Bitcoin Self-Custody — Keys, Backups and Inheritance
Bitcoin Self-Custody — Keys, Backups and Inheritance
Applied protocol under Finance and Wealth in the Wheel of Matter. Doctrinal ground at The Sovereign Substrate; the substrate itself at Bitcoin — Incorruptibility Without a Custodian; current devices and wallets at The Sovereign Stack. See also: Security and Protection, Stewardship.
Whoever holds their own Bitcoin keys has dismissed the custodian and inherited the custodian’s work. Three jobs come with the keys: keeping the secret from everyone, keeping it available after the holder is gone, and refusing it to the person who comes to demand it. Most self-custodied bitcoin that is lost is lost because one of those jobs was left undone. Very little is lost because the cryptography failed. The protocol below assigns each job to an arrangement made in advance, in a fixed order, so that the holding survives its holder’s mistakes, absence and capture.
The Sovereign Substrate holds custody among the five constitutional properties of a monetary substrate aligned with Logos: the holder of the key holds the substance, and no third party can freeze or reverse the holding. It also holds that a property given is not yet a property lived. Sovereignty is taken up, and the taking-up is the work of the Wheel of Harmony. Bitcoin — Incorruptibility Without a Custodian measured how rarely it is taken up: in April 2026 a single company held between 80.8 and 84.1 percent of the assets of United States spot bitcoin funds, and the article called that concentration a cultivation finding that belongs to the Wheel rather than to the network. Finance and Wealth § The Capture Gradient places self-custodied sound money on its sixth rung and compresses the rung’s disciplines into one sentence: hold the keys, run a node, add a passphrase and then multisig across makers as the holding grows and the capacity to keep it grows with it, arrange the keys so the holding survives the holder. What follows is that sentence carried out.
1. What Self-Custody Protects Against, and What It Exposes You To
Self-custody removes the institution from between the holder and the holding, and with it every failure that belongs to institutions. An exchange can freeze an account on a regulator’s letter, lend out deposits it was trusted to keep, or collapse overnight, as FTX did in November 2022 with its customers’ balances inside it. A custodian can also die. When Gerald Cotten, founder of the Canadian exchange QuadrigaCX, died in December 2018, he was the only person who could reach the cold wallets, and roughly 115,000 customers were left holding claims on about C$215 million in assets. Bitcoin in the holder’s own keys is exposed to none of this.
It exposes the holder instead to four risks, ranked here by how often each has actually taken bitcoin from people.
The largest risk is loss by the holder’s own hand: a backup never made, a phrase misspelled, a phone wiped, a paper thrown out by someone tidying. On August 3, 2026 the analyst Willy Woo estimated that about 1.57 million bitcoin had been lost in self-custody against about 1.51 million lost on exchanges, and Changpeng Zhao, Binance’s founder, used the figure the next day to argue that exchanges are the safer place. Woo published no method, and his self-custody total almost certainly counts early coins that are dormant rather than lost. Exchange failures also strike hundreds of thousands of people at once, where a holder’s error strikes one. The direction of the finding still holds: the holder loses more than thieves take from the holder.
The second risk is death without a plan, which turns every holder into a small QuadrigaCX.
The third is coercion, and it rises with visibility. Jameson Lopp’s archive of physical attacks on bitcoin holders listed 702 incidents by October 2026, 165 of them in 2025 and 134 in the first nine and a half months of 2026, with 31 deaths. Lopp attributes much of the recent growth to better searching rather than more crime, and the figures are best read as a floor. France has become the most cited case since January 2025, when David Balland, a co-founder of Ledger, was abducted from his home and mutilated before police freed him. Ralph Waldo Emerson put the general law in Compensation nearly two centuries earlier: when the gatherer gathers too much, nature “swells the estate, but kills the owner.” A large holding that others know about is a target, and no cryptography reaches the person standing at the door.
Device compromise comes fourth. It is real, and 2026 supplied three cases, which section 3 takes up. Ranked by what has actually happened to holders, though, the hacked signing device is the smallest of the four, and a protocol that spends all its care on the device has secured the strongest link.
2. Who Should Not Hold Their Own Keys Yet
Finance and Wealth sets the rule that governs this section: never convert into a form more sovereign than the capacity to steward it. A key held by someone who cannot yet keep it is a holding waiting to be lost, and the honest position for that person is a custodian they chose carefully, held as a bridge, while the capacity is built.
