Bitvavo security record

AFM authorised Bitvavo under MiCA for the whole EEA

The Autoriteit Financiele Markten authorised Bitvavo as a crypto asset service provider under MiCA. The French AMF white list records the passport into France as taking effect on 14 July 2025 and names the three services covered: custody and administration of crypto assets, operation of a trading platform, and transfer services. The licence reaches every EU member state plus Norway, Iceland and Liechtenstein, on top of the national registrations Bitvavo already held in France, Austria, Italy, Spain and the Netherlands. It also puts Bitvavo under AFM conduct supervision, which the 2020 DNB registration explicitly did not. Bitvavo reported nearly two million users and described itself as the largest player globally in the EUR spot market.

Bitvavo obtains MiCA licence from the AFM

Proof of reserves covers 13 assets and is attested once a year

Bitvavo publishes a Merkle tree proof of reserves attested by the independent accounting firm The Network Firm LLP, and a logged in customer can generate a report checking their own balance against the latest attestation. Bitvavo dates the scope of the programme to 31 December 2024, covering BTC, ETH, XRP, EUR, ADA, SOL, DOGE, VET, LINK, HBAR, SUI, FET and SHIB. The page states that attestations are performed annually, so this is a yearly snapshot rather than continuous cover, and any asset outside those thirteen is not covered at all. The figures published as of 31 March 2026 show every asset in scope at a reserve ratio of 100 percent or better, with dogecoin at 104 percent and euro at 113 percent.

Bitvavo proof of reserves

Data breach exposed names, home addresses and IBANs

Bitvavo emailed affected customers about a breach that exposed full name, email address, home address, IBAN, recent trading volume and the last three digits of the phone number. It described those hit only as a limited group of users and never published a number. Bitvavo said user funds were safe and that it had no indication passwords had been exposed, said it had reported the breach to the relevant authorities, and told users to watch their accounts for unusual activity, change their passwords and turn on two factor authentication.

Opgelicht, AVROTROS: Bitvavo informs users about data breach

Five hour outage locked every user out of the platform

From about 13:30 customers could not log in, and Bitvavo put its systems into maintenance mode. Systems were brought back from 18:00 and the platform was running again at 18:30, so nothing could be traded, deposited or withdrawn for roughly five hours during market hours. On 23 November Bitvavo published the root cause confirmed by its third party cloud infrastructure provider: an infrastructure failure made worse by a monitoring system that entered a never ending loop while trying and failing to activate a backup, which the provider's engineers had to stop by hand. Customer assets were not involved. Bitvavo said it was accelerating a move to a microservices architecture to contain the next one.

Bitvavo: Update 3, November 14th incident

Deal with DCG set expected recovery at 80 to 100 percent

After a second hearing on the night of 6 February 2023, Bitvavo and other creditors reached an agreement in principle with Digital Currency Group, set out in a term sheet filed on 10 February. Bitvavo put the expected recovery rate at 80 to 100 percent, payable in cash, digital assets and convertible preferred equity notes in DCG. An offer covering roughly the first 70 percent had been on the table since the start of that year and Bitvavo had rejected it as short of what DCG could pay. Bitvavo sat on the unsecured creditors committee and repeated that it guaranteed the outstanding amount from its own financial resources, so the recovery rate moved Bitvavo's balance sheet and not any customer's balance. Read the range as the expectation Bitvavo published at the time, not as a settled final figure.

Bitvavo DCG update statement, 7 February 2023

280 million euros of customer assets frozen at Genesis

Bitvavo disclosed that 280 million euros was locked at Genesis Global Capital, the Digital Currency Group lender it used to pay yield on customer balances, after Genesis suspended repayments in the wake of the FTX collapse. Bitvavo put its total customer deposits and digital assets at about 1.6 billion euros, so roughly a sixth of the book sat with a single counterparty. Genesis filed for Chapter 11 on 20 January 2023. Bitvavo kept the platform and withdrawals running, said it had the funds to prefund the locked assets, and carried the claim itself rather than passing the loss to customers.

The Block: Bitvavo unable to access 280 million euros held at Genesis Global Capital

Cache misconfiguration exposed eight users' personal data

A misconfigured caching layer showed the personal data of eight users to other people logged in to the app and website for 15 minutes. Bitvavo cleared and reconfigured the cache inside those 15 minutes, then locked the app down because cached copies take about two hours to clear from user devices. All eight affected users were contacted and the Autoriteit Persoonsgegevens was notified. Funds were never at risk, and Bitvavo stated the cause was a misconfiguration on its own side rather than a hack. The same post introduced the Bitvavo Account Guarantee, which may reimburse up to 100,000 euros if someone gains unauthorised access to an account and misappropriates funds.

Bitvavo incident report, 7 September 2022

Registered with De Nederlandsche Bank as a crypto service provider

Bitvavo obtained the DNB registration that the Dutch implementation of the amended fourth anti money laundering directive, in force from 21 May 2020, made compulsory for exchange and custody providers. Its own press release was blunt about the limits: DNB supervised only compliance with the money laundering and terrorist financing prevention act and the 1977 sanctions act, there was no prudential supervision by DNB and no conduct supervision by the AFM, so financial requirements and business risks went unmonitored and there was no specific consumer protection. Bitvavo said Dutch clients had traded more than 3 billion euros on the platform that year. The registration has since been superseded by the 2025 MiCA licence.