River

We just published the November 2026 @River Proof of Reserves. Don't trust, verify.

At River a culture of security and paranoia has been in our DNA since day 1. Often that meant doing things the hard way instead of moving fast. For example, we have always operated our own custody system. This meant doing the work to be a regulated financial institution in our infancy instead of delegating the backend to companies like Prime Trust. We have always worked to minimize reliance on third parties where possible, and as our ability to build software systems accelerates we continue to delete both software and corporate dependencies. We budget a substantial % of our engineering resources every year to tackle tech debt and invest in security hardening. This means moving slower, but having confidence in our foundation and doing right by our clients. I personally give the company security training to every new employee who joins River and we constantly drive a culture of vigilance at the company. We tell every employee at River that their job is to be a security professional. Security isn't a team or a "thing" you do. It's a culture of extreme paranoia and humility - never feeling like you're secure enough and always trying to do better.

If you keep your Bitcoin on an exchange there are two doors that need to be guarded to keep your funds safe: your account login and the exchange custody system. Multi-factor authentication, device verification, withdrawal restrictions like ForceField, etc. are great features to prevent an attacker from compromising your account. However, none of these protections help you if the custody system backing the exchange is compromised, which is what just happened at Binance. Here is how River manages securing your coins internally: Hot wallet: Coins in a hot wallet are the most at risk. These coins are on systems connected to the public internet to process demand withdrawals for clients. The strategy is to keep enough coins in here to allow everyone to withdraw on-demand, but never too much that a hack could be financially devastating. River maintains a very low hot wallet balance, and on top of this we have strict internal manual approval policies if withdrawals exceed certain rate limits. Even if an attacker got through every single line of network defense and completely compromised our systems, they wouldn't be able to walk away with much BTC before being shut out. In order to ensure we always have sufficient coins hot, we have a staging "warm" wallet that is not accessible to process demand withdrawals, but can send funds to top up the hot wallet with sufficient internal approvals. However, the ultimate layer of defense is cold storage: Cold storage is a custody system where the signing keys are held offline, such that a full compromise of all computer systems could still not lead to a theft of funds. At River, we prove every month that we have more coins cold than we have in client BTC liabilities. You can verify this yourself at river.com/reserves. Our multi-sig cold storage system is designed for Bitcoin and Bitcoin alone. We are not exposed to any of the smart contract complexity that was exploited in the Binance hack. We will be sharing more in depth about our cold storage in the coming months. Some exchanges outsource custody, which effectively removes their ability to make any direct claim to you about the integrity and security of their systems. Choose your exchanges carefully. Ask yourself: “are the people running my exchange the most qualified to build a highly secure custody system?”