Four questions show where a person stands. Have they ever restored a wallet from its words alone and watched the same address reappear? Can they say, today, where two copies of a backup would live, neither of them beside the device? Does anyone outside the household know what they hold? Would anyone in the household know what to do if they died tomorrow? A person who answers the first two with no is not ready, and a person who answers the third with yes has a coercion problem to solve before a custody problem.
Capacity is built in three stages, and each is lived in before the next one is taken.
Stage one: learn on a small amount. A software wallet on a phone, holding a sum whose loss would sting and not wound. Here the holder learns to receive, to send, to read a transaction on a block explorer, and above all to wipe the wallet and bring it back from the paper. A retired phone that holds nothing but the wallet, stays switched off in a drawer and is updated each time it wakes comes closer to cold storage than most people expect, and it serves as the waiting room while a hardware signer is bought.
Stage two: move the holding to a hardware signer. A purpose-built device that generates the key inside itself, never exposes it to a networked machine, and shows every transaction on its own screen for approval.
Stage three: remove the single point of failure. A passphrase added to the words, or a multisignature arrangement across devices from different makers, chosen as section 4 describes.
Finance and Wealth sets the same order, a passphrase before multisig, and the reason sits in what multisig asks. It removes the single point of failure. It also multiplies what must be kept: two or three sets of words, the wallet’s configuration file, devices from several makers, and the knowledge of how they fit together. A holder who cannot yet restore one key with confidence will lose a two-of-three arrangement to their own confusion long before a thief breaks it. Multisig is the destination for the holder whose capacity has grown into it, and a passphrase is usually the step before it.
3. Choosing the Signing Device by Its Maker’s Process
A hardware signer is a promise made by the company that built it, and 2026 showed three ways the promise breaks.
On January 4, Ledger disclosed that a breach at Global-e, the partner processing orders for its online store, had exposed customers’ names, postal addresses, emails and phone numbers. No device and no key was touched. What leaked was a list of people who own hardware wallets and where they sleep, which is the coercion risk of section 1 delivered by mail. On July 30, an automated sweep emptied 500 single-signature addresses of about 594.5 bitcoin over four blocks. The keys had been made on Coldcard devices, whose firmware since a March 2021 change had silently fallen back to a predictable software generator instead of the hardware random source; Block estimated the effective strength of keys from the newer models at about 72 bits against the 128 a twelve-word phrase should carry. On October 9, Ledger asked CryptoBilis, its authorised distributor in Southeast Asia, to suspend all sales after wallets bought through that channel were drained of about $90 million, apparently through devices tampered with before they reached their buyers.
Each failure sat somewhere different: in a partner’s database, in a maker’s build, in a distribution channel. Each points to a criterion.
Bitcoin-only firmware. Less code, fewer coins to support, a smaller surface to get wrong. Most makers sell a Bitcoin-only edition beside the multi-coin one.
Open firmware that independent researchers can read and rebuild. The Coldcard flaw sat in published source for five years, so openness is no guarantee. It is the condition under which a flaw can be found by someone other than an attacker, and a closed design removes even that.
Key generation that does not trust a single source of randomness. The strongest devices combine their own random numbers with a second source, randomness from the companion computer or dice rolled by the holder, so that a broken generator on one side cannot make the key guessable. After July 2026 this is the criterion that matters most.
Bought from the maker, delivered to an address that reveals nothing. No marketplace, no reseller, no second-hand device, no device that arrives already set up or with words printed in the box. Where possible, shipped somewhere other than home.
A maker that discloses. Ledger, Coinkite and Block all published advisories within days of their incidents. The record of how a company behaves when it fails belongs in the decision.
The criteria outlast any product list. The Sovereign Stack § The Custody Layer surveys the devices that currently meet them, and the survey changes faster than the criteria do.
4. Generating the Key and Proving It Before Funding
A key is proven before it is trusted, and it is trusted before it holds anything. The sequence below is done once, alone, with the device and nothing else in reach of a camera.
Begin with the device fresh from its packaging and the maker’s companion software downloaded from the maker’s own site, which checks that the device is genuine. Create a new wallet and choose a 24-word backup. Where the device offers to mix in dice rolls, use them. Write each word by hand on paper, numbered, in capitals, and check it against the screen twice. Nothing about the words is typed, photographed, spoken aloud or stored in any device that touches a network: not a notes application, not a password manager, not a photograph that will sync to a cloud overnight.
