://decrypt.co/113334/crypto-exchange-deribit-hacked-28m-bitcoin-ethereum-usdc","name":"","type":"other","credibility":3},{"url":"https://www.bloomberg.com/news/articles/2022-11-02/crypto-derivative-exchange-deribit-lost-28-million-in-a-hot-wallet-hack","name":"","type":"other","credibility":3}],"severity":"medium"},{"content":"Deribit's regulatory history has been marked by a deliberate jurisdictional migration. The exchange originally operated under DRB Panama Inc., which was explicitly unregulated by the Superintendencia del Mercado de Valores in Panama or any other financial regulator for its brokerage services. The Dutch holding company DRB Group B.V. required Deribit to comply with EU sanctions, which led to the exclusion of Russian traders following 2022 EU sanctions. In April 2024, Deribit FZE, the Dubai-registered entity, received a conditional Virtual Asset Service Provider (VASP) license from Dubai's Virtual Assets Regulatory Authority (VARA) for VA Exchange Services — the first derivatives exchange to receive a full market product license from VARA. VARA reference number VL/23/12/002 is publicly disclosed. Effective January 1, 2025, institutional and qualified investors became direct clients of Deribit FZE under the VARA license, while retail clients continued to be serviced by DRB Panama operating as a broker-member of Deribit FZE. The United States has remained a restricted jurisdiction throughout Deribit's history; U.S. residents and territories including Puerto Rico and Guam are blocked from trading. Following the Coinbase acquisition that closed on August 14, 2025, Deribit now operates as a subsidiary of a publicly traded U.S. company regulated by U.S. securities laws, which may affect future regulatory posture.","heading":"Regulatory Status","sources":[{"url":"https://www.coindesk.com/business/2024/04/02/crypto-exchange-deribits-dubai-based-entity-wins-conditional-vasp-license","name":"","type":"other","credibility":3},{"url":"https://insights.deribit.com/exchange-updates/deribit-first-derivatives-exchange-to-receive-vara-regulatory-approval/","name":"","type":"other","credibility":3},{"url":"https://insights.deribit.com/exchange-updates/deribit-to-launch-1-jan-2025-as-a-fully-licensed-spot-and-derivatives-exchange-in-dubai-uae/","name":"","type":"other","credibility":3},{"url":"https://support.deribit.com/hc/en-us/articles/25944499603357-Regulation-And-Governance","name":"","type":"other","credibility":3},{"url":"https://www.sec.gov/Archives/edgar/data/0001679788/000167978825000086/coin-20250508.htm","name":"","type":"other","credibility":3}],"severity":"medium"},{"content":"Deribit maintains several publicly disclosed user protection mechanisms. Approximately 99% of user deposits are held in cold storage using a multi-signature, split private key system, with private keys stored in geographically distributed, military-grade offline vaults and bank-safe deposit boxes. Following the November 2022 hack, the remaining hot and warm wallet operations were migrated to Fireblocks, a specialist institutional custody provider, with mandatory human administrator confirmation required for all hot wallet withdrawals. Deribit operates an insurance fund that covers negative equity from bankrupt traders, protecting winning traders from counterparty default; the fund balance is publicly visible on Deribit's website. Clients also benefit from Copper's crypto crime insurance policy, reported to cover up to $500 million. Deribit's response to the November 2022 breach — covering the $28 million loss from balance sheet reserves without drawing on the insurance fund or impacting client funds — is cited as evidence of financial resilience, though it also demonstrates that hot wallet risk existed prior to the remediation. The exchange has consistently disclosed custody procedures and supported withdrawal address whitelisting with time delays for users.","heading":"User Protections","sources":[{"url":"https://support.deribit.com/hc/en-us/articles/25944547383453-Custody-Policy","name":"","type":"other","credibility":3},{"url":"https://insights.deribit.com/exchange-updates/1-november-incident-report-and-next-steps/","name":"","type":"other","credibility":3},{"url":"https://support.deribit.com/hc/en-us/articles/25944777576477-Insurance-Fund","name":"","type":"other","credibility":3}],"severity":"medium"},{"content":"Deribit's primary documented risk event is the November 1, 2022 hot wallet compromise that resulted in a $28 million loss. The attack vector was never publicly disclosed, and stolen funds were routed through Tornado Cash, a sanctioned mixer, making recovery effectively impossible. While the exchange absorbed the loss without client impact, the incident demonstrated a pre-existing vulnerability in hot wallet infrastructure that persisted despite Deribit's status as the world's leading crypto options platform. A secondary risk