Risk management is the set of practices that decide how much you can lose and under what circumstances, before anything goes wrong. Covered by it are position sizing, custody, diversification, and the rules you set in advance. On four separate occasions Bitcoin has fallen more than 77% from a peak, which is the environment these practices exist for.
The five categories of risk
Most discussion covers only the first. Between them, the others have destroyed more capital. Considerably more.
Market risk. Prices fall. This is the one everyone plans for, and it is the most survivable, because the asset still exists afterwards.
Custody risk. The platform holding your assets fails. FTX collapsed in November 2022 while ranking among the world's largest exchanges, having commingled customer funds with company money.
Execution risk. You cannot trade when you need to. During the market-wide crash of 10 October 2025, roughly $19 billion in leveraged positions liquidated across 1.62 million accounts, several exchanges suffered outages, and some conditional orders never executed.
Protocol risk. Code fails. DefiLlama's hack tracker records $7.6 billion in cumulative DeFi losses.
Operational risk. You make a mistake. Wrong network on a withdrawal, a mistyped crypto address, a malicious token approval, or a seed phrase typed into a fake site.
Position sizing, which does most of the work
Here is the single most consequential decision, and the least discussed.
Sizing determines whether a bad outcome is an inconvenience or a catastrophe. Able to fall 80% without changing your circumstances, a position is a different asset from an identical one sized four times larger, even though the chart is the same.
By common convention, traders risk a fixed small percentage of total capital per position, so no single outcome can end the account. What percentage suits you depends on your circumstances, and no page can determine that.
One arithmetic point worth internalising, from drawdown mathematics: a 50% loss requires a 100% gain to recover, and a 90% loss requires 900%. Sizing exists to keep you out of the range where recovery becomes implausible.
Custody decisions
Where assets sit is a risk decision, not an administrative one.
| Approach | Main risk | Main protection |
|---|---|---|
| Regulated exchange | Platform failure | Segregated funds, supervision, account recovery |
| Unregulated exchange | Platform failure with no recourse | Very little |
| Self-custody | Losing your keys permanently | No counterparty at all |
| Split across both | Complexity | No single point of failure |
For any platform, three practical questions: which regulator licenses it, whether client funds are segregated, and whether the licence is verifiable on the regulator's own public register rather than only on the exchange's website.
Practices that actually reduce exposure
- Decide the rules before you need them. A plan written under pressure is not a plan.
- Size for being wrong. Every position should survive the thesis failing.
- Diversify meaningfully. Ten altcoins that all fall together are closer to one position than ten.
- Withdraw address whitelisting, so funds can only leave to destinations you pre-approved.
- Two-factor authentication on every account, using an authenticator app rather than SMS.
- Test transactions before large transfers, and verify arrival at an address you control.
- Revoke stale token approvals on any wallet used with DEX platforms.
- Keep records of what you bought, when, and at what price, for both tax and honest self-assessment.
The risks people systematically underrate
Correlation. Crypto assets fall together. During market stress the diversification you thought you had largely disappears, because holders sell whatever they can rather than whatever they intended to.
Liquidity. A position is only worth what you can exit it for. A token with a large market cap and thin liquidity cannot be sold at anything near its displayed price.
Leverage. Borrowed positions liquidate automatically, and each forced sale pushes prices toward more liquidations. The October 2025 event is the clearest illustration available.
Yourself. The largest number of new buyers arrive after the largest gains, which is a documented behavioural pattern rather than an insult. Rules set in advance exist specifically because judgment degrades under pressure.
What risk management cannot do
Being honest about the limits.
Preventing losses is not what it does. Determining their size and whether they are survivable is, which is a different objective.
Identifying good assets is also outside its scope. Sizing a bad position correctly still loses money, just less of it.
Nor does it eliminate tail events. An exchange failure, a protocol exploit, or a regulatory shock can arrive without warning, and the response is limiting how much sits in any one place rather than predicting which one fails.
None of this constitutes advice about your circumstances. What level of risk suits you depends on your time horizon, your income, and what you can afford to lose entirely.
Where mb.io fits
Custody risk is the category you can most directly reduce by choosing where assets sit.
mb.io is a regulated crypto spot exchange backed by MultiBank Group, a financial institution founded in 2005 that serves more than 2 million clients across 100+ countries.
- Regulated by VARA in the UAE and AUSTRAC in Australia, both verifiable on public registers
- Institutional-grade MPC custody powered by Fireblocks, with segregated client funds
- 10/10 security score from Hacken, an independent blockchain security auditor
- Withdrawal controls that let you verify a destination before funds move
- 24/7 multilingual client support
Open your account and start trading on mb.io.
Frequently asked questions
What is risk management in crypto?
The practices that determine how much you can lose and under what circumstances, decided in advance. It covers position sizing, custody choices, diversification, and pre-set rules rather than reactions.
What is the most important risk management practice?
Position sizing, because it determines whether any single bad outcome is survivable. It matters more than entry timing, which receives far more attention.
How much should I risk per trade?
Conventional practice is a small fixed percentage of total capital, so no single loss can end the account. What percentage suits you depends on circumstances this page cannot assess.
Is diversification enough protection in crypto?
Less than in other asset classes, because crypto assets are heavily correlated and fall together during stress. Holding ten altcoins provides considerably less protection than holding ten uncorrelated assets would.
What is custody risk?
The risk that whoever holds your assets fails. FTX collapsed in November 2022 after commingling customer funds with company money, which remains the clearest example of why segregation and supervision matter.
How do I reduce operational risk?
Whitelist withdrawal addresses, use authenticator-based two-factor authentication, send test transactions before large transfers, verify networks before withdrawing, and revoke old token approvals.
Does a stop-loss protect me?
Partially. A stop-loss order determines when your order enters the market, not the price it receives. In fast moves and thin books it can fill well below your level, and during outages it may not execute.
What happened on 10 October 2025?
A market-wide crash liquidated roughly $19 billion in leveraged positions across 1.62 million accounts. Market makers withdrew, books went one-sided, several exchanges had outages, and some stop orders failed entirely.
