Why Bitcoin Why Strategy Bitcoin Products Tax Advantage Bond Pricing Portfolio Construction Newsletter Bitcoin Self Custody Bitcoin Stocks & ETFs Glossary About the Team
Your Keys, Your Bitcoin

Self-Custody: Own Your Keys

When you buy Bitcoin on an exchange, you don't actually own Bitcoin. You own a promise from the exchange to pay you Bitcoin. That's a meaningful distinction — and the history of crypto exchanges is a graveyard of broken promises.

Not Your Keys, Not Your Coins

The Bitcoin network doesn't know your name. It only knows addresses. Whoever controls the private key to an address controls the Bitcoin at that address.

Self-custody means you hold your own private keys. No middleman. No counterparty risk. No "we're pausing withdrawals" emails at 3am.

Why It Matters: The Ugly History

This isn't theoretical. Every one of these happened to real people who trusted someone else with their Bitcoin:

💀 Mt. Gox (2014)

850,000 BTC lost. Customers got pennies on the dollar — years later, after lengthy bankruptcy proceedings. The largest Bitcoin exchange of its time, gone overnight.

🔴 Celsius (2022)

Froze withdrawals overnight with no warning. Billions locked in bankruptcy. Regular people couldn't access their savings for months.

🚨 FTX (2022)

Sam Bankman-Fried misappropriated customer funds. $8 billion gone. The shock on everyone's faces — including prominent VCs who invested — was real.

⚠️ BlockFi, Voyager, Genesis

All collapsed in the same cycle. The pattern is always the same: the exchange got greedy, took risks with your money, and when it blew up — your coins were gone.

The pattern never changes.

Exchange gets greedy → takes risks with your money → blows up → your coins are gone. Self-custody breaks this cycle entirely. Your keys are on a device in your house. No bankruptcy court can touch them.

How Bitcoin Self-Custody Actually Works

Bitcoin ownership is just a secret number — a private key. Your wallet software uses that key to sign transactions. Anyone with the key controls the Bitcoin.

A hardware wallet is a small physical device that stores your private key offline, where no hacker can reach it. When you want to send Bitcoin, the device signs the transaction internally — your key never touches the internet.

🌱 Seed Phrase

A seed phrase is 12 or 24 words — ideally made from your own dice rolls (more on that below) — that work as a human-readable backup of your private key. Write it on paper or steel, store it somewhere secure. This is your master backup. If your device breaks, the seed restores everything.

🔐 Passphrase

A passphrase is an optional 25th word of your choosing — a second layer of protection. Even if someone finds your seed words, they can't access your funds without this extra word. Recommended for larger amounts.

Advanced concept: derivation paths and accounts let you organize multiple wallets from one seed. Don't worry about this until you're comfortable with the basics.

Hardware Wallets: What Changed in 2026

⚠️ October 2026 update: I no longer recommend Coldcard.

This page used to recommend one device: Coldcard. On July 30, 2026, Coinkite (the company that makes Coldcard) disclosed a firmware bug that generated seed phrases with far less randomness than advertised. Thieves have been regenerating those seeds offline and sweeping the wallets.

If a Coldcard generated your seed, treat that seed as compromised. The seed is the problem, not the device — so this is true even if you later loaded it into a different wallet, and even if you use a passphrase. A passphrase buys time; it doesn't fix a weak seed. Make a new seed the way described below and move your coins in a single transaction.

Sources: Coinkite's advisory · Coinkite's migration guide. Don't trust, verify.

The lesson I took from it: never let any single device make your seed. A hardware wallet's random number generator is code you can't see. Make the randomness yourself with dice, and use hardware only to check the result.

How to make a seed you can actually trust

1
Roll dice. 99 rolls of a casino die for a 24-word seed. Write the rolls down as you go, in order. Do this alone, with no phone or camera pointed at the table. (Coinkite's advisory treats 50 or more private rolls as enough for a 12-word seed. More is better.)
2
Enter the rolls into one device in dice-only mode — a Jade, or a Coldcard running the fixed firmware. Write down the 24 words it produces and the wallet fingerprint it displays.
3
Enter the same rolls into a second device from a different maker. It must show the same 24 words and the same fingerprint. If two independent devices agree, the seed came from your dice, not from a vendor's bug. In my own testing a Jade and a Coldcard produced identical words from the same rolls — but test it yourself on a throwaway set of rolls before you rely on it.
4
Only then fund it. Destroy the paper with the dice rolls. The 24 words are your backup now, not the rolls.

