How to test a crypto exchange

Direct answer

Shipped untested, a crypto exchange lets attackers steal customer coins from its hot or multisig wallets, and lets callers posing as exchange support talk holders into sending coins to a wallet address the scammer controls. 9 tests are mandatory here, each tied to a risk in the map below. After the release smoke check, start the risk tests with compliance checks: monitoring alerts on deposits and withdrawals must reach the review queue and sign-ups from unlicensed countries must be blocked before trading volume grows.

9 mandatory testsfirst: compliance checks

What counts as a crypto exchange

A crypto exchange here is a platform on web, iOS, Android and a trading API for buying, selling and holding crypto assets with an order book. It covers sign-up and licensing by country, deposits and withdrawals to external addresses, hot and multisig wallets, the matching engine, margin and liquidation rules and the support console. Self-custody wallets that never hold customer assets, stock brokerage and card or bank deposits in fiat are out of scope.

Adjacent product types not covered here

  • stock trading app: A stock trading app routes orders to a clearing firm and an external router rather than its own order book and wallets, so order type conversion and options eligibility replace hot wallet theft and on-chain reconciliation.
  • neobank: A neobank holds fiat balances at partner banks, so pooled-account reconciliation and sanctions screening at sign-up replace hot wallet takeover and price-spike load.

Risk map

6 risks attached to crypto exchange with evidence. Sorted by severity.
RiskGradeNoteEvidence
Fraud or abuse by users
fraud-abuse
moneyprimaryCallers posing as exchange support use leaked account details to talk holders into moving coins to a 'safe' wallet address the scammer controls, and transaction monitoring alerts on those withdrawals sit unreviewed.
Money leaves or fails to arrive
money-loss
moneyprimaryAttackers steal customer coins from the exchange's hot or multisig wallets, or an account flagged to skip liquidation runs a negative balance on customer assets.
Fine or enforcement by a regulator
regulatory-penalty
legalpractitioner
single incident, no second source
Transaction monitoring alerts on crypto deposits and withdrawals pile up unreviewed, and the state licensing regulator fines the exchange.
Personal or sensitive data exposed
data-breach
dataprimaryBribed support agents collect customer data from the exchange's support systems, giving scammers a target list of crypto holders.
Outage during a demand peak
outage-under-load
outagepractitioner
single incident, no second source
A price spike drives a traffic surge, and traders cannot place or cancel orders while the market moves.
App rejected or removed by a store
store-rejection
distributionprimaryThe exchange app is pulled from a country's store listing because the exchange lacks that country's crypto exchange licence or registration.

Mandatory tests (9)

  1. Step 1: release smoke tests

    Why:outage-under-loadstore-rejection

    Done when: After each deploy, a test account places, fills and cancels a small order on web and mobile, and the balance and order history match.

    Tool class: browser automation. Who usually runs it: QA engineer.

  2. Step 2: compliance checks

    Why:regulatory-penaltyfraud-abusestore-rejection

    Done when: Test deposits that match monitoring scenarios raise alerts that reach the review queue, and sign-ups from unlicensed countries are blocked in app and on web.

    Tool class: test management. Who usually runs it: product manager.

  3. Step 3: end-to-end functional tests

    Why:fraud-abusemoney-loss

    Done when: A withdrawal to a new address after a password or phone change triggers a hold and an email the account owner must confirm.

    Tool class: browser automation. Who usually runs it: QA engineer.

  4. Step 4: penetration testing

    Why:money-lossdata-breach

    Done when: An external tester cannot approve a withdrawal from the hot or multisig wallet without the required signers, and cannot read another customer's account from the support console.

    Tool class: proxy. Who usually runs it: security specialist.

  5. Step 5: unit tests

    Why:money-loss

    Done when: Margin, liquidation and fee rules return the expected result for each test case, and no account flag bypasses liquidation without a recorded approval.

    Tool class: unit framework. Who usually runs it: developer.

  6. Step 6: data integrity and migration testing

    Why:money-loss

    Done when: After each ledger close and each wallet movement, customer balances per asset in the ledger sum to no more than on-chain and custodial holdings, and no account other than approved market makers carries a negative balance.

