After examining the current state of self-custody, my views on what setup to recommend to the average user have evolved.
As you know, I have not always advocated multisig. I previously believed that a strong passphrase with sufficient entropy provided adequate protection. However, following the Coldcard incident, I began reconsidering that recommendation: a passphrase can add security, but we still depend on the device on which it is used, leaving us exposed to both software flaws and supply chain attacks. A compromised device capable of capturing the passphrase or the derived keys can defeat that protection.
This led me to recommend multisig using devices from different manufacturers. However, the severity and scope of the Ledger attack have also made me question relying exclusively on hardware wallets, even when combining multiple brands.
A device being open source makes it possible to review how it works, but it does not guarantee that anyone has reviewed it thoroughly enough. We cannot assume that comprehensive, ongoing, independent audits exist, or that there are sufficient incentives to discover and disclose vulnerabilities.
Setups such as Yeti attempt to address this problem by relying on widely reviewed software, such as Bitcoin Core and Ubuntu, and on general-purpose hardware. The latter has an advantage: purchasing it does not directly identify the buyer as someone intending to hold bitcoin, which may make certain targeted supply chain attacks more difficult.
However, I also see limitations in this approach. If several keys are generated or used on the same computer, compromising that computer could compromise the entire setup. We still depend on Bitcoin Core, the operating system, and the hardware itself. A tampered download or a vulnerability in any of those layers could undermine security. Keeping the computer offline reduces risks, but does not eliminate the possibility of introducing malicious data or leaking information through the signatures it produces.
I also believe that a 3-of-7 setup adds too much complexity for the average user. Securely distributing and maintaining seven keys and their backups is difficult in practice. Nor am I comfortable relying on digital backups for long-term recovery: they require maintenance and may become tied to storage media, software, or formats that are no longer accessible.
For these reasons, my proposal would be:
- A 2-of-3 multisig setup, balancing security, redundancy, and ease of management.
- Durable physical backups, such as metal plates, while also preserving the complete multisig wallet configuration.
- Three independent general-purpose devices, from different manufacturers and running different applications.
- Only one private key on each device, generated independently, with no device ever having access to the other two keys.
One combination I would consider exploring is:
- An Android device running Electrum.
- Another Android device from a different manufacturer running MetroVault.
- An iPhone running BlueWallet.
The idea is to diversify the hardware, the software, and, to some extent, the operating system. This way, compromising a single device or application would not be enough to spend the funds.
For this purpose, I would choose devices dedicated to signing, kept offline and separate from everyday phones. Backups should also be distributed so that a single incident cannot expose two keys or cause a loss of access.
This approach still has one significant weakness: **the level of review and auditing of the applications**. We cannot assume that all of them have undergone sufficient security analysis; MetroVault, for example, acknowledges that it has not yet undergone a formal independent audit.
That is why I believe the community should support the review of these tools, fund audits, and improve their interoperability and recovery procedures. The goal would be to have independent, straightforward signing applications subject to sustained scrutiny, using Bitcoin Core’s level of review as a benchmark.
This is the direction that currently seems most reasonable to me for reducing dependence on any single manufacturer, device, or application. Any criticism or suggestions for improving the setup are welcome.
Replies (40)
Now, I recommend considering multisig for added security, even with a strong passphrase. It's a balanced approach.
Now, I recommend considering multisig for added security, even with a strong passphrase. It's a balanced approach.
If you put that much effort in the setup, why not 3-of-3 multisig? It would add so much more security.
Almost everyone installing android is gonna to do it on a pwnt operating system or a pwnt device.
Given the prevalence of bad actor and sockpuppet 'influencers', specialist hardware is too risky.
And even ESP/STM32's are vulnerable to backdoored libraries.
I think the most effective mitigants are to generate private key directly from entropy, and put it through the derivation path on two different home brew set-ups.
The only people I know using hardware wallets are the ones who never do transactions of bigger values in real life. You don't need a hardware wallet, any piece of paper with you account keys is safer than whatever that "ledger" ever was.
Don't keep your funds all inside the same wallet. There are app like CoinMarketCap that permit to keep track of funds on multiple wallets without access to private keys (you have to manually set it up) but helps to keep track of the overall value.