This is exactly how I do it: the same rolls go into a Jade, a Coldcard, and an old laptop that never touches the internet, and all three have to agree before the seed gets a single sat. A Coldcard on the fixed firmware is fine as one of the checkers. It is not fine as the thing that makes your seed. The same goes for every other brand — the point is that no single company's code gets trusted with your randomness.

⚠️ Critical: Buy Direct from the Manufacturer

Never buy a hardware wallet from Amazon, eBay, or any third-party marketplace. Hardware wallets can be tampered with before they reach you. Always order directly from the manufacturer's official website. This is non-negotiable.

Step-by-Step: Getting Started

Take an hour. Do it right. This is your money.

1
Buy two signing devices from two different makers, direct from each manufacturer (never Amazon — tamper risk). One turns your dice rolls into a seed; the other confirms it. I use a Jade and a Coldcard on the fixed firmware.
2
Make your seed with dice, not with the device — follow the four steps above. Both devices must show the same fingerprint before you go any further.
3
Write down your seed phrase on paper, right now, in order. Store it somewhere fireproof and private. This is not a digital thing. Do not take a photo. Do not type it anywhere.
4
Set a passphrase (optional but recommended for larger amounts). Write this down separately from your seed phrase. A passphrase is extra protection on top of a good seed. It is not a fix for a bad one.
5
Get your receive address — copy your Bitcoin receive address from the device display. Verify it matches what's shown in the companion app.
6
Send a small test amount from your exchange first — $20 worth. Verify it arrives in your wallet before moving anything significant.
7
Withdraw the rest from the exchange to your hardware wallet address. Congratulations — you're now the bank.

Common Mistakes to Avoid

🚫 Storing seed words digitally

Photos, cloud notes, password managers, text files — all of these are dangerous. If your seed phrase is on any internet-connected device, it's not safe. Paper only. Metal even better.

🚫 Buying from a third-party marketplace

Amazon, eBay, Craigslist — any of these could sell you a tampered device. Hardware wallets can be pre-loaded with malicious firmware that steals your seed phrase on setup. Buy direct. Every time.

🚫 Never testing recovery

Test your seed phrase before putting real money on the wallet. Wipe the device and restore from seed. Confirm it works. Only then fund it seriously.

🚫 Single point of failure

One copy of your seed phrase in one location is one house fire away from total loss. Consider storing a second copy in a separate physical location — a safe at work, a trusted family member's home, a bank safety deposit box.

🚫 Letting one device make your seed

This is the Coldcard lesson. If a device generated your seed for you, that seed is only as good as the company's code — and in 2026 we learned how that ends. Roll your own dice and check the result on two devices. How to do it ↑

🚫 Rushing

Take your time. Read the documentation. Go slow. A mistake during setup — writing down the wrong word, skipping verification — can cost you everything. This is worth doing carefully.

What About Bitcoin Treasury Stocks & Preferreds?

Self-custody applies specifically to Bitcoin (BTC). Strategy equity (MSTR), preferred shares (STRK/STRF/STRC/STRD), and convertible bonds are traditional securities — they're held in your brokerage account, same as any stock. No hardware wallet needed for those.

If you hold BTC and MSTR, self-custody the BTC. Keep the MSTR in your normal brokerage. Two different systems, each appropriate for what it holds.

Learn About Bitcoin Products →

The Bottom Line

If you own significant Bitcoin, self-custody isn't optional — it's responsible. Two hardware wallets and a set of casino dice cost a few hundred dollars. That's cheap insurance on any meaningful BTC position.

The exchanges aren't evil. They're convenient. But "convenient" and "safe" aren't the same thing in Bitcoin. History has proven this repeatedly, and the next FTX is already out there somewhere, waiting to happen.

Own your keys. Own your Bitcoin.

← Portfolio Allocation Bitcoin Stocks & ETFs
This is not financial advice. Please do your own research and consult a financial advisor before investing. Bitcoin and cryptocurrency carry significant risk of loss. Past performance does not guarantee future results.