Is Bitpanda safe? What is verified about custody, audits and account security
Bitpanda GmbH is authorised as a crypto-asset service provider under MiCAR by the Austrian FMA (commercial register number 569240v), states that it holds ISO 27001 certification and a SOC 2 Type 2 report, and says it keeps crypto in cold storage examined by an external auditor; none of this removes market risk, and crypto-assets are not bank deposits.
Crypto-assets are highly volatile. You could sustain a loss of some or all of your investment, so it is important to invest only what you can afford to lose. Read the risk disclosure
Reviewed by Head of Compliance · Last reviewed
The short answer
No platform removes the risk of loss, so the useful question is what you can check. The first list is confirmed in public registers or stated by Bitpanda on its own site. The second is what the sources do not show.
What is verified
- Register Bitpanda GmbH is in the ESMA interim MiCA register, with the Austrian Financial Market Authority (FMA) as competent authority and as the date. The FMA company database lists it as a crypto-asset service provider under commercial register number 569240v.
- Register Bitpanda Asset Management GmbH, the German company, is authorised as a crypto-asset service provider under MiCAR by BaFin (BaFin-ID 10159692). The ESMA register dates this .
- Stated by Bitpanda Bitpanda holds ISO 27001 certification and has attained a SOC 2 Type 2 report.
- Stated by Bitpanda Crypto-assets are stored in cold storage facilities that are examined by an external auditor.
What is not published
- Certificate numbers, issuers and dates for ISO 27001 and SOC 2 Type 2.
- The name of the external auditor and its report on cold storage.
- A proof-of-reserves report.
- Insurance terms: insurer, limit and scope of cover.
- The share of client assets held in cold storage.
- A history of security incidents.
On this page a field marked to be confirmed is an open item, not a claim.
Certifications and independent assurance
Two statements on Bitpanda's security page point to an outside assessment. Neither comes with a document in the sources, so the evidence fields stay open.
ISO 27001
Bitpanda states that it holds ISO 27001 certification. ISO/IEC 27001 is the international standard for an information security management system. A certificate is issued by an independent certification body for a defined scope.
- Issuer
- to be confirmed
- Certificate no.
- to be confirmed
- Scope
- to be confirmed
- Validity dates
- to be confirmed
- Document
- to be confirmed
- Source
- Bitpanda security page, read
SOC 2 Type 2
Bitpanda states that it has attained a SOC 2 Type 2 report. Such a report is written by an independent auditor and describes how a company's security controls worked over a period of months. It is usually shared on request.
- Auditor
- to be confirmed
- Period covered
- to be confirmed
- Criteria in scope
- to be confirmed
- How to request
- to be confirmed
- Source
- Bitpanda security page, read
How customer crypto is stored
When you buy crypto on Bitpanda, Bitpanda GmbH holds it for you. Custody and administration of crypto-assets is one of the services listed for the company in the ESMA register.
Lending works differently
In Earn on Stablecoins you lend tokens to Bitpanda and ownership passes to Bitpanda for the term, so the custody rules on this page do not describe it. The staking page explains how staking and stablecoin lending differ from custody.
Cold storage and external audit
According to Bitpanda, crypto-assets are stored in cold storage facilities that are examined by an external auditor, and funds are secured in offline wallets. The sources give no figures and name no auditor.
- Custody model
- Custodial: Bitpanda GmbH holds crypto on behalf of clients
- Key management
- to be confirmed
- Share in cold storage
- to be confirmed
- External auditor
- to be confirmed
- Last examination
- to be confirmed
- Source
- Bitpanda security page and home page, read
Legal protection under MiCA
MiCA requires a provider that holds client crypto to make arrangements "to safeguard the ownership rights of clients", in particular if the provider becomes insolvent. The provider may not use client crypto-assets for its own account (Article 70) and must have a custody agreement with each client (Article 75).
- Legal basis
- Regulation (EU) 2023/1114 on EUR-Lex, Articles 70 and 75, read
- Applies to
- Bitpanda GmbH, for the custody service listed in the ESMA register
- Custody agreement
- to be confirmed
- Austrian insolvency law
- to be confirmed
Proof of reserves
No Bitpanda proof-of-reserves report appears in the sources read for this page. A proof-of-reserves report is an outside check that the assets a platform holds match what it owes its clients.
- Report
- to be confirmed
- Auditor and method
- to be confirmed
- Latest date
- to be confirmed
- Source
- Sources read and
For a single purchase, see where Bitcoin you buy is held. For the rules in full, read what MiCA requires of a custodian.
How your account is protected
- Passwords
- Stored as hashes, not in readable form.
- Two-factor authentication
- Optional time-based one-time passwords (TOTP) and multi-factor authentication.
- Password resets
- Each reset request is confirmed by e-mail, and you can freeze the account if you did not ask for it.
- Sessions and devices
- You can see which browsers and devices are signed in to your account.
- Notifications
- Bitpanda notifies you about important activity on your account.
- Anti-phishing code
- You can activate an anti-phishing code under Password & Security.
Switch on two-factor authentication
Two-factor authentication is optional, so it protects you only once you activate it. Do that before you add money, then set the anti-phishing code.
Both are in the security settings in the Bitpanda app. If you are locked out, start with the account access questions.