My trust in software is proportional to the number of eyeballs it’s had on it. Bitcoin Core has had more eyeballs than any other bitcoin project combined.
I wouldn’t “diversify” away from the best software for the same reason I don’t diversify from Bitcoin into shitcoins. I only want the best.
3-of-3 creates a single-point-of-failure. 2-of-3 eliminates a single-point-of-failure such as a typo in a passphrase, which is essentially a 2-of-2. One minor mistake and you will hodl forever.
If you fuck up one of your keys in a 2-of-3, you can still recover. Ask me how I know. 😉
you might be interested in
@npub1j9kt...uswxThe hardware Wallet is an offline signing device. How are you going to sign a transaction if your info is written down on a piece of paper. Entering your seed in a wallet on a internet connected device every time you want to do a transaction is less secure then a hardware wallet. Or are you saying that you should only import the one private key that belongs to a single address in your wallet?
Cell phones have too big of an attack surface. I like The 10x your btc security guide because it reduces the attack surface. I'm also a big fan of TAILS, but sometimes I wonder about how secure it really is. I don't have a way to verify that the data is deleted.
I wonder if there's a way to hash the whole OS? 🤔
Well you have to weigh the risks. A typo versus the risk of three (instead of two) compromised devices/software needed to steel your assets.
If you make a setup like this (2-of-3, or 3-of-3). I suppose you test it before you use it. Like delete everything and recover it from backup seeds. So that way you know you don't have a typo.
Well you have to weigh the risks. A typo versus the risk of three (instead of two) compromised devices/software needed to steel your assets.
If you make a setup like this (2-of-3, or 3-of-3). I suppose you test it before you use it. Like delete everything and recover it from backup seeds. So that way you know you don't have a typo.
Did you have a typo in your passphrase? You could still try. It shouldn't be that difficult to recover.
I have had a typo and was able to recover, but it was nerve-racking.
There is a risk of two compromised devices, but the paper wallet has little chance of getting compromised unless there is some sort of nano technology I am unaware of.
The risk of the paper wallet is that the entropy cannot be verified.
Just install an app at some smartphone or laptop in your home with your daily usage account.
Instead of placing all the funds on a single wallet like those people are doing, keep most of the unused accounts away on cold wallets (e.g. piece of paper) and just run with the normal funds for everyday things.
Things like CakeWallet and the official Monero wallet never lost any funds to me. There is no replacement in MediaMarkt for a brain.
When the goal is daytrading, those funds are inside an exchange anyways and you can/will get riped when it happens because of the exposure. DeFi is an illusion or thing for casino players, not for those that compound profit over months.
I never used a hardware wallet myself because I want control of my keys. Turns out that is still a sane approach.
> The risk of the paper wallet is that the entropy cannot be verified.
Why is that? You can roll your own dice. Only part that needs a computer is the calculation of the checksum word (12th or 24th word) of your seed words.
And you can use an offline computer for that...
MetroVault is truly perfect for the purpose, much better than BlueWallet.
multisig is a pain in the ars, i'm not going to recommend it to anyone, and i'm using it myself. it's just to easy to fuck up, and I actually ended up writing my own script to spend it because there is a bug in electrum that prevents it from finding all my hardware wallets. if you're not confident that a peraon you recommend will do this, you should not recommend they use multisig
on another note, the revies problem is real and solveable. just make a revies log, where anyone can check who has looked at what lines of code with what intent and when
Three devices means three RNGs and three firmware builds you still can't inspect. Coldcard failed on randomness, not on the device model. Roll your own entropy (99 dice = 256 bits) and import it. For the signing box we ship a Linux whose kernel can't network - free.
imo for 99% of people multisig will never work. for technical bitcoiners, sure. a big value proposition of bitcoin would be increased adoption, i don't see adoption increasing with having to be paranoid all the time. i know its rational to be a bit paranoid atm, but with proper entropy a single wallet setup should be fine for most btc holders still (in my humble opinion)
I think the main issue is trusting entropy. So you dont recommend rolling dice?
