Exchanges / HashKey Exchange
30-second risk check: HashKey Exchange
HashKey ExchangeRisk Rating and Review
hashkey.com · Official site verified ↗Likely contracting entity: Hash Blockchain LimitedLicensed virtual asset trading platform operator
Brand and platform disambiguation · Moderate Risk
Cexvia rates HashKey Exchange Moderate Risk at 74/100.
For Hong Kong users, the mapped entity is Hash Blockchain Limited under Licensed virtual asset trading platform operator. Its strongest area is Regulatory & legal standing; the main observed concern is Operations & user protection.
Cexvia Exchange Risk Rating0 critical · 100 stronger evidence
HashKey Exchange74Moderate Risk
Asset & 68Operatio68Corporat75Regulatory & legal standing82Corporate transparency75Asset & solvency transparency68Security & incident history78Operations & user protection68
Across five rated dimensions, Regulatory & legal standing scores highest at 82/100, while Operations & user protection scores lowest at 68/100.
- 01
The HashKey brand maps to separate trading entities in Hong Kong, Bermuda and Dubai, governed respectively by the SFC, BMA and VARA frameworks.
Selected: HK / Hash Blockchain Limited · Verified 2026-07-27
Overall score74Moderate Risk
Dimensions covered5 / 5
Regional Legal Entity Map
The brand does not define the regulatory perimeter.
HashKey Exchange, HashKey Global and Dubai services map to different legal entities. The regional entry point changes the contracting company, regulator and applicable licence.
RegionContracting entityRegulatory recordScopeStatusChecked
What these records can establish
- Named legal entity and jurisdiction
- Permitted or registered activities
- Current public-record status at the verification date
What these records do not prove
- Protection against all asset loss
- Global coverage for every user or product
- Complete solvency or future regulatory status
Regulatory & legal standingComplete
82score / 100Weight 25% · Confidence 93%
Three entities in Hong Kong, Bermuda and Dubai are verifiable, with relatively clear brand entry points and licence boundaries.
- 3 key legal entities
- HK / BM / AE
- Current records: active
Score contribution0.2 / 25
Why this score
Evidence highlights3 key legal entities · HK / BM / AE · Current records: active
Observed limitationThree entities in Hong Kong, Bermuda and Dubai are verifiable, with relatively clear brand entry points and licence boundaries.
Missing or limited evidenceNo material publication gap recorded for this dimension.
0 source records · Reviewed 2026-07-27Corporate transparencyPrimary evidence
75score / 100Weight 15% · Confidence 80%
Licence, rule and control disclosures are relatively clear, while the private group does not publish consolidated audited financial statements.
- Licence boundaries: clear
- Exchange rules: public
- Consolidated financials: unavailable
Score contribution0.1 / 15
Why this score
Evidence highlightsLicence boundaries: clear · Exchange rules: public · Consolidated financials: unavailable
Observed limitationLicence, rule and control disclosures are relatively clear, while the private group does not publish consolidated audited financial statements.
Missing or limited evidencePrimary evidence
0 source records · Reviewed 2026-07-27Asset & solvency transparencyPrimary evidence
68score / 100Weight 20% · Confidence 74%
Published rules describe customer-asset segregation, insurance and at least 90% cold storage, but no frequent public asset-to-liability coverage ratio is available.
- Cold storage: at least 90%
- Customer assets: segregated
- Public reserve ratio: unavailable
Score contribution0.1 / 20
Why this score
Evidence highlightsCold storage: at least 90% · Customer assets: segregated · Public reserve ratio: unavailable
Observed limitationPublished rules describe customer-asset segregation, insurance and at least 90% cold storage, but no frequent public asset-to-liability coverage ratio is available.
Missing or limited evidencePrimary evidence
1 source records · Reviewed 2026-07-27Security & incident historyPrimary evidence
78score / 100Weight 15% · Confidence 58%
HashKey publishes ISO 27001/27701, insurance and cold-storage controls. No major platform incident was found in the selected sources, which is not proof that none has occurred.
- ISO 27001 / 27701
- Custody insurance: disclosed
- Major incident: not found
Score contribution0.1 / 15
Why this score
Evidence highlightsISO 27001 / 27701 · Custody insurance: disclosed · Major incident: not found
Observed limitationHashKey publishes ISO 27001/27701, insurance and cold-storage controls. No major platform incident was found in the selected sources, which is not proof that none has occurred.
