Fortress Bitcoin publishes practical security guides for people who hold meaningful amounts of bitcoin: self-custody, inheritance planning, multisig, and physical security, explained in plain language. We understand the needs of OGs, HNWIs and Bitcoin whales with specific requirements.
If your bitcoin is worth protecting like a house, it deserves security thinking to match. Start with the fundamentals, then build a setup that survives theft, loss, coercion, and time itself.
Fortress Bitcoin is a free library of plain-language security guides for large bitcoin holders. It covers the full lifecycle of serious bitcoin ownership: buying securely, storing keys, choosing custody structures, planning inheritance, defending against physical attack, and keeping everyday operations clean.
Most bitcoin security advice is written for small balances or for engineers. Fortress Bitcoin is written for the person with a life-changing amount of bitcoin and no interest in becoming a cryptographer to keep it safe. Every guide answers one question completely: what to do, what to avoid, and what order to do it in.
The library includes 26 in-depth guides across eight areas:
Bitcoin is a bearer instrument. Whoever controls the private keys controls the bitcoin, with no bank to call, no chargeback to file, and no customer support desk to reverse a mistake. This single fact reshapes every security decision a large holder makes.
A bitcoin transaction, once confirmed, is final. If keys are stolen, the bitcoin is gone in a way that a stolen painting or a drained bank account is not: there is no insurance adjuster, no police recovery process that can reverse the ledger, and no intermediary with the technical ability to claw funds back. Prevention is the entire game. Every other asset class lets you trade some prevention for recovery. Bitcoin does not.
Traditional security assumes the defender can absorb failures: a stolen credit card gets replaced, a hacked email gets recovered. With bitcoin, one compromised seed phrase can empty a lifetime of savings in minutes, from anywhere on earth, with no identity attached to the thief. Your defenses need to hold every time. The attacker's only need one lapse.
Self-custody means accepting three jobs that institutions normally split across teams: physical security of the keys, digital security of the devices, and operational discipline over years. Most losses do not come from sophisticated hacking. They come from ordinary failures: a seed phrase photographed and synced to cloud storage, a passphrase kept only in memory, a firmware update skipped until it is too late. The guides on this site treat boring operational discipline as the main event, because it is.
Bitcoin is designed to be held for decades. That means your security setup must survive things most security plans ignore: your own aging and memory, the death or incapacity of key holders, companies that shut down, devices that become obsolete, and heirs who have never used a hardware wallet. A setup that is secure today and unrecoverable in ten years is not secure. Inheritance planning is not an optional extra for large holders. It is core infrastructure, and it is covered in depth in the inheritance guides.
With bitcoin, visibility invites targeting. Address reuse, public bragging, and leaked personal data turn a holder into a mark for phishing, SIM swapping, extortion, and physical coercion. Operational privacy is not paranoia. It is the cheapest security upgrade available, and much of it costs nothing. See OpSec for Known Bitcoin Holders.
Self-custody means you hold the private keys that control your bitcoin, instead of trusting an exchange or custodian to hold them for you. In practice it means: a hardware wallet or signing device generates and stores your keys offline, you keep a backup of the seed phrase in a physically secure form, and no third party can move your funds without your keys.
The tradeoff is direct. Custodians can be hacked, go bankrupt, freeze withdrawals, or be compelled by governments. Self-custody removes those risks and replaces them with personal responsibility: lose your keys and your backup, and the bitcoin is unrecoverable by anyone, including you.
Single-signature (single-sig) means one key controls the funds. It is simple, widely supported, and easy to back up. Its weakness is total: whoever gets that one key gets everything.
Multisignature (multisig) requires multiple keys to authorize a transaction, for example 2-of-3. It converts single points of failure into distributed risk: a stolen key alone is useless, a lost key alone is survivable.
For large holders, the honest answer is that single-sig is a starting point, not a destination. The complexity of multisig is real: more keys to back up, more devices to maintain, more ways to confuse yourself. But past a certain amount, the cost of that complexity is smaller than the cost of a single key being the only thing between you and ruin. The full decision framework, including when single-sig plus a passphrase is enough and when it is not, is in Single-Sig vs Multisig for Large Holders.
