How Crypto.com Tokens Work: Swaps, Wallets, Rewards, and Security

What Crypto.com Tokens Are and Why They Matter

I started looking into Crypto.com tokens a while back because they kept showing up in different places - card rewards, exchange fees, chain gas, even lending. The main one is CRO. There was also MCO before it, but that got swapped out. This post walks through the big events: the swap, the card reward cuts, the massive burn, the exchange hack, moving funds to a wallet you control, and where things stand with lending and identity. No hype, just what happened and what it means if you hold or use these tokens.

The MCO to CRO Swap in 2020

On August 3, 2020, Crypto.com announced they would merge MCO into CRO. MCO jumped 37% that day. The swap ran through the app with a deadline of November 2. If you moved early - before September 2 - you got a 20% bonus paid in CRO, staked for six months. The fixed rate was 27.6439 CRO per MCO, or 33.17236 with the bonus. MCO already staked for a card got converted automatically, and the staking period stayed intact.

The catch? You had to do the swap inside the Crypto.com app. MCO sitting on an external exchange or even on the Crypto.com exchange first had to be moved into the app. The rate used a dollar-denominated average from the month before August 2. Because the dollar had weakened against the euro around that time, euro users saw the bonus shrink a bit in real terms. And if MCO corrected against CRO later, the bonus looked different depending on when you checked.

The sudden increase in MCO's price during the preceding 24 hours reduced the practical value of the bonus if CRO remained relatively stable.

Card Rewards Cut and What It Did to CRO

In May 2022, Crypto.com said they would phase out card staking rewards and slash cashback rates starting June 1. CRO dropped about 17% that day. Before, cards paid 1% to 8% cashback in CRO depending on tier. After, the bottom two tiers got 0%. The top three got 0.5%, 1%, and 2%. The highest 8% rate used to need roughly $400,000 worth of CRO locked up - the so-called Obsidian tier. That staking reward went away entirely.

Other perks stayed: 100% reimbursement for Netflix, Spotify, and Amazon Prime. But the community reacted hard. One Reddit comment said it was the only reason they used the card. Another user said they would ride out the staking period then leave. Threads popped up asking if the company was healthy and if the prepaid cards had a future. Some argued CRO lost its main utility and planned to sell once lock-ups ended. At the time, CRO traded around $0.29, down nearly 70% from its peak the previous November.

Cashback tiers before and after the change

The 70 Billion CRO Burn and Crypto.org Chain Launch

In February 2021, Crypto.com announced they would destroy 70 billion CRO - called the largest token burn in history at that point. The burn happened in two parts: 59.6 billion right away, then 10.4 billion monthly as tokens unlocked from smart contracts. Circulating supply was expected to jump from 24% to over 80%. The company tied this to fully decentralizing the Crypto.org Chain, which launched mainnet on March 25 with CRO as native currency.

After the burn, 5.9 billion CRO were allocated to block rewards and ecosystem development. The chain was described as open source, permissionless, and built for high-speed, low-cost payments, DeFi, and NFTs. CEO Kris Marszalek said they planned to build payments, DeFi, and NFT offerings on top of it, giving partners access to their 5 million-plus user base.

We plan to build our payments, DeFi and NFT offerings on top of Crypto.org Chain, as will many partner projects, getting the benefit of not only superior infrastructure, but also access to our full ecosystem with 5m+ user base.

On-Chain Lending Via Morpho on Cronos

Late in 2025, Crypto.com said they would embed the DeFi protocol Morpho directly into their products. The idea: customers deposit wrapped crypto as collateral, borrow stablecoins, and earn on-chain yields without leaving the Crypto.com interface. Morpho would set up lending markets on the Cronos blockchain, starting with wrapped Bitcoin (CDCBTC) and wrapped Ether (CDCETH).

Wrapped tokens mirror the value of assets on other networks. Users bring supported assets into Cronos-based markets and use them as collateral through the familiar app. Morpho co-founder Merlin Egalite said the goal is a trusted front-end experience with DeFi infrastructure in the back. The protocol was described as accessible to U.S. users. Egalite argued lending stablecoins and earning yield is separate from a stablecoin issuer paying interest, which the U.S. Genius Act restricts.

Morpho is the second-largest DeFi lending protocol after Aave, with about $7.7 billion in total value locked. It works as a matching and optimization layer on top of platforms like Aave and Compound. This arrangement mirrors a Coinbase partnership from September 2025, where Coinbase integrated Morpho vaults into its consumer app with help from Steakhouse Financial. Coinbase users could see yields up to 10.8% versus 4.5% for just holding USDC.

What the Morpho integration enables

The Genius Act was signed in July 2025. It bars stablecoin issuers from offering interest-bearing products but does not explicitly prohibit yields from decentralized lending. This creates a gray area. Egalite maintains Morpho's activity is outside the law's scope because lending a stablecoin and earning yield is independent of the issuer. Regulators could still scrutinize exchange-integrated lending if they decide it's too close to issuer-linked products. In August 2025, the Bank Policy Institute warned Congress that stablecoin loopholes could divert up to $6.6 trillion from banks. Coinbase disputed that, saying there was no evidence of deposit flight and that banks were protecting card-processing revenue. Both companies are positioning as crypto super apps covering lending, payments, and services that could substitute for banks.

