Bitvavo

Is Bitvavo safe?

Bitvavo is one of the safer places in Europe to hold crypto on an exchange, with one lesson from 2022 attached. It has not lost customer money to a hack since it launched in Amsterdam in 2018, it publishes a quarterly proof of reservesProof of reservesA report in which a crypto exchange shows that it holds enough coins to cover all customer balances, ideally checked by an outside firm.More in the glossary checked by an outside firm, and the Dutch AFM licensed it under MiCAMiCAThe EU's Markets in Crypto-Assets Regulation, which requires crypto exchanges and other providers to be licensed and supervised.More in the glossary in June 2025. We score it 81/100, a little behind Kraken and Bitstamp.

The catch is what happened when crypto lender Genesis froze withdrawals in November 2022. Bitvavo had €280 million stuck there.

What happened with Genesis and DCG

Bitvavo used to pay interest on some coins. To fund it, the exchange lent crypto to Genesis Global Capital, a subsidiary of the US group Digital Currency Group. After FTX collapsed, Genesis stopped withdrawals, and in December 2022 Bitvavo said it could not reach about €280 million (Reuters).

What sets this apart from the Gemini Earn freeze is who carried the risk. Bitvavo said it had enough money to cover customer assets, guaranteed the frozen amount itself, and kept withdrawals open. Genesis filed for bankruptcy on 20 January 2023, and in February Bitvavo said a deal in principle with DCG should return 80% to 100% of the claim. We found no report of customers losing money from the episode.

Still, it shows that before MiCAMiCAThe EU's Markets in Crypto-Assets Regulation, which requires crypto exchanges and other providers to be licensed and supervised.More in the glossary, coins on Bitvavo could be lent out to earn yield. MiCA's custody rules now forbid a crypto custodian from using client assets for its own account, which closes that door for EU exchanges.

Proof of reserves

Bitvavo's attestation is done every quarter by The Network Firm, a US accounting firm that does similar work for other exchanges. A third party takes an anonymised snapshot of all customer balances and builds a Merkle treeMerkle treeA way to combine many records into one short code, so that each person can check their own record is included without seeing anyone else's.More in the glossary, so each customer can check that their balance was counted. The September 2025 snapshot listed bitcoin, ether and most large coins at 100% or more, and euro balances at 111%.

That is the useful kind of proof of reservesProof of reservesA report in which a crypto exchange shows that it holds enough coins to cover all customer balances, ideally checked by an outside firm.More in the glossary, because it includes what Bitvavo owes customers, not only what it holds. It is still a snapshot. It cannot show debts outside customer balances, and unlike Coinbase or the Robinhood-owned Bitstamp, Bitvavo has no audited accounts filed with a securities regulator.

Licences

Jurisdiction	Status
Netherlands and EEA	MiCAMiCAThe EU's Markets in Crypto-Assets Regulation, which requires crypto exchanges and other providers to be licensed and supervised.More in the glossary licence from the AFM, 26 June 2025, passported to 29 other EEA states
Netherlands (before MiCA)	Registered with De Nederlandsche Bank from 2020 for anti-money-launderingAnti-money launderingThe rules and checks that stop criminals from moving illegal money through banks, payment firms and crypto exchanges.More in the glossary rules
UK	Served some users until 2026; buy orders and deposits stopped 23 June 2026, all UK accounts closed after 21 July 2026 (Bitvavo cites the FCA's crypto promotion rules)
US, Asia	Not licensed, not available

A MiCA licence is a real step up from the old national registrations, which only checked money-laundering controls. It brings capital, governance and custody rules. But it is one licence in one region, which is why licensing scores lower here than at exchanges that also answer to New York or the UK.

Legal record and the CEO's exit

We found no fine against Bitvavo by the Dutch central bank or the AFM. That is worth something in the Netherlands, where the DNB fined Coinbase €3.3 million in 2023 for serving Dutch customers before it had registered.

In July 2025, co-founder and chief executive Mark Nuvelstijn stepped down with immediate effect after the newspaper Het Financieele Dagblad reported on his past dealings with an investor convicted of fraud. Bitvavo said the matter concerned his private investments and ran an internal review. CFO Johan van Olffen took over as interim CEO. No regulator action against the company followed in the sources we checked, but governance at a founder-run firm is worth keeping an eye on.

How to use Bitvavo more safely

1. Use an authenticator app for two-factorTwo-factor authenticationSigning in with a second proof of identity on top of your password, such as a code from an app, a security key or a passkey.More in the glossary login and withdrawals, not SMS.
2. Turn on the withdrawal address allowlist so coins can only go to wallets you have approved.
3. Check your balance in each quarterly proof of reservesProof of reservesA report in which a crypto exchange shows that it holds enough coins to cover all customer balances, ideally checked by an outside firm.More in the glossary. It takes a minute and tells you the snapshot included you.
4. Read the terms before using staking. Staked coins can be locked, and staking carries its own risks beyond exchange custody.
5. Keep long-term holdings in a wallet you control. MiCAMiCAThe EU's Markets in Crypto-Assets Regulation, which requires crypto exchanges and other providers to be licensed and supervised.More in the glossary segregation helps in a failure, but an exchange balance is still a claim on a company.

How we scored it

Security history (88) is Bitvavo's strongest factor: no customer money lost to hackers, and the Genesis hole was covered from its own funds. Licensing (74) and custody (74) are the weakest, because Bitvavo is licensed only in Europe and lent client crypto before MiCAMiCAThe EU's Markets in Crypto-Assets Regulation, which requires crypto exchanges and other providers to be licensed and supervised.More in the glossary banned the practice. Confidence is medium because Bitvavo's own pages could not be opened for this review, so the reserve ratios come from its published summary as indexed in September 2025. For a Vienna-based alternative with a similar MiCA licence, see Bitpanda.