A large holder starting from zero should aim for this baseline before optimizing anything else:
Each of these has a dedicated guide on this site. The order matters: device first, then backup, then passphrase, then documentation, then inheritance. Skip the documentation and the first four degrade the moment you are unavailable to explain them.
A hardware wallet is a small dedicated device that generates your bitcoin private keys and keeps them isolated from the internet. When you want to send bitcoin, the transaction is prepared on an internet-connected computer, transferred to the device, signed inside the device where the keys live, and the signed transaction goes back to be broadcast. The keys never touch an internet-connected machine.
This separation is the entire security proposition. Malware on your laptop can see an unsigned transaction, but it cannot extract the keys from the device to sign a different one.
The right device depends on your custody structure, not on brand loyalty. The comparison that matters for large amounts is in Coldcard vs Ledger for Large Amounts, but the principles generalize:
Air-gapped signing means the signing device never connects to another device by cable or wireless. Transaction data moves via QR codes or removable media. This removes entire classes of attack that depend on a compromised USB or Bluetooth connection.
For large holders, air-gapped operation is one of the highest-value upgrades available. It costs nothing beyond a device that supports it and a few extra seconds per transaction. The step-by-step setup is in Air-Gapped Signing Device Setup.
Firmware updates patch vulnerabilities, but a malicious or corrupted update is itself an attack vector. The safe routine from Verifying Firmware Updates Safely:
A skipped update leaves known vulnerabilities open. A rushed update can brick a device or worse. Scheduled, verified, unhurried updates are the middle path.
A seed phrase (recovery phrase) is a list of 12 or 24 ordinary words that encodes the master secret from which all of your wallet's private keys are derived. Anyone who has your seed phrase can recreate your entire wallet on any compatible device, anywhere in the world. It is the keys in human-readable form.
This makes the seed phrase the most sensitive object in your setup. The hardware wallet can be replaced. The PIN can be reset. The seed phrase cannot be changed: if it is exposed, the only remedy is to move your bitcoin to a brand new wallet generated from a brand new seed.
Paper degrades, burns, and dissolves. For meaningful amounts, the backup should be stamped or etched into metal: stainless steel or titanium plates that survive fire, water, and time. The comparison of storage locations, safes, bank vaults, and geographic separation is in Home Safe vs Bank Vault for Seed Storage and Seed Phrase Metal Backup Storage.
The non-negotiable rules:
A passphrase is an extra word you add to your seed phrase. The combination of seed plus passphrase generates a completely different wallet than the seed alone. It acts as a second factor: an attacker who finds your seed but not your passphrase finds an empty (or decoy) wallet.
This is powerful and dangerous in equal measure. The danger, documented in Hardware Wallet Passphrase Risks:
Large holders should treat the passphrase with the same seriousness as the seed: backed up physically, stored in a separate location, and included in the inheritance plan with clear instructions. The five mistakes that empty wallets, and how to avoid each, are detailed in the passphrase guide.
Shamir Secret Sharing (SSS) splits a secret into multiple shares, of which only a subset is needed to reconstruct it: for example, 3 shares created, any 2 required. Applied to a seed phrase, it removes the single piece of paper (or plate) as a single point of failure.
SSS is excellent for geographic distribution: shares in three cities, any two of which recover the wallet. Its costs are complexity and compatibility: shares must be generated and recombined with supporting software, and a confused heir with one share and no instructions has nothing. For most large holders, SSS is an advanced tool for specific problems (multi-location resilience, shared control without multisig), not a default. The mechanics and tradeoffs are in Shamir Secret Sharing for Bitcoin.
A multisig wallet is controlled by multiple keys, and a defined quorum of them must sign to move funds. In a 2-of-3 setup, three keys exist and any two can authorize a transaction. The keys should live on separate devices, ideally from different manufacturers, in different locations.
The security properties that matter:
Multisig trades one big risk for several smaller ones that must each be managed:
Multisig earns its complexity when the amount at stake makes single-key risk unacceptable and when you (or your setup) can sustain the operational overhead honestly. It is not worth it when it will be maintained sloppily: a 2-of-3 where two keys live in the same drawer is theater.
