Our review methodology

Our principles

• Criteria before commission: we assess every provider against the same criteria published here – before we even check whether there is a partner programme.
• Same information for everyone: our overviews and assessments are the same for all readers. We do not tell you personally which provider suits you.
• Bitcoin perspective: we only assess how well a provider is suited for buying, saving and holding bitcoin. Exchanges that also offer many other crypto assets are explicitly allowed. Whether a provider offers bitcoin only or other crypto assets too earns neither plus nor minus points – we do not assess the rest of their offering.
• No badges: we do not award “test winner” titles. Every assessment carries a review date.
• Open to corrections: if you find a mistake, we correct it and document it.

Which providers we consider

We consider services that allow private individuals in Germany to buy and safely hold bitcoin and that are relevant for beginners:

• bitcoin apps that offer bitcoin only,
• crypto exchanges and brokers where you can buy real bitcoin – even if they also offer other crypto assets,
• hardware wallets and metal backups for self-custody,
• tax software for record-keeping.

We only explain securities such as bitcoin ETPs as a product category; we do not assess or recommend individual products. Our comparison does not cover the entire market: we include providers that meet our minimum criteria and are relevant for beginners – with and without partnership.

26providers featured16with partnership10without partnershipWe currently feature 26 providers – 16 of them with a partnership, 10 without.+ Bitstack, Trade Republic, Ledger, Keystone, COLDCARD, Divly (partner without its own profile) – all partners

Minimum criteria for providers

A provider where you can buy bitcoin must meet all five criteria. Otherwise we do not include it and do not place an ad link – no matter how well known it is or how much commission it would pay.

1. 01MiCA licence in the ESMA registerThe provider is authorised as a crypto-asset service provider (CASP) under the EU MiCA regulation and listed in the register of the European Securities and Markets Authority (ESMA) – not on its list of non-compliant entities.
2. 02Real bitcoinYou buy real bitcoin – not derivatives, contracts for difference (CFDs) or securities that merely track bitcoin.
3. 03Withdrawal to your own walletYou can transfer your bitcoin at any time to a wallet whose keys only you hold.
4. 04Transparent costsFees and mark-ups (spread) are listed in a publicly available price list or clearly shown before every purchase.
5. 05Two-factor authenticationThe customer account can be protected with a second factor, e.g. an authenticator app or a security key.

We also exclude providers that are currently subject to a warning from BaFin or another EU supervisor, that block withdrawals without a comprehensible reason, or that advertise with promises of returns, leveraged products or artificial time pressure.

We check authorisation in the ESMA MiCA register and in the BaFin company database. You can do both yourself – we recommend it before opening any account.

How we score: 100 points

Providers that meet all minimum criteria are assessed in five areas. Each area receives 0 to 10 points and is weighted – so a maximum of 100 points is possible.

• Security & trust30 points
  What counts here

  • Supervision, domicile and legal form
  • Custody of customer assets (segregation, information on offline storage)
  • Account protection (2FA options, address whitelist)
  • Handling of past security incidents
• Costs25 points
  What counts here

  • Total cost including spread for sample purchases of €100 and €1,000 (in euros, because that is what you pay in)
  • Cost of the savings plan
  • Fee for withdrawing to your own wallet
  • Cost of euro deposits and withdrawals
• Bitcoin features & self-custody20 points
  What counts here

  • Route to your own wallet: withdrawal fee, effort, automatic withdrawal, address whitelist
  • Bitcoin savings plan: intervals and minimum amount
  • Lightning support
  • Buying bitcoin directly – without detours via tokens, swaps or certificates
• Beginner-friendliness15 points
  What counts here

  • Clear app and sign-up in the reader’s language
  • A simple route to buying bitcoin, without leverage or trading features in the foreground
  • Savings plan from small amounts
  • Clear warnings instead of pressure
• Transparency & support10 points
  What counts here

  • Reachable support
  • Tax report or transaction export
  • Understandable terms and communication during incidents

The order in our overviews follows this overall score. Whether a provider is a partner and how high a commission is does not count. The assessment is an editorial judgement based on these criteria – not a recommendation for your personal situation.