Missing or limited evidencePrimary evidence
1 source records · Reviewed 2026-07-27Operations & user protectionPrimary evidence
68score / 100Weight 25% · Confidence 57%
Official maintenance notices and rules are connected, but no unified real-time status page was found. This lowers coverage and confidence without becoming an automatic negative fact. Complaint evidence remains limited and is not treated as proof of safety.
- Maintenance notices: connected
- Unified status page: not found
- Comparable sample: insufficient
- Trust Score: 9 / 10
Score contribution0.2 / 25
Why this score
Evidence highlightsMaintenance notices: connected · Unified status page: not found · Comparable sample: insufficient · Trust Score: 9 / 10
Observed limitationOfficial maintenance notices and rules are connected, but no unified real-time status page was found. This lowers coverage and confidence without becoming an automatic negative fact. Complaint evidence remains limited and is not treated as proof of safety.
Missing or limited evidencePrimary evidence
4 source records · Reviewed 2026-07-27Risk Drivers and Data Gaps
What moves the rating—and what remains uncertain.
Missing evidence is reported separately. It lowers coverage or confidence and is not automatically scored as a negative fact.
Key rating drivers
Regulatory & legal standing
820.2 weightedThree entities in Hong Kong, Bermuda and Dubai are verifiable, with relatively clear brand entry points and licence boundaries.
Security & incident history
780.1 weightedHashKey publishes ISO 27001/27701, insurance and cold-storage controls. No major platform incident was found in the selected sources, which is not proof that none has occurred.
Corporate transparency
750.1 weightedLicence, rule and control disclosures are relatively clear, while the private group does not publish consolidated audited financial statements.
Asset & solvency transparency
680.1 weightedPublished rules describe customer-asset segregation, insurance and at least 90% cold storage, but no frequent public asset-to-liability coverage ratio is available.
Operations & user protection
680.2 weightedOfficial maintenance notices and rules are connected, but no unified real-time status page was found. This lowers coverage and confidence without becoming an automatic negative fact. Complaint evidence remains limited and is not treated as proof of safety.
Missing or limited evidence
Corporate transparency
Evidence status: Primary evidence. This limits confidence in the dimension conclusion.
Asset & solvency transparency
Evidence status: Primary evidence. This limits confidence in the dimension conclusion.
Security & incident history
Evidence status: Primary evidence. This limits confidence in the dimension conclusion.
Operations & user protection
Evidence status: Primary evidence. This limits confidence in the dimension conclusion.
Scope limitation
HashKey Exchange in Hong Kong and HashKey Global in Bermuda have different user scope and terms.
Security Intelligence Coverage
9 signal families, with collection boundaries shown.
3 automated or configured · 6 require analyst review
Official service status
Exchange maintenance and service notices are monitored from the official support archive.
- Cadence
- Every 15 minutes + review
- Rating use
- Eligible after validation
Independent probes
Official website, documented public API, DNS and TLS probes are configured.
- Cadence
- Every 5 minutes
- Rating use
- Context only
Security incidents
Service incidents are captured with the venue and legal entity kept explicit.
- Cadence
- Daily
- Rating use
- Eligible after validation
Reserves and wallets
Custody, client-asset and any published wallet disclosures are reviewed.
- Cadence
- On change + weekly review
- Rating use
- Eligible after validation
Account controls
MFA, anti-phishing and withdrawal controls are reviewed from official help materials.
- Cadence
- On change + weekly review
- Rating use
- Eligible after validation
Legal and regulatory
SFC and other jurisdictional records are mapped to the exact HashKey entity.
- Cadence
- On change + weekly review
- Rating use
- Eligible after validation
Domain and phishing
Official-domain and certificate baselines are configured.
- Cadence
- Daily
- Rating use
- Context only
Vulnerability signals
Potential product and dependency matches are queued for validation.
- Cadence
- Daily
- Rating use
- Never scored directly
Verified complaints
Official case references and structured evidence are mapped by venue and entity.
- Cadence
- On change + weekly review
- Rating use
- Context only
Latest Risk Events
Verified changes connected to HashKey Exchange.
Asset, Security and Operations
The evidence behind the dimensions users care about most.