A pragmatic middle path many large holders use: single-sig plus a strong passphrase for the bulk, with clear documentation, while learning multisig on a smaller amount first. Graduate the full balance only after you have completed a full test recovery of the multisig on your own, without notes, under no time pressure. If you cannot do that, you are not ready to trust it with everything.
Because the problem is genuinely hard. Bitcoin inheritance requires transferring three things at once: the assets, the technical knowledge to access them, and the legal clarity to do so legitimately. Traditional estate planning handles the first and third. Bitcoin adds the second, and it is the one that fails most often: heirs who inherit keys they cannot use, or instructions they cannot follow, effectively inherit nothing.
Without a plan, the likely outcomes are: the keys are never found, the keys are found but the passphrase is not, the heirs find everything but cannot operate the wallet software, or the estate spends years in legal uncertainty while the bitcoin sits untouched. In every case the family experiences the loss twice: once in grief, once in wealth that was meant for them and is unreachable.
Involving heirs too early creates security risk (more people who know). Involving them too late creates recovery risk (nobody who knows). The balance depends on age, maturity, and the amount, and it should be staged: awareness first, then supervised practice with small amounts, then real responsibility. The age-by-age framework is in Kids and Bitcoin Inheritance.
The first 48 hours after death determine whether the plan works. Hour zero: the check-in is missed and the dead man's switch starts its countdown, with delays as a designed feature, not a bug. Hour six: the executor is notified and receives a process to follow, not spending authority. Hour twenty-four: the custody map is opened, showing every wallet, signer, backup, and device on one page. Hour forty-eight: recovery begins, using plain-English instructions written for stress and reviewed by counsel. Automation makes a bad plan fail faster, so the plan is mapped on paper before anything is automated.
A wrench attack is physical coercion: an attacker forces you to unlock your wallet and transfer your bitcoin, using violence or the threat of it. The name comes from the observation that a wrench (or its equivalent) defeats any encryption. Against a wrench, your cryptography is irrelevant. Your preparation is everything.
They follow a pattern, documented second by second in Wrench Attack Prevention at Home:
The uncomfortable truth is that most wrench attacks begin with the victim's own oversharing. Privacy is the first line of physical defense.
A duress wallet (a form of plausible deniability) is a secondary wallet, derived from the same seed with a different passphrase, holding a small amount of bitcoin. Under coercion, you surrender this wallet. The attacker sees a real wallet with real funds and a valid transaction history, and has no way to prove a larger wallet exists.
A duress wallet does not make you safe. It gives you something to give up, which changes the dynamics of the encounter. It must be prepared in advance: funded with a believable amount, used occasionally so its history looks real, and never mentioned to anyone. The full concept, including its limits, is in Duress Wallets and Plausible Deniability.
Make an attack costly, noisy, uncertain, and slow: good lighting, solid doors, an alarm system that actually notifies someone, and operational habits like not opening the door to unexpected visitors at night. None of this is bitcoin-specific, and all of it matters more for bitcoin holders than for anyone else, because the payoff for a successful home invasion is instant, irreversible, and borderless.
The deeper defense is structural: multisig with keys in multiple locations means no single visit can extract the funds. An attacker who learns your bitcoin requires two keys in two cities faces a very different calculation.
Opsec is the set of everyday habits that keep you from becoming a target and keep attackers from reaching your keys. It covers what you reveal, what you reuse, and what you click. For known bitcoin holders, opsec failures are the most common precursor to targeted attacks. The complete playbook is OpSec for Known Bitcoin Holders.
A SIM swap attacker convinces your mobile carrier to move your phone number to their SIM card. They then intercept your calls and texts, including SMS two-factor codes, and use them to reset passwords on your exchange, email, and other accounts.
Your phone number is the weakest link in your bitcoin security. Four fixes, all doable this week, from SIM Swap Protection for Bitcoiners:
An attacker sends tiny transactions (dust) from addresses that look almost identical to addresses you actually use: same first and last characters, different middle. Later, when you copy a receive address from your transaction history instead of generating a fresh one, you may paste the attacker's lookalike and send funds to them. The defense is procedural: always generate receive addresses from your own wallet, never copy them from history, and verify the full address on the signing device before confirming. Details in Address Poisoning Attacks Explained and Verifying Receive Addresses Securely.
