In recent weeks, we’ve seen an increase in the number and severity of cybersecurity events occurring both within and outside of the Bitcoin industry:
- Hacks: Over the summer, a flaw in COLDCARD hardware wallet firmware was tied to the theft of roughly 1,367 bitcoin. More recently, attackers stole roughly $387 million from crypto exchange Bitget.
- Data breaches: Two separate data breaches have affected customers of hardware wallet manufacturers Keystone and Foundation. Coinbase just had another data breach, following a larger breach in 2025.
- Scams and phishing attacks: Advancements in AI allow scammers to more easily deceive people into handing over their information and assets. After the COLDCARD hacks, scammers sent fake emails posing as hardware wallet makers, offering a “hardware audit” to trick owners into installing malware.
AI makes it easier for attackers to go after your accounts and wallets. Even if River never exposes your data, attackers can use details leaked by other companies to target you.
It’s more important than ever to have strong protections in place, as this pattern won’t be slowing down.
Security has been our top priority since River’s founding in 2019. That means protecting your bitcoin and data, being open about how River operates, and keeping you informed as threats change.
Here are steps that make your bitcoin and data harder to steal:
Protect your account:
- Use two-factor authentication (2FA). River requires it for all clients, and we recommend turning it on for your email too, since your inbox can reset other accounts. Keep River’s account notifications on and read them. They’re often the first sign something is wrong.
- Turn on ForceField. ForceField puts a weekly limit on how much bitcoin can leave your account. Turning it off takes 5 days, and we notify you repeatedly during that time. This stops attackers from draining your bitcoin, even if they gain access to your phone or password.
Protect your data, but assume it’s already out there:
- Maintain strong privacy: Keeping your information private is the single most effective way to reduce the risk of scams and phishing attacks.
- When you receive a link from anyone, pause before you click. Don’t follow links in unexpected emails or texts, as these can include malware used to steal your information or funds.
- Be suspicious of phone calls from unknown numbers. River will never call you to ask for your two-factor codes, password, or account credentials. If someone calls claiming to be River, open the River app. A banner at the top shows whether River is on the phone with you.
River has never had a breach of client data. We plan to keep it that way. We run our own custody infrastructure to limit reliance on third parties, we maintain strict data controls, and are SOC 2 compliant.
If you hold your bitcoin on an exchange, do your due diligence. Never place blind trust in an exchange to keep your bitcoin safe. When vetting an exchange, keep these 11 questions in mind.
If you self-custody, make sure you’re following best practices. Our recent report outlines what to keep in mind when practicing self-custody.
The security landscape is rapidly evolving, and that won’t change anytime soon. The best defense is staying on top of best practices. We’ll keep doing our part behind the scenes and keep you informed as threats change. If anything ever seems off, reach out to our Client Services team at support@river.com.
