Custody is a trade-off, not an ideological battle

The recently disclosed Coldcard security incident, which we covered last week, has brought a fundamental question back into focus: How secure is bitcoin self-custody? On certain devices and firmware versions, seed phrases were generated with significantly less randomness than intended. As a result, the private keys derived from them could be predicted under certain conditions. The vulnerability did not affect Bitcoin itself. It concerned the generation of the keys used to access it.

The incident is not evidence against hardware wallets or self-custody. Instead, it highlights a specific risk: Even a device used without a permanent internet connection depends on secure key generation, reliable software and robust processes. The key question is therefore not simply: "Which wallet is the most secure?" The following questions are just as important:

• What could go wrong with my custody model?
• Will I still be able to use the chosen setup correctly several years from now?
• What happens if I lose the ability required to manage it?

A sound custody solution combines technical security with a realistic assessment of your own abilities and personal circumstances.

A wallet does not store bitcoin

Bitcoin is not a file stored on a smartphone or hardware wallet. Put simply, the Bitcoin blockchain records how bitcoin may be transferred and under which conditions. A wallet manages the keys required to sign transactions.

Anyone who controls the necessary private keys therefore has the technical ability to sign a valid transaction and transfer the bitcoin to another address on the Bitcoin blockchain. If access to these keys is lost, the bitcoin concerned can generally no longer be moved. In a multisignature setup, several keys are required.

Three basic custody models

Self-custody

With self-custody, users control the necessary keys themselves. The options range from a software wallet on a smartphone to a hardware wallet. They include simple single-signature solutions as well as multisignature models that require several keys.

Important: A hardware wallet alone does not constitute a complete security framework. Its primary role is to protect private keys during their generation, storage and use. Secure seed phrase storage, transaction verification, wallet recovery and estate planning remain the user's responsibility.

Collaborative custody

With collaborative custody, control is distributed across several keys and often across several people or locations. A multisignature solution is generally used. In a two-of-three setup, for example, two of three keys are sufficient to sign a transaction. One possible arrangement involves one key held by the user, a second key stored in a separate location and a third key held by a specialised provider. However, which party can execute a transaction depends on how the keys are distributed.

Collaborative custody is not automatically the same as self-custody. The decisive question is whether users can move or fully recover their bitcoin without the provider's consent or continued existence. Anyone who controls only one of two required keys remains dependent on another party.

Third-party custody

With third-party custody, a provider manages the necessary keys. This provider may be a crypto exchange, a bank, a regulated custodian or an app provider. Clients access their bitcoin through an account and the processes defined by the provider. The legal structure varies. Depending on the provider, contract and jurisdiction, the custodied assets may be allocated directly to the client, or the client may only have a contractual claim against the provider. This should be examined in advance.

Which model might be suitable for whom?

A general recommendation would not be appropriate. The following overview indicates which models may be considered depending on the circumstances.

The value of the assets is not the only deciding factor. Technical knowledge, personal discipline, family circumstances, physical security and the ability to operate the setup correctly several years from now are equally important. A simple and well-understood solution can be more secure than a technically sophisticated system that few people can operate reliably.

Risks that are often overlooked

Loss and theft

Losing a hardware wallet does not automatically mean losing the bitcoin, provided that a functioning seed phrase backup exists. However, the device and seed phrase should not be stored in the same location. Depending on the setup, anyone who finds both may gain access. Multiple backups increase resilience, but they also create additional potential points of attack.

User error

Many losses result not from a technical attack but from incorrect entries or inadequate checks. Receiving addresses should be verified on a trusted device. Before making a large transfer, it is advisable to conduct a small test transaction. A controlled recovery test is equally important. A backup that has never been tested may provide only a false sense of security.

Technology and supply chain risks

How was the seed phrase generated? Can the source of the wallet software or firmware be verified? Are security notices and updates reviewed regularly? Does recovery depend entirely on a single manufacturer? The Coldcard incident falls into this category. It shows that even an offline device is only as reliable as its underlying key generation, software and implementation. Publicly available source code can facilitate independent reviews, but does not in itself guarantee that the software is free from errors.

Physical security

Backups must be protected against fire, water and other forms of damage. At the same time, the custody setup should not leave unnecessary indications that someone owns bitcoin. The more visible the setup and the more people who know about it, the greater the risks of burglary, theft or extortion.

Estate planning and incapacity

A technically secure wallet can become inaccessible if nobody other than its owner knows that it exists. Family members do not necessarily need direct access to the seed phrase. However, they should know that the bitcoin exists, where reliable instructions can be found and which steps must be taken in an emergency. An estate-planning solution must achieve two objectives: Unauthorised individuals must not gain access during the owner's lifetime, while authorised persons must be able to act in the event of illness, incapacity or death. Professional and legal advice may be appropriate for complex or substantial holdings.

A simple security checklist

• Understand who controls the necessary keys and which approvals are required for a transaction.
• For third-party custody, review the provider, legal framework, treatment of custodied assets, withdrawal procedures and emergency processes.
• With self-custody, store the seed phrase and device separately.
• Do not photograph the seed phrase or store it in an ordinary cloud service or unencrypted file.
• Never share a seed phrase with support staff or enter it on a website.
• Test the recovery process in a controlled manner, initially with a small amount.
• Keep firmware and wallet software up to date, but install updates only from verified sources.
• Document the setup clearly and plan for loss, illness, incapacity and death.
• Avoid unnecessary complexity. A solution is only secure if it can be operated correctly over the long term.

Important legal information

^{This publication is intended for information and marketing purposes only, and does not constitute investment advice or a specific individual investment recommendation. It is not a sales prospectus and does not constitute a request, an offer, or a recommendation to buy or sell investment instruments or investment services, or to engage in any other transaction. Maerki Baumann & Co. AG does not provide legal or tax advice. Investors are therefore advised to obtain independent legal or tax advice concerning the suitability of such investments, since their tax treatment depends on the personal circumstances of the investor in question and is subject to change at any time. ¬Maerki Baumann & Co. AG holds a Swiss banking licence issued by the Financial Market Supervisory Authority (FINMA). This publication is expressly not intended for persons domiciled in Germany or so-called U.S. persons.}

Editorial deadline: 10 August 2026

Maerki Baumann & Co. Ltd.
Dreikönigstrasse 6, CH-8002 Zurich
T +41 44 286 25 25, info@maerki-baumann.ch
maerki-baumann.ch | archip.ch