factor was Deribit's exposure to Three Arrows Capital: 3AC held an approximately 16% indirect stake in Deribit and owed approximately $80 million in unpaid loans and negative trading balances at the time of 3AC's collapse in 2022. Deribit was among creditors that pushed for 3AC's liquidation, suggesting the exposure was material but ultimately managed. Jurisdictional risk has been partially mitigated by the 2024-2025 migration to a VARA-licensed Dubai entity, though retail clients remain serviced through unregulated DRB Panama. U.S. persons are barred from the platform. The completed Coinbase acquisition in August 2025 meaningfully alters the risk profile: Deribit is now a subsidiary of a publicly traded, NASDAQ-listed, SEC-reporting company with regulatory obligations in the United States, providing a degree of institutional oversight that was not previously present. Ongoing risks include the inherited history of unregulated operation, the unsolved 2022 hack, and Tornado Cash-linked fund flows which may attract regulatory scrutiny.","heading":"Risk Assessment","sources":[{"url":"https://www.coindesk.com/business/2022/11/02/crypto-exchange-deribit-loses-28m-in-hot-wallet-hack","name":"","type":"other","credibility":3},{"url":"https://cointelegraph.com/news/source-claims-3ac-s-deribit-exposure-is-worth-much-less-than-reported","name":"","type":"other","credibility":3},{"url":"https://www.coindesk.com/business/2022/07/01/blockchaincom-deribit-among-creditors-that-pushed-for-3ac-liquidation-report","name":"","type":"other","credibility":3},{"url":"https://www.theblock.co/post/366957/coinbase-completes-2-9-billion-cash-and-stock-acquisition-of-deribit","name":"","type":"other","credibility":3},{"url":"https://www.sec.gov/Archives/edgar/data/0001679788/000167978825000207/q325shareholderletter.htm","name":"","type":"other","credibility":3}],"severity":"medium"}],"timeline":[{"date":"2016-06","event":"Deribit officially launches, founded by John Jansen, Marius Jansen, and Sebastian Smyczinski, incorporated in the Netherlands.","source":"","date_original":"2016-06-01"},{"date":"2020-02","event":"Three Arrows Capital acquires an indirect ~16% stake in Deribit via a Singapore SPV.","source":"","date_original":"2020-02-01"},{"date":"2022-07","event":"Deribit is named among creditors pushing for Three Arrows Capital's liquidation; 3AC owes Deribit approximately $80 million.","source":"","date_original":"2022-07-01"},{"date":"2022-11","event":"Deribit's hot wallet server is compromised just before midnight UTC; approximately $28 million in BTC, ETH, and USDC is stolen.","source":"","date_original":"2022-11-01"},{"date":"2022-11-02","event":"Deribit announces the hack, confirms client assets unaffected, states loss will be covered by balance sheet. Normal on-chain withdrawals resume.","source":""},{"date":"2022-11-05","event":"On-chain analysts observe stolen funds begin moving to Tornado Cash.","source":""},{"date":"2024-04-02","event":"Deribit FZE receives a conditional VASP license from Dubai's VARA — the first derivatives exchange to receive a full market product derivatives license from VARA.","source":""},{"date":"2024-11-29","event":"Deribit announces January 1, 2025 migration of all activities to its Dubai-licensed entity, Deribit FZE.","source":""},{"date":"2025","event":"Deribit FZE goes live as the primary entity for qualified and institutional investors; retail clients remain under DRB Panama as a broker-member.","source":"","date_original":"2025-01-01"},{"date":"2025-05-08","event":"Coinbase announces agreement to acquire Deribit for approximately $2.9 billion ($700 million cash plus 11 million Coinbase Class A shares).","source":""},{"date":"2025-08-14","event":"Coinbase completes acquisition of Deribit, making it a wholly-owned subsidiary of Coinbase Global, Inc.","source":""}],"sources_used":[{"url":"https://blog.mexc.com/wiki/who-is-deribit-founder/","name":"","type":"other","archive_url":"http://web.archive.org/web/20260208041027/https://blog.mexc.com/wiki/who-is-deribit-founder/","credibility":3,"archive_timestamp":"2026-02-08T04:10:27+00:00"},{"url":"https://www.coindesk.com/business/2022/07/01/blockchaincom-deribit-among-creditors-that-pushed-for-3ac-liquidation-report","name":"","type":"other","archive_url":"http://web.archive.org/web/20251118085612/https://www.coindesk.com/business/2022/07/01/blockchaincom-deribit-among-creditors-that-pushed-for-3ac-liquidation-report","credibility":3,"archive_timestamp":"2025-11-18T08:56:12+00:00"},{"url":"https://www.coindesk.com/business/2025/05/08/coinbase-buys-deribit-for-usd2-9b","name":"","type":"other","archive_url":"http://web.archive.org/web/20260628165229/https://www.coindesk.com/business/2025/05/08/coinbase-buys-deribit-for-usd2-9b","credibility":3,"archive_timestamp":"2026-06-28T16:52:29+00:00"},{"url":"https://www.theblock.co/post/366957/coinbase-completes-2-9-billion-cash-