    Tool class: data validation. Who usually runs it: QA engineer.

  7. Step 7: security scanning

    Why:data-breach

    Done when: Each release is scanned and no open high finding remains on withdrawal address changes, API trading keys or stored ID documents.

    Tool class: DAST scanner. Who usually runs it: security specialist.

  8. Step 8: performance and load testing

    Why:outage-under-load

    Done when: With a replay of the busiest price-spike traffic on record, login, order placement and cancel stay within the agreed response target.

    Tool class: load generator. Who usually runs it: developer.

  9. Step 9: resilience and failure testing

    Why:outage-under-load

    Done when: With one matching engine node or database replica stopped during a load test, orders keep matching and the status page reports degraded service.

    Tool class: chaos tool. Who usually runs it: developer.

Recommended and optional tests

Not needed and why

  • usability testing

    Not needed: no attached risk depends on usability. Becomes recommended when order-entry errors drive support tickets.

  • accessibility testing

    Not needed: no accessibility rule or complaint naming crypto exchanges was found. Becomes recommended when the exchange serves EU retail customers under accessibility law.

  • localization testing

    Not needed: the exchange launches in one language. Becomes recommended when a second market launches with a local-language interface.

Order of work

First release

  1. release smoke tests: After the deploy, place, fill and cancel a small order from a test account on web and mobile and confirm the balance and order history match.
  2. compliance checks: Make test deposits that match monitoring scenarios and confirm the alerts reach the review queue, then try sign-ups from unlicensed countries in the app and on web and confirm they are blocked.
  3. end-to-end functional tests: Change a test account's password or phone, request a withdrawal to a new address and confirm the hold and the confirmation email to the account owner.
  4. penetration testing: Have an external tester try to approve a hot or multisig wallet withdrawal without the required signers and read another customer's account from the support console.
  5. unit tests: Run margin, liquidation and fee rules against the reviewed test cases and confirm no account flag bypasses liquidation without a recorded approval.
  6. data integrity and migration testing: After the ledger close, reconcile customer balances per asset in the ledger with on-chain and custodial holdings and confirm only approved market makers carry a negative balance.
  7. security scanning: Scan each release and close every high finding on withdrawal address changes, API trading keys and stored ID documents.
  8. performance and load testing: Replay the busiest price-spike traffic on record and confirm login, order placement and cancel stay within the agreed response target.
  9. resilience and failure testing: Stop one matching engine node or database replica during a load test and confirm orders keep matching and the status page reports degraded service.

Ongoing cadence

Tools

Listed alphabetically inside each test type, filtered to the tests above and to the platforms of crypto exchange (web, ios, android, api). Not recommendations.

45 tools shown

release smoke tests

  • Firebase Test LabRuns app tests on hosted devices. iosandroidfreemium
  • TestRailTest case and run management. webiosandroidapicommercial
  • XrayTest management inside Jira. webiosandroidapicommercial

end-to-end functional tests

  • AppiumCross-platform mobile UI automation over WebDriver. iosandroidopen-source
  • ApplitoolsVisual comparison of screens across builds. webiosandroidcommercial
  • BrowserStackCloud of real devices and browsers. webiosandroidcommercial
  • CypressBrowser-based end-to-end testing with a visual runner. webfreemium
  • DeepEvalUnit-style evaluation for LLM applications. apiopen-source
  • DetoxGray-box end-to-end testing for React Native apps. iosandroidopen-source
  • EspressoAndroid UI testing framework from Google. androidopen-source
  • LambdaTestCloud browser and device grid. webiosandroidcommercial
  • MaestroMobile UI flows written in YAML. iosandroidfreemium
  • PercyVisual review of UI changes. webcommercial
  • PlaywrightBrowser automation for Chromium, Firefox and WebKit. webopen-source
  • PostmanAPI client with collections and scripted assertions. apifreemium
  • PromptfooEvaluation and regression tests for LLM prompts and outputs. apiwebopen-source
  • Sauce LabsCloud test infrastructure for web and mobile. webiosandroidcommercial
  • SeleniumWebDriver-based browser automation. webopen-source
  • XCTestApple's framework for unit and UI tests. iosopen-source