Then decide between a passphrase and multisig.
The passphrase. An extra phrase, chosen by the holder and never generated by the device, combined with the 24 words to open a different wallet. The bitcoin goes into the wallet that words and passphrase open together. The words alone then open an empty wallet, so a burglar who finds the steel plate, or a relative who glimpses it, finds nothing. The passphrase also covers the failure of July 2026: because the device never generated it, Coldcard owners who had added a strong one were far less exposed to their device’s weak randomness than those who had not. It carries two hazards that must be held in mind every time it is used. There is no reset: lose the passphrase and the words open nothing. And a single wrong character opens a different, valid, empty wallet with no error message. A strong passphrase is five or six unrelated words, drawn by dice from a list such as the Electronic Frontier Foundation’s, never a name, a date or a line of poetry, and it is entered on the device’s own screen and never on a computer.
Multisignature. Two of three keys, each on a device from a different maker, kept in different places. No single device, maker or location can spend or lose the holding. The configuration file that describes how the keys combine must be backed up beside each key, since without it the keys alone are hard to reassemble. This is the arrangement Finance and Wealth names for material holdings, and section 2 gives the reason to reach it second.
Now prove the key. Ask the device for its first receiving address and write the first six and last six characters beside the words. Wipe the device. Restore it from the paper, with the passphrase if one was chosen. Ask again for the first receiving address. If it matches, the paper is a working key; if it does not, the error is found now, while nothing is at stake. Only then does money move, and it moves twice: a small test amount first, confirmed on a block explorer and on the device, then the rest.
5. Where the Words and the Passphrase Live
Backups are placed by two rules that pull against each other. No single place may hold enough to spend the bitcoin, and no single loss may destroy the means to spend it.
For a single key with a passphrase, the geometry that satisfies both rules is three places. The 24 words sit in two of them, for example a hidden spot in the holder’s own home and a trusted family member’s house. The passphrase is memorised and also written in a third place that holds no copy of the words: a safe-deposit box, a lawyer’s sealed file, the sealed letter of section 7. A thief who reaches any one place gets half a key at most. A fire that takes any one place leaves the other two able to rebuild everything. The signing device itself is never counted as a backup, and it never shares a safe with the words, since whoever takes the safe takes both.
Within the first weeks, the words move from paper onto steel, stamped or engraved letters on a plate that survives the house fire paper does not. The plate carries no label: nothing on it says bitcoin, wallet or seed.
Two shortcuts recur and both fail. Cutting a twelve-word phrase into halves leaves whoever finds one half roughly sixty bits to search, within reach of a determined attacker, while the loss of either half destroys the key. Where splitting is wanted, the standard built for it, Shamir’s secret sharing as implemented in SLIP-39, divides the secret so that any two of three shares rebuild it and one share reveals nothing. The second shortcut is the cloud in any form, encrypted or not: a backup that lives on someone else’s computer has handed the third job, refusal, to an operator the holder has never met.
6. Spending and Selling Without Exposing the Vault
The device that holds the savings signs ordinary transactions to addresses, and it never connects to a website. Almost every theft from a holder who kept good backups happens at the moment a wallet is connected to a site and asked to sign something its owner did not read. A vault that signs only plain payments has no such moment.
Every address is read on the device’s own screen before it is approved, because the screen of a networked computer can be rewritten by malware that swaps one address for another on the clipboard. When bitcoin arrives from another person, the receiving address is confirmed through a second channel, read aloud over a call, first six characters and last six. Every first payment to a new address is a test.
Selling routes through a second wallet. The holder keeps a separate trading wallet with its own words, and only that wallet ever connects to a trading venue. On sale day the vault sends that day’s amount, and only that amount, as a plain bitcoin payment to the venue’s deposit address. On Hyperliquid, as of October 2026, native bitcoin arrives through a bridge called Unit: deposits below 0.0003 bitcoin are lost, credit follows two confirmations, about half an hour, and the deposited coins are controlled by three guardians, any two of whom can act, who are not publicly named and whose system has no public audit. While bitcoin sits there it rests on other people’s honesty, so it sits there for the shortest time the sale allows. It is sold on the spot market for USDC, never on the perpetual-futures market the venue opens by default, where an order opens a leveraged bet instead of a sale. The proceeds are withdrawn the same day to the trading wallet, and the venue ends the day at zero. The holder should also know what USDC is: a dollar token whose issuer, Circle, can freeze any address, which makes it a rail for moving dollars and no place to keep them.
