River currently holds a large portion of client Bitcoin in a single 3-of-5 multisig cold storage address. River’s approach is more transparent and disciplined than most exchanges, but concentrating this much client capital in a single 3-of-5 address is not ideal risk management. It’s acceptable — not excellent. Pros: → Uses multisig instead of a single key → Funds are kept in cold storage → Full-reserve model (no lending of client BTC) → High transparency through public Proof of Reserves and a published on-chain address Cons: → Extreme concentration risk — tens of thousands of BTC in one address → Only 3 of 5 key holders are needed to move the funds → Creates a high-value single target → Falls short of best practices used by larger institutional custodians, who typically spread funds across multiple vaults This single address, holding more than 32,000 BTC and currently worth over $2B, is a massive target. If you want to do that as an individual or your company, fine. I wouldn't do that with other people's money, especially when there's no insurance to cover the "unexpected". This is a massive target for well-funded state actors. I applaud the transparency efforts, but there has to be another way.