Yes, and specifically one who understands that bitcoin is not like other property. An estate attorney needs to grasp: keys are not accounts, there is no institution to subpoena for access, a will that says "my bitcoin goes to my daughter" is meaningless without a working transfer mechanism, and poorly drafted documents can create legal authority without technical ability (or the reverse). Bring yours up to speed with Estate Lawyer Bitcoin Briefing, and confirm they understand self-custody before you sign anything.
Bitcoin tax treatment varies by jurisdiction, but the record-keeping burden is universal: acquisition dates, cost basis, and transaction history for every disposal. Heirs inherit your cost basis problems along with your coins. Keep clean records now: exchange statements, wallet exports, and a simple ledger of buys, sells, and transfers. Your executor and your accountant will both need them. The heir-and-executor checklist is in Inheritance Tax and Bitcoin Records. This is general operational guidance, not tax advice: confirm the specifics with a qualified professional in your jurisdiction.
Bitcoin insurance exists but is narrower than most holders expect. Custodial insurance typically covers the custodian's hot wallets against theft, not your self-custody setup. Personal policies may cover physical risks (burglary of devices) under valuables or cyber endorsements, with significant exclusions. The realistic picture for 2026, including what policies actually pay for and what they exclude, is in Bitcoin Insurance Options in 2026. Insurance is a supplement to good security, never a substitute: no policy restores keys that are simply lost.
Institutions face the same bearer-instrument risks as individuals, plus governance: who can authorize movements, how decisions are recorded, how key holders are vetted and replaced, and how auditors get visibility without getting keys. Family offices need frameworks that survive staff turnover and generational transfer (Bitcoin Custody for Family Offices). Companies holding bitcoin on the balance sheet need treasury controls: separation of duties, spending limits, and board-level policies (Business Treasury Bitcoin Security). And every institution faces the build-or-buy choice between self-custody and a qualified custodian (Choosing a Bitcoin Custodian vs Self-Custody).
Bitcoin in a divorce raises valuation, disclosure, and enforcement problems that courts are still learning to handle. The price volatility between filing and settlement alone can swing the marital estate dramatically. The practical guidance: disclose fully (hidden wallets discovered later destroy credibility and invite sanctions), get valuations in writing at defined dates, and address key transfer mechanics explicitly in the settlement rather than assuming they will work themselves out. See Divorce and Bitcoin Custody. This is general information, not legal advice.
The short, calm version: not imminently, and not in the way headlines suggest. Breaking bitcoin's cryptography with a quantum computer would require a machine far beyond anything that exists, and the network and wallet software have years of warning to migrate to quantum-resistant schemes if the threat materializes. Coins in addresses that have never spent (whose public keys are not exposed) are at less theoretical risk than reused addresses. The measured explanation is Quantum Computing and Bitcoin. Do not let quantum anxiety distract from the threats that empty wallets today: phishing, coercion, and lost backups.
You bought bitcoin years ago, it became a large part of your net worth, and your security setup has not kept up with the amount. Your priorities: a correct self-custody baseline, a passphrase done right, metal backups in separate locations, and an inheritance plan your family can actually execute. Start with Single-Sig vs Multisig for Large Holders, then Dead Man's Switch Bitcoin.
You steward bitcoin across generations and need governance, not just gadgets: documented procedures, redundant key holders, coordinator redundancy, and an estate plan integrated with the family's existing structures. Start with Bitcoin Custody for Family Offices and Estate Lawyer Bitcoin Briefing.
The company holds bitcoin and the board wants controls: who moves money, how it is approved, how it is audited, and what happens when someone leaves. Start with Business Treasury Bitcoin Security and Choosing a Bitcoin Custodian vs Self-Custody.
You are about to convert a large sum into bitcoin and want to do it right the first time. Do not buy first and figure out custody later. Read the self-custody and hardware wallet guides before the purchase settles, set up the full baseline, and practice recovery with a small amount before the large one arrives.
Path 1: Secure the basics (weekend project). Single-sig vs multisig decision, hardware wallet setup, metal seed backup, passphrase, written recovery procedure. Guides: single-sig vs multisig, coldcard vs ledger, seed phrase metal backup, passphrase risks.
