← Back to Learn

Self-Custody: Holding Your Own Keys

If you don't hold your keys, you don't own your Bitcoin. Here is how to fix that.

Why Self-Custody Matters

When your Bitcoin sits on an exchange, it is the exchange that holds the private keys, not you. You have a balance on a screen, but you are trusting that company to keep your coins safe and give them back when you ask. History has shown this trust is often misplaced.

Exchanges have been hacked, frozen accounts without warning, gone bankrupt, and locked users out of their funds. When this happens, there is usually no recourse. The Bitcoin is gone.

Self-custody means you hold the private keys that control your Bitcoin. No company can freeze your funds, no hack on a remote server can take your coins, and no bankruptcy can wipe out your savings. It is the most fundamental form of financial sovereignty.

Types of Self-Custody Wallets

Mobile Wallets (Hot Wallets)

Apps on your phone that store your private keys. They are convenient for everyday use and small amounts. Because your phone is connected to the internet, they are considered "hot" storage, more convenient but slightly less secure than offline options.

Best for: Daily spending, small amounts, beginners getting started with self-custody.

Hardware Wallets (Cold Storage)

Dedicated physical devices that store your private keys offline. They only connect to a computer or phone briefly when you need to sign a transaction. The rest of the time, your keys exist in an air-gapped environment that malware cannot reach.

Best for: Larger amounts, long-term savings, anyone serious about security.

Multi-Signature Wallets

Wallets that require multiple keys to authorize a transaction (for example, 2-of-3 keys). This means no single device or location can move your Bitcoin alone. If one key is lost or compromised, you can still recover your funds using the remaining keys.

Best for: Significant savings, inheritance planning, high-security needs.

A simple rule of thumb

  • Small, spendable amounts: a hot wallet on your phone is fine. The convenience is worth the small trade-off in security when the amount would not hurt to lose.
  • Larger amounts, real savings: move to a dedicated hardware device that keeps keys offline. Some devices skip the seed phrase entirely and manage backup a different way; others are traditional seed-phrase devices with long track records. Either category is reasonable for a single device.
  • Amounts that would genuinely hurt to lose:don't rely on one device from one vendor. Use multisig, spreading keys across multiple devices (ideally from different manufacturers), so one lost, stolen, or flawed device can never move your funds alone.

Always buy hardware directly from the manufacturer's official site, and verify the address before you download any wallet software.

What Is Entropy, and Why It Matters

Every wallet needs a way to generate your seed phrase, and that process depends on entropy: genuine, unpredictable randomness. If the randomness behind your keys is even slightly predictable (say, a flawed random-number generator, or a shortcut in how a device or app creates your seed) an attacker who figures out the flaw can work backward and guess your keys, without ever touching your device or seeing your seed phrase.

This has happened in the real world: hardware wallets from well-regarded manufacturers have shipped with firmware bugs that generated keys in a predictable way instead of a truly random one, and attackers who found the flaw drained wallets without needing any information from the owner. No brand is immune. That is exactly why relying on a single device, no matter how reputable, is a risk in itself, and why multisig across multiple vendors is worth the extra setup once the amount matters.

The takeaway:high entropy means genuinely unpredictable randomness generating your keys. You can't verify entropy yourself, so the practical defense is not trusting any single vendor's randomness with everything you own. Split larger holdings across multiple devices and manufacturers with multisig, so one flaw, anywhere, is never enough to lose your funds.

Setting Up a Hardware Wallet

  1. Purchase from the manufacturer directly. Never buy a hardware wallet from a third-party seller or secondhand. Tampered devices have been used to steal funds.
  2. Initialize the device. When you first set it up, the device will generate a new seed phrase — a list of 12 or 24 words. This seed phrase is the master backup of your entire wallet.
  3. Write down your seed phrase on paper. Do not take a photo of it, do not store it in a note-taking app, do not email it to yourself. Write it on paper (or stamp it into metal for fire and water resistance) and store it somewhere physically secure.
  4. Verify the seed phrase. The device will ask you to confirm the words in order. This ensures you wrote them down correctly.
  5. Set a PIN. Choose a strong PIN to protect the device itself. If someone finds your hardware wallet, the PIN prevents them from using it.
  6. Send a small test transaction. Before transferring significant funds, send a small amount to the hardware wallet and verify it arrives. Then practice sending a small amount back. This confirms everything is working correctly.

Seed Phrase Security

Your seed phrase is the single most important thing to protect. Anyone who has your seed phrase can take all your Bitcoin from any device, anywhere in the world. Treat it like the combination to a vault.

Rules for your seed phrase:

  • Never store it digitally (no photos, no cloud storage, no text files)
  • Never share it with anyone, no legitimate service will ever ask for it
  • Store it in a physically secure location (safe, safety deposit box)
  • Consider storing a backup copy in a second secure location
  • Consider stamping it into metal to protect against fire and water damage
  • Test your backup: verify you can restore a wallet from the seed phrase

Common Mistakes to Avoid

  • Leaving Bitcoin on an exchange "temporarily." Temporary has a way of becoming permanent. Move coins to self-custody as soon as practical.
  • Using a single backup location. If your only seed phrase copy is destroyed in a fire or flood, your Bitcoin is gone forever.
  • Not testing your backup. A seed phrase you cannot restore from is not a real backup. Practice a recovery before you depend on it.
  • Overcomplicating it. A simple hardware wallet with a well-protected seed phrase is more secure than a complex setup you do not fully understand.

New to Bitcoin? Download Bitcoin Basics for Everyone to learn about wallets, keys, and the fundamentals before setting up self-custody.