Asset and solvency transparency
68/100Published rules describe customer-asset segregation, insurance and at least 90% cold storage, but no frequent public asset-to-liability coverage ratio is available.
- Cold storage: at least 90%
- Customer assets: segregated
- Public reserve ratio: unavailable
Security and incident history
78/100HashKey publishes ISO 27001/27701, insurance and cold-storage controls. No major platform incident was found in the selected sources, which is not proof that none has occurred.
- ISO 27001 / 27701
- Custody insurance: disclosed
- Major incident: not found
Operations and user protection
68/100Official maintenance notices and rules are connected, but no unified real-time status page was found. This lowers coverage and confidence without becoming an automatic negative fact.
- Maintenance notices: connected
- Unified status page: not found
- Coverage and confidence reduced
- Comparable sample: insufficient
- Low visibility is not low complaints
Exposure guidance
Limited long-term custody
- Use case
- Suitable for normal trading with controlled exchange balances.
- Avoid
- Avoid using the exchange as a single long-term custody location.
- Reason
- Regulatory & legal standing is the strongest observed area, while Operations & user protection limits a stronger conclusion.
Action checklist
Choose your next step based on your current situation.
- 01Verify the official domain and app publisher
- 02Confirm the legal entity named in the account agreement
- 03Check whether the selected product is covered in your region
- 04Start with the minimum deposit
- 05Test one withdrawal
- 06Enable strong account security
- 07Avoid keeping unnecessary long-term balances
Compare Alternatives
Compare HashKey Exchange with other published Passports.
ExchangeRiskScoreRegulatorySecurityConfidence
FAQ
Questions about HashKey Exchange
Is HashKey Exchange safe?
HashKey Exchange is currently rated Moderate Risk at 74/100. This reflects observed public evidence and is not a guarantee of safety.
Is HashKey Exchange regulated?
3 legal-entity records are mapped in this Passport. Each record has a jurisdiction-specific status and scope.
Which entity serves the selected region?
Hong Kong: Hash Blockchain Limited — Licensed virtual asset trading platform operator.
Does HashKey Exchange publish reserve or solvency evidence?
Published rules describe customer-asset segregation, insurance and at least 90% cold storage, but no frequent public asset-to-liability coverage ratio is available.
Should funds be stored on HashKey Exchange long term?
Limited long-term custody. Suitable for normal trading with controlled exchange balances. Avoid using the exchange as a single long-term custody location.
Verified sources
Every conclusion links back to primary evidence.
Each source shows its verification date and the specific statement it supports.
Regulator · Securities and Futures Commission
Tier A↗SFC Licensed virtual asset trading platforms
Legal entity, platform name, CE number and licensing date.
Platform terms · HashKey Global
Tier B↗HashKey Global User Agreement
HashKey Global contracting entity, company number and BMA licence disclosure.
Regulator · Virtual Assets Regulatory Authority
Tier A↗VARA Public Register — Hashkey MENA FZE
Legal entity, licence number, issue date, activities and eligible customer types.
Regulator · Securities and Futures Commission
Tier A↗SFC Public Register — Hash Blockchain Limited
Hong Kong entity and licence details.
Platform terms · HashKey Exchange
Tier B↗HashKey Exchange Investor Business Terms
Hong Kong platform contracting entity and business terms.
Reserve disclosure · HashKey Global
Tier B↗HashKey Global Exchange Rules
Published reserve or asset-disclosure evidence used in the solvency assessment.
Security notice · HashKey
Tier B↗HashKey security and custody overview
Published security or incident evidence used in the security assessment.
System status · HashKey
Tier B↗HashKey system upgrade announcement
Official service-status evidence used in the operational assessment.
Evidence coverage · Cexvia methodology
Method↗Cexvia complaint evidence standard
Complaint comparisons use verifiable primary evidence. The current cross-platform sample remains limited.
Market data · CoinGecko
Tier B↗HashKey Exchange market data
Third-party market-quality data used as a supporting signal.
Market data · CoinGecko
Tier B↗Trust Score methodology
CoinGecko methodology covering liquidity, cybersecurity, API coverage, team and incident signals.
Cexvia ratings reflect observed risk under available public evidence. A higher score means lower observed risk, not guaranteed safety. Coverage, confidence, redlines and score direction are published separately. This page is not investment, legal or custody advice. Commercial relationships do not change scores or suppress verified evidence.