Flipster security: proof of reserves, custody and how to verify them
Flipster publishes a Merkle-proof Proof of Reserves with daily reports (on 6 October 2026 it showed reserve ratios between 100.39% and 206.16% across eight assets), states that it uses Fireblocks MPC custody and holds ISO/IEC 27001 and 27701 certifications, and runs a public bug bounty on HackenProof; no reserves auditor is named and the certificate details are not published.
Risk warning Not financial advice. Crypto is highly volatile and may drop in value significantly. You may lose the amounts you invest and your investments do not benefit from any form of financial protection.
| Reserves method | Merkle proof, daily reports |
|---|---|
| Reserves auditor | None named |
| Custody, global platform | Fireblocks MPC, company statement |
| Custody, Flipster FZE | At least 90% in cold wallets |
| Key holder, Flipster FZE | Flipster FZE, sole custodian |
| Hot-wallet insurance | Stated; insurer not named |
| ISO/IEC 27001, 27701 | Stated; certificates not published |
| Bug bounty | HackenProof, public programme |
| Incident history | Not published |
Solid border: evidence opened at its source. Dashed: a company statement or company data. Dotted: an open item that the sources do not settle.
| Proof block | Issuer or method | Read | Evidence | Status |
|---|---|---|---|---|
| Reserves | Merkle proof with daily reserve reports, published by Flipster | 2026-10-06 | flipster.io/ | company data |
| Audits | No auditor is named for the reserves. The live page mentions “independent audits” without a firm, a report or a date. | 2026-10-06 | None published | to be confirmed |
| Custody model, global platform | “MPC cold-wallet custody with Fireblocks”, stated by Flipster. No contract or attestation is published. | 2026-10-06 | flipster.io/blog, TradFi guide | company statement |
| Custody model, Flipster FZE | At least 90% of client virtual assets in a cold wallet, less than 10% in a hot wallet; omnibus wallets; assets held in trust | 2026-10-06 | flipster.io/ | company statement |
| Key management | Flipster FZE states that it is sole custodian of the private keys. Key policy for the global platform is not published. | 2026-10-06 | flipster.io/ | company statement |
| Insurance | Flipster FZE states insurance for client virtual assets in its hot wallets. Insurer and limit are not named. | 2026-10-06 | flipster.io/ | company statement |
| Security testing | Flipster FZE states annual vulnerability assessments and penetration tests by an independent third party. The tester is not named. | 2026-10-11 | flipster.io/ | company statement |
| Certifications | ISO/IEC 27001 and ISO/IEC 27701, stated by Flipster. No certifying body is published. | 2026-10-06 | None published | to be confirmed |
| Bug bounty | HackenProof, programme “Flipster Web & Mobile” | 2026-10-11 | Flipster Web & Mobile on HackenProof | programme page opened |
| Licence, Flipster FZE | VARA public register, VASP Licence VL/26/07/002, Exchange Services | 2026-10-11 | Flipster FZE register entry | verified on register |
| Incident history | None published by Flipster | 2026-10-06 | None published | to be confirmed |
The licence is held by Flipster FZE only. Who runs each company is on legal entities and responsible individuals.
Flipster’s Proof of Reserves uses a Merkle tree. Each customer balance is hashed into a leaf, the leaves are hashed together in pairs, and the result is one root hash that Flipster publishes. Change a single balance and the root changes.
For each asset the page sets “Customer net balances” against “Flipster net balances” and shows the ratio between the two. Flipster describes “daily reserve reports” and offers a downloadable JSON file and a verification tool.
The figures are the company’s own and no auditor is named. The terms are in the definitions of cold wallet, MPC and Merkle tree.
Reserve ratios by asset
Eight assets were listed on 6 October 2026. The lowest ratio was 100.39% and the highest 206.16%. The figures change daily, so read the current report before you rely on them.
| Asset | Ratio | Against 100% |
|---|---|---|
| USDT | 106.11% | |
| BTC | 101.00% | |
| ETH | 103.77% | |
| USDC | 206.16% | |
| USDE | 173.95% | |
| TRX | 148.90% | |
| XRP | 101.99% | |
| NRSUSDTP | 100.39% |
How to verify your own balance
Open the report. Go to flipster.io/support/proof-of-reserves and note the report date and the Merkle root hash.
Get the data. Download the JSON file published with the report.
Run the check. Use the verification tool to confirm that your hashed balance is included in the tree. The check does not reveal your personal details.
Compare the roots. If the root you arrive at matches the published root, your balance was counted in that report.
Each step is explained in the guide to verifying a proof of reserves.
What the proof does not cover
- Who checked it. No auditor is named, although the live page mentions “independent audits” and “audited storage”.
- Other liabilities. The proof sets listed assets against customer balances. It says nothing about loans or other debts of the company.
- The time between reports. Each report is a point in time, and reserves can move before the next one.
- Assets outside the list. Only the assets in the report are covered.
How to read a ratio
A ratio compares what Flipster reports holding in one asset with what it reports owing customers in that asset. At 100% the two figures are equal. Above 100% the reported holdings are larger.
A ratio says nothing about who holds the keys, about assets that are not listed, or about the company’s solvency as a whole.
Those gaps are part of the custody and counterparty risks you carry on any exchange.
Global platform ROW
For the global platform, run by Flipster Corp, the company states “MPC cold-wallet custody with Fireblocks”. That is a company statement: no contract, attestation or wallet policy is published.
MPC stands for multi-party computation. A signing key is split into shares, so no single device holds the whole key. The technique is described in Fireblocks’ introduction to multi-party computation, which explains the technology and is not evidence of Flipster’s contract.