Recent numbers back your caution about supply chains. Roughly 77 percent of reported crypto losses in Q3 2026, about $906 million, came from compromised suppliers, developer tools, and infrastructure sitting outside standard audits.
Encryption protocols have relied for years on entropy that has never failed because it is well-designed and thoroughly tested—the closest example to us being Bitcoin Core.
The dice analogy is like saying that just because one manufacturer produced a defective product, I’m going to start riding horses again.
That’s the problem—the lack of review—and it’s precisely what I explained in my message: hardware wallets are rarely reviewed because they’re commercial products; they aren’t there for the good of the community like Bitcoin Core, OpenSSL libraries, etc., are.
car
He is too lasy to roll a few dice. The horses analogy is stupid. Use a superior source of entropy (dice) instead of software that is not yet broken, so you can trust it. Don't trust, but verify with your own eyes.
I have been thinking of using COTS and normal consumer devices who we know are infected and not safe - to combine into something which never ever exists in 1 device.
So you have your phone, smart watch and laptop. You also have credit cards and such.
Then a combination of these could turn into a ephemeral multi sig wallet.
Or something, I am not sure at all yet.
MetroVault has been released with version 1.0 at 7. December 2025 and version 2.5 five days later. The developer Gorun Jinian is unknown and the code never has been audited. Looks a bit to strange.🤔
ALSO open source DOES NOT mean EVERYONE is REVIEWING OR PEN TESTING it
if dev not charging for DEV - then DEV NOT TO BE BLAMED for any flaw.
imagine how many people has SKILL + TIME + TOOLS to review APK code or even generate on their from source code IF FOSS . every bank now a days wants u install proprietary APK which tracks almost everything. nearly 97% users comply.
How do you create a paper wallet without software? You do it on an offline electronic device. You are back to square one. Which offline device are you going to use? An old smart phone/ an old laptop/desktop or a hardware wallet? Ideally you use a device that has no internet connection ability. So a desktop without a wificard would be my choise and not use it for something else.
I hope you do not advice people to create their paper wallet on an online device or even worse on a website!
That is the same extremist line of reasoning that you used for convincing people into buying a ledger and now here we are.
I had so far zero issues with my cheap approach, while your funds got SAFU.
Huh? I don't advise people to use a hardware wallet, let alone a ledger device. I am just saying that your reasoning is not the most secure and it seems insincere as you talk about a paper wallet like you don't need a computer to generate one. So my advise is the same as yours. Make use of a paper wallet, but generate it with an offline machine, never to be connected to the internet again. If your paper wallet is generated with an online machine it is not actually offline is it? Nothing extreme about it, just common sense.
You can have both: a 3 of 3 that becomes a 2 of 3 after a timelock. #Liana can build it.
Which wallet do you know that needs to be online for generating private keys?
That is invariably generated locally just like NOSTR keys here. If you mean disconnecting the computer from the internet when generating keys, that would be superstition and the same type of people that buy hardware wallets because somehow they are uncapable of keeping their phones clean or at the very least a second phone just for the large wallets.
There is really no replacement for a brain. Dumb people will always be dumb.
Yeah, I've tried it. It's interesting. I'm just worried that it's too complicated.
Agree that it is stupid to disconnect a computer from the internet to generate keys. Security wise it would make no difference if the computer was offline and connected later on.
But if you create it offline, sign offline and stay offline then the attack surface is much smaller. I believe that every online device is insecure (nothing to do with keeping it clean). Wether you are interesting enough for three letter agencies or other hackers is a whole other question. I think you are saying: the risk of getting hacked is so enormous small that it is not worth the effort. You could even say that adding complexity with offline setups leads to an increased loss of funds because users mess up ( not even talking about the fraud with hardware wallets).
That is a far more clear explanation than my simplistic one. Thank you.
To me that's the beauty of Liana: miniscripts are complicated but Liana takes care of it. You don't need to understand your descriptor, you just need to know it's important to keep it in multiple places.
@npub1qlr4...pd95 Checking who built MetroVault and whether anyone audited it is how I think about wallets too. I trust them more when the code has been reviewed in public.