penetration testing

  • Burp SuiteProxy and scanner for web application security testing. webapifreemium

unit tests

  • JestJavaScript test runner with mocking and snapshots. webapiopen-source
  • JUnitTest framework for the JVM. apiandroidopen-source
  • pytestTest framework for Python with fixtures and plugins. apiopen-source
  • VitestTest runner for Vite-based JavaScript and TypeScript projects. webapiopen-source
  • XCTestApple's framework for unit and UI tests. iosopen-source

data integrity and migration testing

  • dbt testsTests on warehouse models inside dbt. apiopen-source
  • Great ExpectationsData validation with declarative expectations. apiopen-source

security scanning

  • Burp SuiteProxy and scanner for web application security testing. webapifreemium
  • GarakProbing LLM applications for prompt injection and leakage. apiopen-source
  • mitmproxyInteractive HTTPS proxy. iosandroidwebapiopen-source
  • MobSFStatic and dynamic analysis for mobile binaries. iosandroidopen-source
  • OWASP ZAPDynamic application security scanner. webapiopen-source
  • SchemathesisProperty-based testing from OpenAPI and GraphQL schemas. apiopen-source
  • SemgrepStatic analysis with custom rules. apiwebiosandroidfreemium
  • SnykDependency and code vulnerability scanning. apiwebiosandroidfreemium
  • TrivyScanner for containers, dependencies and configuration. apiopen-source

performance and load testing

  • ArtilleryLoad testing with YAML scenarios. apiwebfreemium
  • GatlingLoad testing with Scala, Java or Kotlin scenarios. apiwebfreemium
  • JMeterLoad testing tool from the Apache Foundation. apiwebopen-source
  • k6Load testing scripted in JavaScript. apiwebopen-source
  • LighthouseAudits for accessibility and performance in Chrome. webopen-source
  • LocustLoad testing scripted in Python. apiwebopen-source

resilience and failure testing

  • Chaos MeshFault injection for Kubernetes. apiopen-source
  • GremlinManaged fault injection. apicommercial
  • ToxiproxyTCP proxy for simulating network failures. apiopen-source

integration tests

  • Charles ProxyHTTP proxy for inspecting and throttling traffic. iosandroidwebcommercial
  • JestJavaScript test runner with mocking and snapshots. webapiopen-source
  • JUnitTest framework for the JVM. apiandroidopen-source
  • PostmanAPI client with collections and scripted assertions. apifreemium
  • pytestTest framework for Python with fixtures and plugins. apiopen-source
  • VitestTest runner for Vite-based JavaScript and TypeScript projects. webapiopen-source
  • XCTestApple's framework for unit and UI tests. iosopen-source

regression suite

  • CypressBrowser-based end-to-end testing with a visual runner. webfreemium
  • DeepEvalUnit-style evaluation for LLM applications. apiopen-source
  • PlaywrightBrowser automation for Chromium, Firefox and WebKit. webopen-source
  • PromptfooEvaluation and regression tests for LLM prompts and outputs. apiwebopen-source
  • TestRailTest case and run management. webiosandroidapicommercial
  • XrayTest management inside Jira. webiosandroidapicommercial

contract tests

  • PactConsumer-driven contract testing with a broker. apiopen-source
  • PostmanAPI client with collections and scripted assertions. apifreemium
  • SchemathesisProperty-based testing from OpenAPI and GraphQL schemas. apiopen-source

What to send to the person who will test

Send the checklist and the brief below. The printable checklist for crypto exchange has the same 9 items with checkboxes.

Download the checklistMarkdownCSVBrief (Markdown)

Acceptance criteria wording

A release of the crypto exchange is accepted when a test account places, fills and cancels a small order on web and mobile and the balance and order history match. A withdrawal to a new address after a password or phone change is held until the account owner confirms by email. Customer balances per asset sum to no more than on-chain and custodial holdings, and no account other than approved market makers carries a negative balance.