Path 2: Protect against people (next). Wrench attack prevention, duress wallet, SIM swap lockdown, opsec cleanup. Guides: wrench attack prevention, duress wallets, SIM swap protection, opsec for known holders.
Path 3: Survive time (this month). Custody map, dead man's switch, estate attorney briefing, tax records, heir walkthrough. Guides: dead man's switch, estate lawyer briefing, inheritance tax records, kids and inheritance.
Path 4: Go institutional (when ready). Multisig build-out, coordinator redundancy, Shamir shares for geographic distribution, custodian evaluation, insurance review. Guides: multisig coordinator redundancy, Shamir secret sharing, choosing a custodian, insurance options.
Each path is ordered so that earlier steps protect you while you work on later ones. Do not start Path 4 before finishing Path 1.
There is no single safest way, only tradeoffs matched to your situation. For most large holders, the strong answer is: keys on reputable hardware wallets, seed backups stamped in metal in separate locations, a passphrase stored apart from the seed, and for the largest amounts, multisig across multiple devices and locations. The common thread in every good answer is the elimination of single points of failure, for both theft and loss.
There is no universal threshold, because it depends on your ability to operate multisig correctly. A useful rule: when the loss of the full amount would change your life, single-key custody is no longer appropriate. But multisig done badly is worse than single-sig done well. Learn it on a small amount first, complete an unaided test recovery, and only then migrate the balance.
Bitcoin's protocol has never been hacked in the sense of counterfeit coins or broken consensus rules. What gets "hacked" is everything around it: exchanges, individual devices, email accounts, phone numbers, and people. Your security perimeter is your keys, your devices, and your behavior, not the bitcoin network itself.
Nothing automatic. Without a plan, your bitcoin sits untouched until someone with the keys moves it, which may be never. With a plan (inventory, instructions, legal authority, and a trigger mechanism), your heirs recover it through the process you designed. See the inheritance guides.
Tell as few people as possible, and never amounts. Every person who knows is a potential leak: through gossip, social engineering targeting them, or coercion. Your estate attorney and executor need to know enough to do their jobs, ideally without knowing amounts until necessary.
It solves some problems (fire, burglary) and creates others (bank access hours, institutional risk, lack of privacy, potential legal compulsion). Many holders split the difference: one backup in a home safe, another in a geographically distant location under their own control. The full comparison is in Home Safe vs Bank Vault for Seed Storage.
The passphrase: an extra word added to your seed phrase that generates an entirely different wallet. It is the most misunderstood feature in bitcoin security, powerful as a second factor and dangerous because typos open empty wallets silently and forgotten passphrases are unrecoverable. See Hardware Wallet Passphrase Risks.
Generate it fresh from your own wallet software, and verify the full address on your hardware wallet's screen before sharing it. Never copy receive addresses from transaction history, where poisoning attacks plant lookalikes. See Verifying Receive Addresses Securely.
Treat it as a possible SIM swap until proven otherwise. From another line, call your carrier immediately, freeze the number, then rotate credentials on your most sensitive accounts, starting with email. The 30-minute response playbook is in SIM Swap Protection for Bitcoiners.
You can, but large holders usually should not. Separating funds across wallets (spending, savings, deep cold storage) limits the blast radius of any single compromise and lets you apply different security levels to different amounts. The savings wallet gets the full treatment: air-gapped device, metal backup, passphrase, multisig when appropriate.
Review the full setup annually: verify backups are where they should be, confirm firmware is current, rehearse recovery, and update the custody map for any changes. Test recovery on a spare device at least once before trusting the setup with the full amount, and again any time you change something structural.
A secondary wallet with a small, believable balance, kept ready to surrender under physical coercion. It gives an attacker something to take, which changes the encounter. It is prepared in advance and never discussed. See Duress Wallets and Plausible Deniability.
Not as an imminent threat, and not ahead of the risks that actually empty wallets today. Keep addresses un-reused as good practice (which also helps privacy), and let protocol-level migration happen if and when the threat becomes real. See Quantum Computing and Bitcoin.
