It's not just the hacks and outright scams that make cryptocurrency a risky investment.

According to a report from the office of the New York state attorney general, the exchanges themselves — the places where would-be investors go to buy and sell cryptocurrencies like bitcoin and ether — are not doing enough to protect their customers. And that should concern you.

The in-depth look at 13 exchanges, released today, details all the ways in which major exchanges fail to guard their customers against fraud, manipulation, and abuse. It's not a pretty picture.

"[Virtual] asset trading platforms now in operation have not registered under state or federal securities or commodities laws," reads the report. "Nor have they implemented common standards for security, internal controls, market surveillance protocols, disclosures, or other investor and consumer protections. Accordingly, customers of virtual asset trading platforms face significant risks."

That those risks are varied and wide-ranging was perhaps to be expected. That they are not limited to some of, shall we say, the less scrupulous exchanges was perhaps not.

The New York State attorney general sent voluntary questionnaires out to 13 exchanges, and nine decided it was in their best interest to respond. The exchanges that did play ball include major names like Bitfinex, Bittrex, Coinbase, and Gemini Trust Company. Binance Limited, Gate.io, Huobi Global Limited, and Kraken all essentially told the AG to buzz off.

Which didn't go over so well.

"Based on the results of our report," wrote the official Twitter account of New York state attorney general Barbara Underwood's office, "we have also referred three platforms — Binance, Gate.io, and Kraken — to the New York State Department of Financial Services for possibly operating unlawfully in New York."

Based on the results of our report, we have also referred three platforms – Binance, https://t.co/UEMbx5VSWm, and Kraken – to the New York State Department of Financial Services for possibly operating unlawfully in New York. — NY AG Underwood (@NewYorkStateAG) September 18, 2018

The report looked at the possibility of market manipulation and insider trading at each exchange, in addition to the prevalence of automated and algorithmic trading. Many of the companies running the exchanges, the report shows, buy and sell cryptocurrencies on their own exchange — perhaps in an effort to maintain liquidity.

Coinbase, for example, told the AG that close to 20 percent of its "executed volume" was its own trading. Why is this a potential problem?

"[When] a significant percentage of the volume in one or more assets on a venue is attributable to one source," the report explains, "customers face the risk that the availability of liquidity in those assets could change, without notice and at any time, including when liquidity is needed most — namely, in times of market volatility or rapid price movement."

In other words, if the market suddenly tanks and Coinbase stops buying and selling on its own exchange, those mom and pop investors looking to offload their crypto before it hits rock bottom may not be able to find buyers. And then they'd be left holding some rapidly shrinking bags.

Coinbase, need we remind you, is one of the better regulated exchanges.

Kraken, which declined to answer the AG's questions, appeared to dismiss the very notion that scams even matter at all when it comes to trading cryptocurrency.

"In announcing the company’s decision not to participate in the Initiative," notes the report, "Kraken declared that market manipulation 'doesn’t matter to most crypto traders,' even while admitting that 'scams are rampant' in the industry."

This should not inspire confidence. But hey, it gets worse.

In a section titled "Protections for Customer Funds Are Often Limited or Illusory," the report helpfully informs us that "Generally accepted methods for auditing virtual assets do not exist." What's more, it continues that "several [tracking platforms] do not claim to do any independent auditing of their virtual currency holdings at all."

So, in conclusion, many cryptocurrency exchanges appear to be vulnerable to large-scale price manipulation via bots and fail to appropriately protect investors' funds.

That's something to keep in mind the next time your friend passionately attempts to convince you to put your savings into cryptocurrency.