Which crypto exchanges have a MiCA licence?

18 of 27well-known exchanges and apps are authorised under MiCA

Binance, Bitget, HTX, MEXC, Bitfinex, Uphold, Nexo have no firm under that name in ESMA’s register of MiCA-authorised crypto firms as of 5 November 2026. A brand can operate in the EU through a firm with another name, so this isn’t proof it is unlicensed. Trade Republic and N26 are in the register only as regulated firms that notified their regulator (Article 60), as banks and investment firms may, so they aren’t counted as authorised. The earliest authorisation here is MoonPay’s, from 30 December 2024; the latest is SwissBorg’s, from 5 March 2026.

9 of the 18 authorised have had a hack recorded in the hacks ledger, the largest being Bybit’s $1.40bn. A licence sets rules for custody and security; it doesn’t mean an exchange has never been hacked.

Malta licensed the most of these brands: 6 (OKX, Crypto.com, Gate, Gemini, Bitpanda, Blockchain.com), out of 20 firms it has authorised in all. France has authorised the most firms overall, 36, but only 1 of these brands. A firm licensed in one EU country can serve customers across the EU.

In the US, New York runs the best-known state licence for crypto firms. 6 of these 27 brands have a firm on New York’s list of virtual currency licensees and trust charters: Coinbase, Gemini, Bitstamp, Robinhood, eToro, MoonPay. Source: NYDFS.

Firms already serving EU customers under national rules could keep doing so during a transition that ended by 1 July 2026 at the latest, and earlier in many countries. Since then, a firm offering crypto services in the EU needs MiCA authorisation in one member state, which it can then use across the EU.

The list is Bitminer.io’s choice of the largest crypto exchanges by trading volume and the apps most used in Europe. Each is matched by name in ESMA’s interim MiCA register, which ESMA updates as national regulators report. A brand can operate in the EU through a firm with another name, so a “No” means no firm carrying the brand’s name is listed. Hacks are the exchange’s own incidents with a known loss in the hacks ledger, from DefiLlama’s data, including OKX’s as OKEx. Hacks of a brand’s separate DeFi products aren’t counted, and neither are takeovers of its social media accounts, where scam posts cost users money but the exchange itself wasn’t breached. “Full record” opens the company check, which adds US enforcement documents, including any later dismissal. The register covers crypto-asset service providers; stablecoin issuers are authorised separately. Check any company across every ledger

Cite this Bitminer.io, “MiCA licences of major crypto exchanges”, data to 5 November 2026, https://bitminer.io/ledger/licences/exchanges/. Free to reuse under CC BY 4.0 with credit and a link. How this is built · Frozen copy of November 2026’s data