Moving Crypto Off Exchange to a Wallet You Control

A guide from MEW published in April 2025 recommends moving crypto to a self-custodial wallet after trading on a custodial platform. The reasoning is simple: an exchange can become inaccessible or shut down, leaving users dependent on the platform for access. FTX users learned that the hard way. A custodial exchange manages your blockchain keys. A self-custodial wallet puts control of keys and assets in your hands.

The process starts by downloading the MEW Mobile app and creating a wallet on iOS or Android. Then in the Crypto.com app, you go to Accounts, then Crypto, pick the asset, hit Withdraw, choose External Wallet, add the MEW address via the plus symbol, select Wallet address, pick the cryptocurrency, check supported networks in MEW Mobile by tapping the network at top-left, return to Crypto.com, select the network, paste the MEW address, name the wallet, confirm you trust the address, enter passcode and 2FA, select the destination wallet, confirm again, enter amount, review, confirm, enter passcode and 2FA again. The tokens appear in MEW Mobile after confirmation.

The same flow works on the Crypto.com website: go to Accounts, click the three-dot menu under Crypto wallet, hit Withdraw, select or add the MEW address, confirm trust, enter amount, verify the network matches what MEW supports, confirm, enter passcode and 2FA. Processing takes a few minutes depending on the network. MEW describes itself as a free, client-side, open-source interface for Ethereum. MEW Mobile is on iOS and Android. If you are looking for a solid option to hold your own keys , this is one path.

Not your keys, not your coins.

The January 2022 Exchange Hack

On January 24, 2022, an analysis by Rob Behnke detailed an attack on the centralized Crypto.com exchange where attackers stole an estimated $33.7 million from user accounts. The exchange managed private keys for users. Instead of protecting a key directly, users logged in with username, password, and 2FA. The attackers found a vulnerability that let them bypass 2FA completely. Once bypassed, accounts were protected only by passwords.

They extracted 4,836.26 ETH (worth $15.2 million) and 443.93 BTC (worth $18.6 million) from 483 users. The stolen assets went to Tornado Cash, making them impossible to track. The exact bypass mechanism stayed unknown. Crypto.com's official statements were called limited and misleading. CEO Kris Marszalek initially said no customer funds were lost despite evidence otherwise. Later, Crypto.com said it moved to new 2FA infrastructure and strengthened security.

This attack illustrated the custodial risk. When an exchange manages your keys, you trust the exchange's security. A platform vulnerability can mean permanent loss of your funds - even with 2FA enabled. It's a reminder why moving to a self-custody wallet after trading matters. You can also explore a wallet that supports multiple chains if you hold assets across networks.

DeFi Wallet and the Ethereum Merge

In September 2022, Crypto.com announced its DeFi Wallet would support the Ethereum Merge - the shift from proof-of-work to proof-of-stake. The target was around September 15. No action was required from wallet users beforehand, and funds stayed accessible. Users were encouraged to wait until the upgrade completed before transacting.

The Merge combined the Beacon Chain (consensus layer) with Ethereum Mainnet (execution layer). It happened in two stages: Bellatrix on September 6 made the Beacon Chain merge-aware, then Paris activated when execution difficulty hit a specific Terminal Total Difficulty. The exact timing depended on mining difficulty, targeting September 10–20.

Two scenarios were possible. Scenario A: no blockchain split, ETH and ERC20 transactions continue without suspension. Scenario B: chain splits into proof-of-stake and proof-of-work branches. The "ETH" ticker goes to proof-of-stake tokens; forked tokens go to the proof-of-work branch. Forked tokens would be distributed based on ETH balance snapshots before Paris. Crypto.com DeFi Wallet reserved the right to decide whether to support a forked chain, applying the same listing review as other tokens. They would not support a fork that failed to prove stable. Wrapped ETH might or might not qualify for forked-token distribution depending on the fork project's rules.

Users were advised to avoid trading, sending, or receiving ETH and ERC20 tokens until the Merge completed. No action was needed to protect funds beforehand. Ethereum's full history from genesis would remain intact. Watch for scams - no "ETH2" token exists, no extra action needed to keep funds safe. Crypto.com directed users to status.crypto.com for platform updates.

NFTs and Web3 Identity Context

Crypto.com also runs an NFT platform. An interview with Jeff Zeller, senior director of NFT partnerships, from October 2022 gives context. He came from ESPN, Sony Music, and Apple. He first encountered NFTs minting CryptoKitties, then paid attention when NBA Top Shot blew up. He sees NFTs as combining entertainment, partnerships, merchandise, and marketing.