Flipster FZE (UAE) VARA
Flipster FZE states that it keeps “at least 90% of client virtual assets in a cold wallet, while less than 10% may be kept in a hot wallet”. The assets sit in omnibus wallets and are held in trust, Flipster FZE is sole custodian of the private keys, and the wallets are reconciled daily.
It also states “insurance to cover the value of client virtual assets held in our hot wallets”. The insurer and the limit are not named.
Flipster FZE is licensed by VARA for Exchange Services under VASP Licence VL/26/07/002; read the VARA licence and what it covers before you assume it applies to your account.
Flipster FZE states that a withdrawal needs four checks: a funding password, a Google Authenticator code and two one-time passcodes, one by text message and one by email. It also describes optional transaction limits. Whether the same checks apply on the global platform is not stated.
Four habits protect an account on any exchange:
- Use an authenticator app wherever the account offers one.
- Keep the funding password different from the login password.
- Type the address yourself or use a bookmark. Do not follow links in messages.
- Check the address and the network before you confirm, and compare the withdrawal fees by network.
Login, device and recovery topics are in the account security questions.
Flipster runs a public bug bounty on HackenProof under the programme name “Flipster Web & Mobile”, and HackenProof triages the reports. The scope read on 11 October 2026 covers flipster.io, app.flipster.io, api.flipster.io and the mobile apps.
Reward ranges were not read for this page. They are on the Flipster Web & Mobile programme page.
Flipster FZE also states annual vulnerability assessments and penetration tests by an independent third party. The tester is not named and no report is published.
Found a flaw or a fake site? See how to report a security issue or phishing attempt.
A certificate is a proof block only when it names its issuer, its number and its dates. Flipster states two ISO certifications and one third-party rating.
None of the three could be tied to an issuer document for this page, so none is shown as a badge. ISO/IEC 27001 covers information security management, and ISO/IEC 27701 extends it to privacy.
| Claim | Issuer | Certificate | Valid from, to | Evidence |
|---|---|---|---|---|
| ISO/IEC 27001 | Not published | Not published | Not published | Stated on flipster.io, read 2026-10-06 |
| ISO/IEC 27701 | Not published | Not published | Not published | Stated on flipster.io/blog, read 2026-10-06 |
| Exchange rating, stated as AAA | CER.live | Flipster page on CER.live | Not read | Stated on flipster.io; not confirmed on cer.live on 2026-10-11 |
Flipster publishes an Official Channel Verification tool. Enter a Telegram handle, an email address or a URL to check whether it is an official Flipster channel.
Support should not need your password, your funding password or an authenticator code. Treat any message that asks for one as phishing.
| Verification tool | flipster.io/channel-verification |
|---|---|
| Official domain | flipster.io |
| App and API hosts | app.flipster.io, api.flipster.io |
| Help centre | support.flipster.io |
| Official profiles | X, Telegram, LinkedIn |
Two things on Flipster carry the word insurance. Neither is deposit insurance.
The derivatives Insurance Fund absorbs the shortfall when a liquidated position closes at a loss larger than its margin. Under the Derivatives Trading Terms, margin left after the liquidation fee goes to the fund, and if the fund cannot absorb a position, counterparty liquidation can close a profitable position on the other side. See how liquidation and the insurance fund work on perpetual futures.
The hot-wallet insurance stated by Flipster FZE covers client virtual assets in its hot wallets, on terms that are not published.
The regulatory position is plain. Under the marketing rules of VARA, which licenses Flipster FZE under VL/26/07/002, marketing must state that an investor “can lose all the money or other value they invest, and does not benefit from any form of financial protection”.
Flipster publishes no incident history and no status page on its main site.
That is the absence of a record. It is not a record that nothing has happened, and this page makes no such claim.
| Date | What happened | What changed |
|---|---|---|
| No entry | No incident report is published by Flipster | Not applicable |
Is Flipster safe to use?
That depends on what you need to see evidenced. Evidenced: a Merkle-proof Proof of Reserves with daily reports, a public bug bounty triaged by HackenProof, and a VARA licence (VL/26/07/002) held by Flipster FZE for Exchange Services. Not evidenced: a reserves auditor, the ISO certificate details, the custody contract for the global platform and any incident history. Crypto held on an exchange can be lost.
Does Flipster have proof of reserves?
Yes. Flipster publishes a Proof of Reserves built on a Merkle tree, with daily reserve reports, a downloadable JSON file and a verification tool. On 6 October 2026 the page showed ratios from 100.39% to 206.16% across eight assets. Those are company figures, and you can test the inclusion of your own balance against the published root.
Who audits Flipster’s reserves?
No auditor is named. The live Proof of Reserves page mentions “independent audits” and “audited storage”, but it gives no firm, no report and no date. Until an audit report is published, treat the ratios as the company’s own data, checked only by the Merkle proof that each user can run for their own balance.
Are my assets insured?
No deposit insurance or investor protection scheme is stated for either Flipster company. Flipster FZE states insurance for client virtual assets held in its hot wallets, without naming the insurer or the limit. The derivatives Insurance Fund covers liquidation shortfalls between traders. It does not cover your balance if the exchange fails.
What we could not verify
- An auditor, a report or a date for the reserves.
- The certifying body and certificate numbers for the ISO statements.
- A contract or attestation for Fireblocks custody.
- The insurer and the limit of the hot-wallet insurance.
- The firm behind the penetration tests.
- Any incident log.
Where to go next
Check your own balance against the published Merkle root