and-stock-acquisition-of-deribit","name":"","type":"other","archive_url":"http://web.archive.org/web/20251203012809/https://www.theblock.co/post/366957/coinbase-completes-2-9-billion-cash-and-stock-acquisition-of-deribit","credibility":3,"archive_timestamp":"2025-12-03T01:28:09+00:00"},{"url":"https://www.coindesk.com/business/2022/11/02/crypto-exchange-deribit-loses-28m-in-hot-wallet-hack","name":"","type":"other","archive_url":"http://web.archive.org/web/20260209060632/https://www.coindesk.com/business/2022/11/02/crypto-exchange-deribit-loses-28m-in-hot-wallet-hack","credibility":3,"archive_timestamp":"2026-02-09T06:06:32+00:00"},{"url":"https://insights.deribit.com/exchange-updates/1-november-incident-report-and-next-steps/","name":"","type":"other","archive_url":"http://web.archive.org/web/20260608145030/https://insights.deribit.com/exchange-updates/1-november-incident-report-and-next-steps/","credibility":3,"archive_timestamp":"2026-06-08T14:50:30+00:00"},{"url":"https://decrypt.co/113334/crypto-exchange-deribit-hacked-28m-bitcoin-ethereum-usdc","name":"","type":"other","archive_url":"http://web.archive.org/web/20260518185249/https://decrypt.co/113334/crypto-exchange-deribit-hacked-28m-bitcoin-ethereum-usdc","credibility":3,"archive_timestamp":"2026-05-18T18:52:49+00:00"},{"url":"https://www.bloomberg.com/news/articles/2022-11-02/crypto-derivative-exchange-deribit-lost-28-million-in-a-hot-wallet-hack","name":"","type":"other","archive_url":null,"credibility":3,"archive_error":"error:no-request","archive_status":"unarchivable","archive_timestamp":null},{"url":"https://www.coindesk.com/business/2024/04/02/crypto-exchange-deribits-dubai-based-entity-wins-conditional-vasp-license","name":"","type":"other","archive_url":"http://web.archive.org/web/20251023095927/https://www.coindesk.com/business/2024/04/02/crypto-exchange-deribits-dubai-based-entity-wins-conditional-vasp-license","credibility":3,"archive_timestamp":"2025-10-23T09:59:27+00:00"},{"url":"https://insights.deribit.com/exchange-updates/deribit-first-derivatives-exchange-to-receive-vara-regulatory-approval/","name":"","type":"other","archive_url":"http://web.archive.org/web/20260418193543/https://insights.deribit.com/exchange-updates/deribit-first-derivatives-exchange-to-receive-vara-regulatory-approval/","credibility":3,"archive_timestamp":"2026-04-18T19:35:43+00:00"},{"url":"https://insights.deribit.com/exchange-updates/deribit-to-launch-1-jan-2025-as-a-fully-licensed-spot-and-derivatives-exchange-in-dubai-uae/","name":"","type":"other","archive_url":"http://web.archive.org/web/20260307032253/https://insights.deribit.com/exchange-updates/deribit-to-launch-1-jan-2025-as-a-fully-licensed-spot-and-derivatives-exchange-in-dubai-uae/","credibility":3,"archive_timestamp":"2026-03-07T03:22:53+00:00"},{"url":"https://support.deribit.com/hc/en-us/articles/25944499603357-Regulation-And-Governance","name":"","type":"other","archive_url":null,"credibility":3,"archive_error":"error:no-request","archive_status":"unarchivable","archive_timestamp":null},{"url":"https://www.sec.gov/Archives/edgar/data/0001679788/000167978825000086/coin-20250508.htm","name":"","type":"other","archive_url":"https://web.archive.org/web/20260830010209/https://www.sec.gov/Archives/edgar/data/1679788/000167978825000086/coin-20250508.htm","credibility":3,"archive_timestamp":"2026-08-30T01:02:09+00:00"},{"url":"https://support.deribit.com/hc/en-us/articles/25944547383453-Custody-Policy","name":"","type":"other","archive_url":"http://web.archive.org/web/20250906174213/https://support.deribit.com/hc/en-us/articles/25944547383453-Custody-Policy","credibility":3,"archive_timestamp":"2025-09-06T17:42:13+00:00"},{"url":"https://support.deribit.com/hc/en-us/articles/25944777576477-Insurance-Fund","name":"","type":"other","archive_url":"http://web.archive.org/web/20260515161005/https://support.deribit.com/hc/en-us/articles/25944777576477-Insurance-Fund","credibility":3,"archive_timestamp":"2026-05-15T16:10:05+00:00"},{"url":"https://cointelegraph.com/news/source-claims-3ac-s-deribit-exposure-is-worth-much-less-than-reported","name":"","type":"other","archive_url":"https://web.archive.org/web/20260830041012/https://cointelegraph.com/news/source-claims-3ac-s-deribit-exposure-is-worth-much-less-than-reported","credibility":3,"archive_timestamp":"2026-08-30T04:10:12+00:00"},{"url":"https://www.sec.gov/Archives/edgar/data/0001679788/000167978825000207/q325shareholderletter.htm","name":"","type":"other","archive_url":"https://web.archive.org/web/20260829153230/https://www.sec.gov/Archives/edgar/data/1679788/000167978825000207/q325shareholderletter.htm","credibility":3,"archive_timestamp":"2026-08-29T15:32:30+00:00"}],"source_tags":["defillama"],"addresses":[],"reviewed":true,"reviewed_by":null,"model_used":"claude-sonnet-4-6","created_at":"2026-05-04T02:54:46.935225+00:00","updated_at":"2026-08-30T05:14:12.325055+00:00"}}