Comparative Loss Data (River 2025 Report)
Published 8/4/2026, 6:50:18 PM
River's custody data does not prove that exchanges are inherently safer than self-custody. Instead, River’s research presents a conditional framework where the "safer" option depends on a user's technical proficiency and the specific security practices of the chosen exchange.
While River's data shows that more Bitcoin has been lost through self-custody mismanagement than through exchange failures, the report emphasizes that exchange custody introduces "counterparty risk" (insolvency and fraud) that is entirely outside the user's control.
Comparative Loss Data (River 2025 Report)
River’s January 2025 study quantified historical Bitcoin losses, showing that while self-custody has a higher aggregate loss volume, exchange losses are often more catastrophic for the broader market.
| Metric | Self-Custody | Exchange Custody |
|---|---|---|
| Estimated BTC Lost | ~1.6 million BTC | ~1.2 million BTC |
| Primary Risk Factor | User error (lost keys, weak backups) | Counterparty risk (insolvency, hacks) |
| Verifiability | Absolute (on-chain ownership) | Partial (~50% of top exchanges use PoR) |
| River's Verdict | Preferred for technical users | "May" be safer for non-technical users |
[Source: https://river.com/learn/files/river-custody-report-2025.pdf]
Key Analytical Findings
1. The "Conditional Safety" Argument
River explicitly states that a reputable exchange "may provide a higher level of protection... depending on your technical ability to handle your own setup." For users who cannot reliably manage private keys or secure a hardware wallet, the institutional-grade security of a top-tier exchange (multi-sig, redundant cold storage, SOC 2 compliance) is often the safer practical choice. [Source: https://river.com/learn/files/river-custody-report-2025.pdf]
2. Systemic vs. Individual Risk
The data distinguishes between the types of risk:
- Self-Custody: Losses are typically individual (e.g., a single user losing a seed phrase).
- Exchange Custody: Losses are often systemic. River notes that in 2022 alone, approximately 158,000 BTC were lost due to internal theft or insolvencies stemming from exchanges lending out customer deposits. [Source: https://river.com/learn/files/river-custody-report-2025.pdf]
3. The Proof of Reserves (PoR) Gap
River highlights a critical transparency issue: 7 out of the 10 largest U.S. exchanges still lack cryptographic Proof of Reserves. [Note: not independently confirmed] River argues that an exchange is only a viable "safe" alternative if it provides client-verifiable reserves and maintains a full-reserve (non-lending) model. [Source: https://river.com/learn/files/river-custody-report-2025.pdf]
4. Security Incident Trends
River's research indicates that private key compromises are a leading cause of stolen funds, accounting for 43.8% of all stolen crypto in 2024. [Contested: Independent sources like TRM Labs and Chainalysis report different figures for 2024, with some attributing higher percentages to infrastructure attacks.] This data is used by River to suggest that professional custody can mitigate the specific risk of key mismanagement. [Source: https://river.com/learn/files/river-custody-report-2025.pdf]
Conclusion
River’s data suggests that exchanges act as a "safety net" for the less technical, while self-custody remains the "gold standard" for sovereignty. The data does not declare a winner; rather, it proves that neither method is inherently safe without proper execution—self-custody requires technical discipline, while exchange custody requires rigorous due diligence into the platform's reserve and lending practices.