Keys & Kin · Issue 2 · Sat 17 Oct 2026

Is holding your own bitcoin still safe?

By Jason D’souza · 8-minute read

The year of hacks and leaks

2026 could easily be called the year of bitcoin hacks and leaks.

Last week, Ledger confirmed a hidden implant inside devices sold through one reseller in Southeast Asia: a small chip that read the 24 words off the screen during setup and sent them out over a mobile network. Since late July, Coldcard owners have found out that a firmware version from March 2021 created some wallets' keys with far weaker randomness than it should have, and around USD 116 million has been drained from those wallets. In August, Trezor told about 13,700 customers that their names, emails and home addresses had leaked through its shipping partner.

Three of the best-known names in self-custody, three different failures, in about three months. As bitcoin becomes more mainstream and more valuable, it becomes a bigger target.

So if you hold your own bitcoin, or you've been thinking about it, there's a fair question sitting in the back of your mind: is self-custody still the safe choice?

Three ways people are reacting

I've watched holders react to this disturbing news in roughly three ways.

They leave. Prominent voices have used moments like this to push ETFs and bitcoin treasury stocks as the "safer" way: the exposure, without the responsibility of holding your own coins. That's a real option, and last week's issue put it on the map. But it doesn't remove the risk, it moves it. Institutions use custodians like Coinbase, that run the same kinds of security protocols as discussed in this issue, except they hold highly concentrated bitcoin stacks, and a pile that big is always the target. When you run those protocols yourself, you are, in my opinion, far better protected and far more private. That's my opinion, and I have my own incentives (remember the spectrum).

They freeze. They read the headlines, feel uneasy, and change nothing. The device stays in the drawer, the words stay wherever they were written down, and the hope is that it is someone else's problem. Until it’s not.

They look closer. They ask a narrower question: which part of a setup did each of these stories actually hit, and does mine have the same weak spot?

The first two categories of people are understandable. Both treat self-custody as a binary: either it works or it doesn't. However, a bitcoin setup is a set of choices you make consciously, knowing what each one leads to. So I think it's slightly disingenuous to call self-custody unsafe. This issue is for the people in the third group, the ones who take a closer look.

The map

Most self-custody content out there assumes you're technical. I'm living proof that a non-technical person can understand, build and run a self-custody setup. So I've thought long and hard about how to explain what a setup actually involves, the choices it asks of you, and what those choices lead to.

I settled on a map with three layers. The choices you make in the first two decide the outcomes in the third: your security, your privacy, your convenience and your inheritability (how easily your family can take over). Every self-custody setup fits on it.

Layer 0: People and habits. Who holds what, and who knows what. This is the layer most setups skip. It includes you (written instructions, practice drills), your heir (trained, knows where to look and what to do) and your privacy habits (a separate email and a digital encrypted vault, and devices delivered without your name on a bitcoin order list).

Layer 1: Structure and parts. First the structure: how many keys exist and how many it takes to spend. One key with a passphrase works like a safe with a hidden compartment. A heir key on a timer works like a will that carries itself out if you stop showing up. A 2-of-3 multisig works like a joint account that needs any two of three signatures. A 3-of-5 works like a board vote.

Then four parts, one set per key:

• Signing device: the pen that signs. It lives offline and only ever passes out a signature. How it talks matters: indirectly (a QR code or a memory card, so there's never a live connection) or directly (a USB cable or Bluetooth).
• Coordinator: the wallet app on your phone or computer. It prepares the payment and shows your balance, but it holds no keys. Treat it like a waiter bringing you the bill: useful, but you still cross-check the bill; in our case you verify all transaction addresses on device before you sign.
• Node: where the wallet looks up your balance. Your own node is like checking your own bank statement. Someone else's server is like asking a stranger to look up your account: it works, but now they know what you hold.
• Backup: your seed on steel, in a place you chose, plus a descriptor for any setup with more than one key. If the seed is the key to a house, the descriptor is the floor plan: it says which keys belong to this house and how many it takes to open the door. It can't open anything on its own, but without it, even the right keys can struggle to find the door.

Layer 2: Outcomes. Nobody "picks security." You pick parts, and security, privacy, convenience and inheritability are the result. Push one up and another usually comes down.

What this map doesn't argue: that self-custody is the best way to hold bitcoin. Last week settled that. There is no best way, only the incentives you choose and the trade-offs you actively accept; so you don't miss the forest for the trees.