Hardware wallets, backups and tax software

Hardware wallets have their own criteria. Because no financial supervisor is responsible here, security, openness and reliable recovery matter most. Minimum criteria:

1. 01Own displayAddresses and transactions can be checked and confirmed on the device itself – not just on the computer or phone.
2. 02Standard recoveryThe wallet can be restored from its seed phrase using an open standard (BIP39), including with other software or another device.
3. 03Verifiable firmwareThe firmware is open source or independently audited in a verifiable way.
4. 04Actively maintainedThe manufacturer ships security updates and communicates openly about vulnerabilities and incidents.
5. 05Bought from the manufacturerWe only link to the manufacturer’s official shop or authorised resellers – never second-hand marketplace listings.

Scoring (100 points)

• Security architecture35 points
  What counts here

  • Key protection (e.g. secure element)
  • Air-gapped operation (QR code, memory card) possible
  • PIN, passphrase and protection against theft
• Openness & verifiability20 points
  What counts here

  • Open-source firmware and software
  • Reproducible builds
  • Independent audits
• Ease of use for beginners20 points
  What counts here

  • Set-up and companion app
  • Clear instructions
  • Compatibility with common wallet software
• Bitcoin focus10 points
  What counts here

  • Bitcoin-only edition available
  • Support for multisig and current address formats
• Manufacturer & privacy when buying10 points
  What counts here

  • Handling of customer data and past data leaks
  • Delivery to a parcel locker or pick-up point possible
• Price5 points
  What counts here

  • Price relative to features

Metal backups are assessed mainly on the basis of independent stress tests with heat, acid and pressure – for example the public tests by Jameson Lopp – and on how easily the seed phrase can be transferred without errors.

Tax software is assessed on whether it reflects German tax law (holding period, FIFO method), can import data from exchanges and wallets, how it handles your data and what it costs. It is a tool and does not replace tax advice.

Where our data comes from

• ESMA’s register of crypto-asset service providers under MiCA and its list of non-compliant entities,
• BaFin’s company database and warnings,
• official price lists, fee pages and terms and conditions of the providers,
• security and transparency reports and announcements by providers and manufacturers,
• independent tests and reputable specialist media, especially for security incidents.

Every piece of information carries a date. Where we have tried a provider or device ourselves, we say so in the profile.

Price and network data

The bitcoin price, block height, coins issued, hashrate, difficulty, fees and the halving countdown are not written into our texts as fixed numbers – they are shown live:

• Sources: our server asks mempool.space first. If a value is unavailable there, it falls back – for the price to Bitstamp, Kraken and Coinbase, for network data to Blockstream and blockchain.info. Your browser only asks our server.
• Freshness: the server keeps values for up to one minute and remembers the last good state. Source and time are shown next to the links to live charts; if the values are older than 15 minutes, it says “last known values”. Without JavaScript you see the values from when the page was built.
• Price history: our calculators use Bitstamp daily closing prices (US dollars from August 2011, euros from July 2016) and mempool.space for earlier periods.
• Currency: prices, calculators and worked examples are in US dollars, the international reference for the bitcoin price. Euros remain for German tax thresholds and tax amounts – the tax office calculates in euros – and for prices and fees that a provider states in euros.

How often we review

• MiCA status: at least once a month and before every new partner link. ESMA updates its register weekly.
• Costs and conditions: at least every three months and immediately when a provider announces changes.
• Overall assessment: at least every six months.
• Immediately: in the event of security incidents, withdrawal freezes, loss of authorisation or measures by a supervisory authority.

The date of the last review is shown for every provider.

Handling incidents

If a serious incident occurs at a provider – such as a hack, a withdrawal freeze, insolvency, a data leak or the loss of its licence – we proceed as follows:

1. We assess the situation based on statements from the provider, the authorities and reputable media.
2. If readers could be harmed, we pause all ad links to this provider immediately – without waiting for a final resolution.
3. We add a dated note to the provider profile explaining what happened.
4. We reassess the provider. Without valid authorisation it is removed from our comparisons, and we remove all ad links.
5. Past incidents remain visible in the profile – factually and without gloating, so you can form your own view.

Partners and non-partners

Limits of our assessment

Our assessment is a careful editorial judgement – not a guarantee. Fees and conditions change, security can only be checked to a limited extent from the outside, and what suits many people may not suit you. Always check the current information directly with the provider before signing up and read our risk notice.

Report a mistake

Have you noticed an outdated fee, a mistake or an incident we have not yet taken into account? Write to support@blockchain21.net. We check every report and document corrections to content in our corrections log. Providers can also point out errors – but they have no influence on assessment or ranking.