How Exchanges Work
An exchange is where you swap cash for crypto, but the real question is who holds your coins while you do it.
On a centralised exchange, the company holds your private keys. That is convenient (you just log in, and support can usually help you back in), but if it is hacked, freezes withdrawals, or fails, your coins can be stuck or lost even though you did nothing wrong.
Look at the two exchange types above before reading on: a centralised exchange (CEX) on the left, a decentralised exchange (DEX) on the right. For almost everyone, the first real brush with crypto happens on an exchange: the place you turn dollars into Bitcoin, or one coin into another. It feels like a shop, you log in, you press buy, coins appear. But underneath, an exchange is doing two jobs at once, and one of them decides how safe your money actually is. The job most beginners never ask about is custody: while your coins sit on the exchange, who is really holding them? Toggle the custody spotlight above and watch where the key lives. Get that one idea straight and the rest of this module falls into place.
What an exchange actually does
A crypto exchange is a business that matches buyers with sellers and lets you convert between assets. It plays two roles at the same time.
First, it is a marketplace. It pairs someone who wants to buy with someone who wants to sell, and settles on a price between them. Second, it is an on/off ramp, the bridge between ordinary money and crypto. You deposit dollars (the on-ramp), trade, and later withdraw dollars again (the off-ramp). Without exchanges, getting from a bank account into crypto for the first time would be extremely difficult, which is why they sit right at the centre of the whole ecosystem.
Who holds your coins
This is the single most important idea in the module, so slow down here.
Owning crypto really means controlling a secret private key, a long password that authorises spending. Whoever holds the key controls the coins. That is the whole game.
When you keep coins on an exchange, the exchange holds the keys for you. This is called custodial. It is convenient: you log in with a normal password, and the company handles security and account recovery. But it also means you are trusting that company not to fail, freeze your account, or get hacked.
The alternative is a self-custodied wallet, software or a hardware device where you hold the keys yourself. The old crypto saying captures the trade-off perfectly: not your keys, not your coins. Self-custody gives you full control and full responsibility (lose the keys and no one on earth can recover them). A custodial exchange gives you convenience in exchange for trust.
How trades get matched: the order book
Most centralised exchanges match trades using an order book, a live, two-sided list of offers.
- The buy side lists bids, the prices buyers are willing to pay.
- The sell side lists asks, the prices sellers are willing to accept.
- The gap between the highest bid and the lowest ask is the spread.
You place trades into that book with two basic order types:
- A market order says "fill me right now at the best available price." Fast, but you accept whatever price the book gives you.
- A limit order says "only fill me at this price or better." You get price control, but the trade might never happen if the market does not reach your price.
One warning worth holding onto: a large market order can walk the book, filling at steadily worse prices when there are not enough offers sitting at the best price. The first fold below shows exactly how that goes wrong.
Two kinds of exchange: CEX vs DEX
Exchanges come in two broad flavours, and the difference comes back to custody.
A centralised exchange (CEX) is a company that holds your funds (custodial), runs the order book on its own servers (fast), and usually asks you to verify your identity, known as KYC, short for "know your customer."
A decentralised exchange (DEX) is the opposite. It is non-custodial, so you trade straight from your own wallet and never hand over your keys, and it runs on the blockchain itself through smart contracts (see Module 2 and 3). Many DEXs skip the order book entirely and use an automated market maker (AMM) instead, which prices trades with a formula against pooled funds rather than matching individual buyers and sellers.
In short: a CEX tends to be faster and easier for beginners, while a DEX gives you self-custody and permissionless access at the cost of more complexity and on-chain fees.
Choosing where to trade
Before you trust any venue with real money, run through a short checklist:
- Security track record. Has it ever been hacked, and how did it handle it?
- Custody. Does it hold your keys, and can you withdraw to your own wallet?
- Fees. What are the trading fees, the spreads, and the withdrawal costs?
- Liquidity. Is there enough volume that you can get in and out without moving the price against yourself? (Module 5 goes deeper on this.)
- Jurisdiction and regulation. Where is it based, and is it legal to use where you live?