Where the news lands on the map

Back to the three stories. Each one hit a different box.

• Ledger implant → how your device reached you (Layer 0, privacy and delivery). Buy direct from the maker, or have someone you trust do it, and check the device before you trust it.
• Coldcard flaw → how your key was created (Layer 1, backup). If the device's randomness fails, the key is weak from day one. One fix is to create the words yourself, by hand, so you're not relying on a single device for randomness.
• Trezor leak → who knows you hold bitcoin (Layer 0, privacy). Your name and address on a bitcoin order list is a risk no device can fix. Private delivery and a separate email take you off that list.

None of these is a reason to give up on self-custody. Each is a reason to know which box it hit, and whether your setup has the same weak spot.

Know your weakest box

When you look at self-custody this way, you see the whole range of risks at once. Then you pick out the ones that matter for you, based on where you live and who will inherit, and you adjust the parts until the setup fits you rather than the noise.

It also tells you where your setup is weakest. So you keep an eye on that one weak spot, instead of watching and reacting to every headline. That's how you sleep well at night.

Five setups, one map

Here is the same map filled in for the five setups I build with clients. Same boxes every time, different choices, so each one leans towards different outcomes. If you've taken the quiz, you'll recognise your profile. If you haven't, find yours in two minutes.

1. Fortified Vault: one maker's flaw or one bad day can't hurt you

• Built for: anyone whose biggest fear is a remote hack, a burglary, or a flaw in one device.
• Structure: 2-of-3 multisig, each key on a device from a different maker, each stored in a different place.
• Leans towards: security.
• Trade-off: the slowest to spend from; distance between the places is the defence.

2. Sovereign Minimalist: the fewest parts, and the most private

• Built for: someone who wants nobody to know, and as little as possible to look after.
• Structure: one key plus a passphrase. The words alone open a small decoy wallet; the real one needs the passphrase.
• Leans towards: privacy and convenience.
• Trade-off: one device carries a lot, so the device selection, backup strategy and the passphrase creation need extra care.

3. Automated Legacy: inheritance happens by itself

• Built for: a person whose first worry is "what happens if I'm gone?"
• Structure: your key spends any time; your heir's key can only spend after a period of you being inactive, that period is chosen by you beforehand. Your heir can't get in early, and the network itself enforces it.
• Leans towards: inheritability and convenience.
• Trade-off: if you're incapacitated rather than gone, your heir waits for the timer.

4. Agile Custodian: multisig you can spend from in minutes

• Built for: someone who spends or moves bitcoin often but still wants more than one key.
• Structure: 2-of-3 multisig, with one key kept ready on a dedicated laptop.
• Leans towards: security and convenience.
• Trade-off: two keys sit at home, so someone forcing you at home is the weak spot. In my experience, many people here accept this trade-off, because violent robbery is rare in the UAE.

5. Dynastic Protocol: no single person can act, including you

• Built for: larger holdings meant to last generations.
• Structure: 3-of-5 multisig, keys held by you, your heir, a lawyer and a vault, all five devices come from different manufacturers and ideally different device architecture.
• Leans towards: security and inheritability.
• Trade-off: the least convenient, and less private, because other people hold keys.

None of these is perfect. Each one is a set of trade-offs chosen on purpose.

Your one step this week

Take your own setup and walk it through the map, one box at a time:

1. People: if you were in hospital tomorrow, would your heir know where to look and what to do?
2. Parts: how does your signing device talk to your wallet, and whose server does your wallet ask for your balance?
3. Backup: if your device broke today, could you restore from what you've written down, and would anyone else know how?

Find the box where you are exposed.

Two holders, a year from now

Picture two holders with the same device, a year from now. There will be another headline; there always is.

The first reads it and feels the same knot in his stomach. He doesn't know whether it touches him, so he either does nothing or does something drastic.

The second reads it, sees which box it hit, and checks one thing. If his setup is fine there, he goes back to his day. If it isn't, he already knows what to fix, and so does his family.

Same bitcoin, same news. The difference is the map.

Like life, bitcoin is not black and white. Exploring the grey requires nuance and a certain framing.

Want help building your bitcoin setup? Hit reply, or write to me at jason@uaebitcoindecision.com.

Keep evolving.
Jason

P.S. Not sure which of the five fits you? The 4-question quiz matches you to a setup profile in about two minutes. Find your setup profile. And if a friend holds bitcoin, forward this to him.