Brief

# Test brief: crypto exchange

Product type: crypto exchange. A platform for buying, selling and holding crypto assets with an order book.
Risk map and evidence: https://howtotestaproduct.com/how-to-test/crypto-exchange/
Printable checklist: https://howtotestaproduct.com/checklists/crypto-exchange/

Run these 9 mandatory tests in this order. A test is done only when its done condition is true on the build you will release.

1. release smoke tests (risks: outage-under-load, store-rejection). Tool class: browser automation. Usually run by: QA engineer.
   Done when: After each deploy, a test account places, fills and cancels a small order on web and mobile, and the balance and order history match.
2. compliance checks (risks: regulatory-penalty, fraud-abuse, store-rejection). Tool class: test management. Usually run by: product manager.
   Done when: Test deposits that match monitoring scenarios raise alerts that reach the review queue, and sign-ups from unlicensed countries are blocked in app and on web.
3. end-to-end functional tests (risks: fraud-abuse, money-loss). Tool class: browser automation. Usually run by: QA engineer.
   Done when: A withdrawal to a new address after a password or phone change triggers a hold and an email the account owner must confirm.
4. penetration testing (risks: money-loss, data-breach). Tool class: proxy. Usually run by: security specialist.
   Done when: An external tester cannot approve a withdrawal from the hot or multisig wallet without the required signers, and cannot read another customer's account from the support console.
5. unit tests (risks: money-loss). Tool class: unit framework. Usually run by: developer.
   Done when: Margin, liquidation and fee rules return the expected result for each test case, and no account flag bypasses liquidation without a recorded approval.
6. data integrity and migration testing (risks: money-loss). Tool class: data validation. Usually run by: QA engineer.
   Done when: After each ledger close and each wallet movement, customer balances per asset in the ledger sum to no more than on-chain and custodial holdings, and no account other than approved market makers carries a negative balance.
7. security scanning (risks: data-breach). Tool class: DAST scanner. Usually run by: security specialist.
   Done when: Each release is scanned and no open high finding remains on withdrawal address changes, API trading keys or stored ID documents.
8. performance and load testing (risks: outage-under-load). Tool class: load generator. Usually run by: developer.
   Done when: With a replay of the busiest price-spike traffic on record, login, order placement and cancel stay within the agreed response target.
9. resilience and failure testing (risks: outage-under-load). Tool class: chaos tool. Usually run by: developer.
   Done when: With one matching engine node or database replica stopped during a load test, orders keep matching and the status page reports degraded service.

Acceptance criteria wording:
A release of the crypto exchange is accepted when a test account places, fills and cancels a small order on web and mobile and the balance and order history match. A withdrawal to a new address after a password or phone change is held until the account owner confirms by email. Customer balances per asset sum to no more than on-chain and custodial holdings, and no account other than approved market makers carries a negative balance.

Report back for each test: pass or fail against its done condition, the build or version tested, and the proof (screenshot, log line or report file).

Licence: CC BY 4.0.

For founders: what to forward and what to ask back. For product managers: turning this page into tickets.

Questions about testing a crypto exchange

What testing does a crypto exchange need?

9 tests are mandatory, from the post-deploy order smoke test and compliance checks on monitoring alerts to performance and resilience tests on the order book. Each is tied to one of the 6 risks in the map, such as customer coins stolen from hot or multisig wallets or traders unable to cancel orders during a price spike. Integration, exploratory, regression and contract tests are recommended, each with the event that makes it mandatory.

What testing is required for a crypto exchange as a financial product?

Compliance checks are mandatory while the exchange is licensed per jurisdiction: monitoring alerts on test deposits must reach the review queue and sign-ups from unlicensed countries must be blocked. The map cites a state licensing regulator's fine after monitoring alerts piled up unreviewed, and the store policy that requires country registration for exchange apps.

Which tests in a vendor test plan for a crypto exchange are not needed?