No exchange scores perfectly on all five. But a beginner who asks these questions before depositing avoids most of the disasters that are actually avoidable.
Worked example: a market order 'walking' a thin book
Suppose the sell side (the asks) of an order book looks like this:
- 2 units offered at $30,000
- 3 units offered at $30,050
- 5 units offered at $30,200
You place a market order to buy 4 units. It fills against the cheapest asks first: 2 units at $30,000 ($60,000) plus 2 units at $30,050 ($60,100), for a total of $120,100. Your average price is $120,100 / 4 = $30,025, already above the $30,000 you saw quoted.
Now imagine you had tried to buy 8 units instead. You would clear the $30,000 and $30,050 levels and reach all the way up to $30,200, dragging your average price even higher. That upward drift is called slippage, and it is worse when the book is thin (few offers near the top).
A limit order set at, say, $30,050 would have protected you. It would fill only up to that price and then simply stop, rather than chasing the price up. This is why thin markets and big market orders are a dangerous combination, a theme Module 5 returns to.
How a DEX prices trades without an order book
A traditional order book needs two sides: someone bidding, someone asking. Many decentralised exchanges replace that with an automated market maker (AMM).
Instead of matching individual buyers and sellers, an AMM holds pooled funds that other users have supplied (a liquidity pool), and it prices every trade with a formula against that pool. When you buy from the pool, you take some of one asset out and add the other in, and the formula shifts the price automatically based on how much is left.
The practical upshots for a beginner:
- You trade directly from your own wallet, so you keep custody the whole time.
- There is no company deciding the price; a formula does.
- Large trades against a small pool cause big price movement (the AMM version of "walking the book"), so pool size matters just like order-book depth does.
Custodial vs self-custody: which should a beginner pick?
There is no single right answer, only a trade-off you should make on purpose rather than by accident.
Custodial (coins on an exchange). Easiest to start with. If you forget your password, support can usually help you back in. The risk is that you are trusting the company: if it is hacked, becomes insolvent, or freezes withdrawals, your coins can be stuck or lost even though you did nothing wrong.
Self-custody (you hold the keys). No company can freeze or lose your coins for you. But the responsibility is total: there is no "forgot password" link. If you lose your keys or recovery phrase, the coins are simply gone, and if you get tricked into revealing them, a thief can drain the wallet instantly.
A common middle path for newcomers: use a reputable custodial exchange to learn and to move money in and out, keep only what you are actively using there, and move longer-term holdings into self-custody once you are comfortable managing keys. The point is to choose deliberately, not to leave everything on an exchange simply because it was the first screen you saw.
Quick knowledge check
What does "not your keys, not your coins" actually mean? Whoever holds the private keys controls the coins. On a custodial exchange the exchange holds your keys, so you are trusting it to stay safe and solvent. In self-custody you hold the keys yourself, which gives you full control but also full responsibility for keeping them safe.
What is the difference between a market order and a limit order? A market order fills immediately at the best price currently available, so it is fast but you accept whatever price the book gives you. A limit order fills only at a price you set or better, so you keep control of the price but the trade might never execute if the market does not reach it.
Give one core difference between a CEX and a DEX. A centralised exchange (CEX) is custodial and runs an order book on its own servers, usually with identity checks (KYC). A decentralised exchange (DEX) is non-custodial, so you trade from your own wallet, and it runs on-chain through smart contracts, often using an automated market maker instead of an order book.
Sources
- IOSCO, "Policy Recommendations for Crypto and Digital Asset Markets" (Final Report), the role of an exchange as a marketplace and fiat on/off ramp, and how centralised (custodial) exchanges differ from decentralised (non-custodial) ones.
- SEC (investor.gov), "Types of Orders", how an order book lists bids and asks, and the difference between market orders and limit orders.
- Bitcoin.org, "How does Bitcoin work?", how private keys authorise spending and why "not your keys, not your coins" captures the custody trade-off.
- Uniswap (official protocol docs), "How Uniswap works", how decentralised exchanges price trades against liquidity pools instead of using an order book.