Coercion is planned for here as well. A passphrase lets the bare 24 words open a wallet of their own, and some holders leave a modest sum there, enough to be believed, to be handed over if the demand ever comes at the door. Fewer people knowing what is held does more than any device feature: no screenshots of balances, no talk of price at dinner, no hardware wallet box in the recycling.
7. Arranging the Keys So the Holding Survives You
A holding that dies with its holder is lost as completely as one that was stolen, and the heirs have no one to call. QuadrigaCX is the institutional version. The private version happens without a newspaper story, every month.
An heir needs four things, and the holder supplies them while alive. The heir must know the holding exists. They must know where the backups are, and where the passphrase is if there is one, since without it the words open an empty wallet. They need the steps of a restore written for someone who has never done one: which software, downloaded from where, and what to type. And they need to know whom to ask for help who will not simply take the coins.
All four go into a sealed letter written for a non-technical reader and stored apart from the backups. The letter names the device and the software, describes where each backup lives, and walks through the restore in numbered steps. It never contains the words themselves. A will can point to the letter’s existence without describing its contents, because a will can become a public document in probate. The letter is rewritten whenever the arrangement changes, and a holder who adds a passphrase and forgets to say so in the letter has left the heirs a key to an empty room.
Two arrangements move inheritance from trust into the protocol itself. In a two-of-three multisig, one key can sit with the heir, so that on the holder’s death the heir and one remaining backup reach the coins without anyone else. A time-locked recovery path, of the kind the Liana wallet builds on Bitcoin’s own scripting, adds a backup key that becomes valid only after the coins have sat unmoved for a set period, several months or a year, so the heir’s key can do nothing while the holder lives and is active. Pamela Morgan’s Cryptoasset Inheritance Planning remains the plainest guide to the documents themselves.
The Abrahamic cartography names the obligation underneath. The Qur’an condemns gold and silver hoarded as kanz and withheld from use (9:34), and ʿAbd Allāh ibn ʿUmar, asked what kanz meant, answered that wealth whose due has been paid is not kanz. Wealth is held as a trust, amāna, and stored wealth is judged by whether what it owes keeps reaching those it is owed to: the poor while the holder lives, the family after. A holding that only its holder can open fails that test on the day the holder dies.
8. The Yearly Test That Shows It Still Works
An arrangement made once decays without anyone noticing. Paper fades, a family moves house, firmware changes, the holding grows past the stage it was arranged for, and a letter written three years ago describes a setup that no longer exists. Once a year, on a fixed date, the holder checks it.
Three questions carry the whole test. Could you restore from the backups alone, today, without the device? Answer it by doing it: restore on a spare device, or run the device’s own backup check, and confirm the first address against the one written down. Would your heir know what to do? Answer it by reading the letter as if you were them, and rewriting what no longer matches. If someone demanded the bitcoin tonight, what would you hand over? Answer it by knowing, in advance, which wallet that would be.
Around those three, the holder confirms that each backup is where the letter says and still legible, reads the maker’s release notes before installing any firmware update rather than after, counts who now knows what is held, and asks whether the holding has outgrown its stage, the moment to move from a single key toward a passphrase or from a passphrase toward multisig.
A holder who can answer all three questions has done what the custodian used to do. Bitcoin — Incorruptibility Without a Custodian ends on a machine in a spare room, checking arithmetic nobody asked it to check, and calls it what the mint became. Custody completes the picture. Verification became an act the holder performs, and custody became a discipline the holder keeps: a few hours of care in the first month, an evening each year, and the habit of saying little. Stewardship sits at the centre of the Wheel of Matter for this reason. Matter well held asks for attention once and then gives attention back, and the attention that no longer goes to the fear of losing what was stored is free for what the storing was for.
See also: Finance and Wealth, The Sovereign Stack, The Sovereign Substrate, Bitcoin — Incorruptibility Without a Custodian, Security and Protection, Stewardship, Wheel of Matter, Cypherpunks and Harmonism, Sovereignty.