Usability testing is not needed while no attached risk depends on it, until order-entry errors drive support tickets. Accessibility testing is not needed until the exchange serves EU retail customers under accessibility law, and localization is not needed until a second market launches with a local-language interface.

What is the minimum testing for a crypto exchange at MVP stage?

The minimum is the 9 mandatory tests, because holding customer assets, allowing withdrawals to external addresses and running a live order book apply from the first trade. Unit tests on margin and liquidation are mandatory only while margin or credit is offered to any account. Compatibility and offline tests are optional.

Evidence

  1. ev-0062post-mortemprimary

    Coinbase Global, Inc. Form 8-K (May 14, 2025), Coinbase Global, Inc. (filed with the U.S. Securities and Exchange Commission)

    Company filing on a crypto exchange incident in which bribed support staff collected customer data from internal support systems, after which the exchange added fraud monitoring and warned customers of impersonation. Supports data-breach and fraud-abuse for crypto exchanges.

    published 2025-05-14 · verified 2026-10-07

  2. ev-0063court-or-fineprimary

    DFS Announces [amount] Settlement with Coinbase, Inc. after Investigation Finds Significant Failings in Company's Compliance Program, New York State Department of Financial Services

    State regulator settlement finding a crypto exchange's know-your-customer program inadequate and its transaction monitoring system unable to keep pace with alerts, leaving a large unreviewed backlog. Supports regulatory-penalty and fraud-abuse for crypto exchanges.

    published 2023-01-04 · verified 2026-10-07

  3. ev-0064regulatorprimary

    North Korea Responsible for [amount] Bybit Hack (Alert Number I-022625-PSA), Federal Bureau of Investigation, Internet Crime Complaint Center

    FBI public service announcement attributing the theft of virtual assets from a cryptocurrency exchange to a state-backed group, with stolen assets laundered across many addresses. Supports money-loss for crypto exchanges that hold customer assets in hot or multisig wallets.

    published 2025-02-26 · verified 2026-10-07

  4. ev-0065court-or-fineprimary

    SEC Charges Samuel Bankman-Fried with Defrauding Investors in Crypto Asset Trading Platform FTX, U.S. Securities and Exchange Commission

    SEC complaint alleging a crypto trading platform diverted customer funds to an affiliated trading firm and exempted that firm from key platform risk controls. Supports money-loss for crypto exchanges where account-level exceptions to margin and liquidation rules let customer assets leave.

    published 2022-12-13 · verified 2026-10-07

  5. ev-0011standardprimary

    OWASP Top Ten, OWASP Foundation

    The OWASP Top Ten lists the most critical web application security risk categories, such as broken access control and injection.

    published undated · verified 2026-10-07

  6. ev-0066post-mortemprimary

    Incident Post Mortem: June 1, 2020, Coinbase

    Supports outage-under-load for crypto exchanges.

    published undated · verified 2026-10-07

  7. ev-0001store-guidelineprimary

    App Review Guidelines, Apple

    Apple reviews every iOS, iPadOS and macOS App Store submission against these guidelines, including crashes and bugs at review, privacy disclosures, in-app purchase rules and extra rules for medical, financial and kids apps, and apps with user-generated content must let users report offensive content and block abusive users (guideline 1.2), and apps offering loot boxes or similar mechanisms must disclose the odds of each item type before purchase (guideline 3.1.1).

    published undated · verified 2026-10-07

  8. ev-0069store-guidelineprimary

    Understanding Google Play's Cryptocurrency Exchanges and Software Wallets Policy, Google Play

    Non-custodial wallets are out of scope of the Cryptocurrency Exchanges and Software Wallets policy.

    Google Play requires custodial software wallets and exchanges to declare the feature and hold country-specific registration, and excludes non-custodial wallets. Supports store-rejection for custodial crypto wallets and for crypto exchange apps on Android.

    published undated · verified 2026-10-07

Disclaimer

This page lists tests and risks for a product category, not for your product. Risks are attached only with the evidence shown in the Evidence section. Tools are listed alphabetically and are not recommendations. Nothing here is legal, regulatory or security advice; where a regulator or a store sets a requirement, their page is linked and takes precedence.