Platform security
Bitpanda's security page lists the measures below. They are the company's own description. The open fields show what would let an outsider check them.
Defences and development
Layered technical defences protect the platform, and software is built under a secure development lifecycle. An insider-threat monitoring programme covers internal activity. Operations, security and engineering teams work on a 24/7 coverage model.
- Evidence
- Bitpanda's own statement
- Outside check
- ISO 27001 and SOC 2 Type 2, with the open fields listed above
- Source
- Bitpanda security page, read
Penetration tests
External parties carry out penetration tests on Bitpanda's systems.
- Tester
- to be confirmed
- Cadence
- to be confirmed
- Latest test
- to be confirmed
Bug bounty programme
Bitpanda runs a public bug bounty programme for security researchers.
- Programme address
- to be confirmed
- Report contact
- to be confirmed
Incident history
The sources read for this page contain no list of past security incidents at Bitpanda.
- Incident log
- to be confirmed
- Last updated
- to be confirmed
What protection schemes do and do not cover
Protection depends on the product and on the company that provides it. Crypto-assets are not bank deposits.
| Product | Provided by | What applies | What does not apply or is open |
|---|---|---|---|
| Crypto held with Bitpanda | Bitpanda GmbH | The safekeeping duties of MiCA: client ownership rights must be safeguarded and a custody agreement is required (Articles 70 and 75). | No deposit guarantee scheme covers crypto-assets. Authorisation under MiCAR does not protect you against a fall in prices. |
| Earn on Stablecoins | Bitpanda GmbH | Bitpanda describes it as an unregulated product that is not a regulated crypto-asset service under MiCAR. | No deposit protection and no investor-protection scheme. Ownership of the tokens passes to Bitpanda for the term. |
| Stocks and ETFs | Bitpanda Financial Services GmbH | The company is a shareholder of Anlegerentschädigung von Wertpapierfirmen GmbH, Vienna. | Scope and limit of cover: to be confirmed |
| Euro balances | Bitpanda Payments GmbH | The company is an e-money institution. | How client funds are safeguarded: to be confirmed |
Insurance
The sources name no insurer, no policy limit and no scope of cover for assets held with Bitpanda. This page therefore makes no statement about insurance.
- Insurer
- to be confirmed
- Cover and limit
- to be confirmed
- Who is covered
- to be confirmed
Security measures do not remove market risk. Read the risks that security measures cannot remove. If something has gone wrong, the route is set out under complaints and dispute bodies.
Phishing and fake Bitpanda sites
Bitpanda support never asks for your password, seed phrase, recovery codes or two-factor codes, and it does not message you first.
Criminals copy the look of well-known brands, and a copied login page can show up in search results. Check the address bar before you sign in, and open Bitpanda from the app or from a bookmark you saved yourself.
- Official websites
- www.bitpanda.com, support.bitpanda.com (help centre), blog.bitpanda.com (blog) and group.bitpanda.com (corporate site).
- Sign-in address
- to be confirmed
- Social profiles
- Bitpanda on LinkedIn, Bitpanda on X, Bitpanda on Facebook, Bitpanda on YouTube and Bitpanda on Instagram.
- Suspicious site or message
- Do not enter any details. Report a security concern to support through the in-app chat or the helpdesk.
Security FAQ
Is Bitpanda safe to use?
No investment platform is without risk. What you can check is this: Bitpanda GmbH is in the ESMA register and the FMA company database as a crypto-asset service provider under MiCAR, and Bitpanda states that it holds ISO 27001 certification and a SOC 2 Type 2 report. Certificate details, the auditor's name and a proof-of-reserves report are not published in the sources. Prices can still fall.
Is Bitpanda regulated?
Yes. Bitpanda GmbH is authorised as a crypto-asset service provider under MiCAR by the Austrian Financial Market Authority (FMA), under commercial register number 569240v. Stocks and ETFs, e-money services and precious metals come from separate group companies with their own supervisors. See the licence and register details for each company.
Does Bitpanda publish proof of reserves?
No proof-of-reserves report from Bitpanda appears in the sources read for this page on 6 and 11 October 2026. Bitpanda states that its cold storage facilities are examined by an external auditor, but it does not name the auditor or link a report. Until a report is published with auditor, method and date, treat this as an open item.
What happens to my crypto if Bitpanda becomes insolvent?
MiCA obliges a provider that holds client crypto to safeguard clients' ownership rights, especially in insolvency, and forbids it to use client assets for its own account. How that duty works in an Austrian insolvency, and how long it would take to get assets back, depends on Austrian law and on Bitpanda's custody agreement. No outcome is certain. Lending products such as Earn on Stablecoins are treated differently.
How do I secure my Bitpanda account?
Activate two-factor authentication, set the anti-phishing code under Password & Security and choose a password you use nowhere else. Look at the list of signed-in devices from time to time, and freeze the account if a password reset e-mail arrives that you did not request. Bitpanda support never asks for your password, seed phrase or codes.
More background is in the security and regulation guides in Bitpanda Academy. The companies are described on the page about the legal entities behind Bitpanda, and the Bitpanda product overview shows what each one offers.
Check the licences next
Security evidence is half of the answer. The other half is who supervises each Bitpanda company, and under which identifier.