Zeller describes an NFT as a digital collectible with a visual layer (art, video, 3D) and an informational layer (attributes, artist, ownership history, access rights). People buy for art appreciation or community and experiences. Successful collections maintain active owner communities on Discord and Twitter, meeting at conferences and invite-only events. Value reflects art, community, and experiences - similar to physical collectibles.

Zeller identified three industry challenges: cross-border regulation (digital operations cross jurisdictions differently than physical goods), sustainability (Ethereum's move to proof-of-stake was a big step), and user onboarding (welcoming newcomers without overwhelming them). He addressed two misconceptions: NFTs can change - the permanent element is the blockchain record, not the visual asset; and you don't need technical skills - platforms like Crypto.com NFT make buying comparable to e-commerce.

People should enter the NFT space because they appreciate the art, collectible, or community rather than solely to make money.

A separate research report from September 2022 covered Web3 identity: self-sovereign identity (SSI), decentralized identifiers (DIDs), Web3 domains (.crypto,.dao,.eth), and soulbound tokens (SBTs). Web3 domains are human-readable names for wallet addresses, often NFTs themselves. ENS had over 2.17 million names. Unstoppable Domains offers NFT domains with no renewal fees on Polygon. Cronos ID offers.cro domains usable in Crypto.com DeFi Wallet and dApps.

Web3 identity building blocks

Soulbound tokens, proposed by Vitalik Buterin in January 2022, are non-transferable NFTs tied to an individual or entity. They can represent educational credentials, employment history, event participation. A "soul" is a wallet holding SBTs. They are publicly visible and revocable by issuers. Use cases include provenance, decentralized key management, undercollateralized lending, DAO governance, and programmable privacy. Risks include redlining (using SBTs to deny access) and privacy (SBTs are public). The report noted SBTs were in early stages with use cases expected to emerge.

Token Economics and Buybacks in General

A 2026 research piece by Spencer Bogart looked at why crypto markets reward token buybacks and revenue distributions even though traditional venture investors prefer reinvestment. In traditional startups, returning capital can signal a lack of growth ideas. In crypto, markets have rewarded the opposite: Aave passed a proposal to return all protocol revenue to token holders, Hyperliquid distributes $65 million monthly, and buybacks returned over $1 billion industry-wide in 2025.

Protocols don't always have the same reinvestment options as traditional companies. Liquidity incentives and grants have produced limited returns. Some protocols expand into adjacent products - Aave building a broader financial suite, Uniswap launching its own chain. But decentralized governance makes rapid execution hard. Product decisions pass through governance processes not built for speed. This narrows reinvestment options.

The relationship between a token holder and a protocol's economics has been unclear. Regulatory ambiguity, developing governance structures, and evolving mechanisms for directing cash flow to token holders all create uncertainty. Buybacks and fee distributions signal a concrete economic connection: "This token is tied to real economic value." Markets reward projects for providing a direct economic answer even if it's not the theoretically optimal long-term structure.

Protocols can reach economic maturity faster than traditional companies. Uniswap, Aave, and Hyperliquid process billions or trillions in volume on active infrastructure. A protocol can go from launch to scaled, cash-flowing infrastructure in a few years. The point where distributing revenue beats retaining it may arrive earlier than traditional investors expect. The model isn't fixed - markets could change if protocols learn to compound cash flow into broader platforms, or tokens may remain a different kind of economic asset rather than imitating corporate equity.

What This Means If You Hold or Use CRO

CRO has been through a lot: a token swap, a massive burn, card reward cuts, an exchange hack, chain launches, and now DeFi lending integrations. Each event shifted the token's utility and perception. The swap centralized utility into CRO. The burn reduced supply dramatically. The card reward cuts removed a major reason to hold and stake. The hack reminded everyone of custodial risk. The Morpho integration adds a new yield path - but in a regulatory gray zone.

If you hold CRO, you are holding a token tied to a centralized exchange's ecosystem, a standalone chain (Crypto.org), a sidechain (Cronos), and now embedded DeFi lending. The utility depends on which products you actually use. If you don't use the card, the exchange, or the lending, the token's value to you is mostly speculative. If you do use them, the token unlocks fee discounts, yield, and access.

Moving assets to a wallet you control - whether that's MEW Mobile, a hardware option , or another self-custody app - remains the single most important step after you finish trading. The 2022 hack proved that even 2FA isn't enough when the platform itself is compromised. A wallet is just a key manager - whoever holds the keys holds the coins. You can also check local wallet options if you're in a region with specific banking rails.

Staking CRO for card tiers used to be the main play. Staking crypto means locking tokens to support a network or product in exchange for rewards. Those rewards got cut. Now staking on Crypto.org Chain or Cronos for validation or DeFi is a different calculation. The burn helped supply dynamics, but demand still has to come from real usage - cards, chain fees, lending volume, NFT activity.

I don't track every price tick. I watch whether the products people actually use keep growing. The card, the exchange, the chains, the lending, the NFT marketplace - if those grow, CRO has a reason to exist beyond speculation. If they stall, the token becomes a bet on a turnaround. That's the simplest lens I've found.