It depends on your competence, your jurisdiction, and your governance needs. Custodians remove personal operational risk and add counterparty risk: hacks, insolvency, withdrawal freezes, compulsion. Self-custody reverses the trade. Institutions often end up hybrid: self-custody for the core with a custodian for operational balances. The decision framework is in Choosing a Bitcoin Custodian vs Self-Custody.
Carry the device, not the seed. Know the local legal environment before you fly: some jurisdictions can compel device unlocking at borders. Consider traveling with a clean device and restoring from backup at your destination for high-risk crossings. The full protocol is in Traveling With a Hardware Wallet Safely.
Acquisition dates, amounts, cost basis, and a log of every disposal (sale, trade, spend). Export wallet histories periodically; do not rely on being able to reconstruct years later. Heirs need these records as much as you do. See Inheritance Tax and Bitcoin Records. Confirm specifics with a tax professional in your jurisdiction.
That is exactly the design constraint. The inheritance plan must assume zero technical knowledge: one page naming everything, instructions written for stress, and a rehearsal where someone actually follows them. If your plan requires your heirs to understand multisig, it will fail. Simplify the recovery path, even if the storage itself is sophisticated. Multisig for storage, single clear path for recovery.
For most self-custody holders, available policies cover less than expected: typically the custodian's risk, not yours, with broad exclusions. Evaluate it as a supplement after the security baseline is solid, not as an alternative to it. See Bitcoin Insurance Options in 2026.
Treating security as a purchase instead of a practice. People buy the expensive hardware wallet and skip the boring parts: the tested backup, the written procedure, the inheritance plan, the annual review. Nearly every catastrophic loss story is a failure of process, not of products.
Today: read the single-sig vs multisig guide and decide your structure. This weekend: set up the hardware wallet correctly and create the metal backup. This month: write the recovery procedure and start the inheritance plan. Security compounds like interest: the unglamorous steps, done in order, beat the perfect setup planned but never built.
Address: A destination for bitcoin payments, derived from a public key. Reusing addresses harms privacy; generate a fresh one per receipt.
Air-gapped: A device with no wired or wireless connection to any other device. Transaction data moves via QR code or removable media.
Bearer instrument: An asset controlled by whoever holds it (or its keys), with no intermediary to appeal to. Bitcoin is a bearer instrument.
Custodian: A company that holds bitcoin keys on clients' behalf. Removes personal operational risk; adds counterparty risk.
Dead man's switch: An automated mechanism that triggers a process (such as notifying an executor) if the holder stops checking in.
Duress wallet: A secondary wallet with a small balance, prepared in advance to surrender under physical coercion.
Firmware: The software running on a hardware wallet. Updated to patch vulnerabilities; verified before installation.
Hardware wallet: A dedicated device that generates and stores private keys offline and signs transactions internally.
Inheritance plan: The combined inventory, instructions, legal documents, and trigger mechanisms that let heirs recover bitcoin.
Multisig: A wallet requiring multiple keys (a quorum, e.g. 2-of-3) to authorize transactions. Removes single points of failure.
Opsec (operational security): Everyday habits that reduce targeting risk: privacy, compartmentalization, and skepticism toward unsolicited contact.
Passphrase (25th word): An extra word combined with the seed phrase to generate a different wallet. A second factor with sharp edges.
Seed phrase: 12 or 24 words encoding the master secret of a wallet. Whoever has it controls the funds. Never stored digitally.
Shamir Secret Sharing: A method splitting a secret into shares, of which a subset (e.g. 2-of-3) reconstructs it. Used for geographic distribution.
SIM swap: An attack moving your phone number to an attacker's SIM to intercept calls and texts, including 2FA codes.
Single-sig: A wallet controlled by one key. Simple; a single point of failure.
Wrench attack: Physical coercion to force a holder to transfer bitcoin. Defended by privacy, duress wallets, and multisig across locations.
*General information only. Fortress Bitcoin publishes educational security guides, not legal, tax, or financial advice. Confirm important decisions with qualified professionals in your jurisdiction. Bitcoin security practices evolve; review your setup at least annually.*
Exchanges are convenient and sometimes necessary, but every large exchange hack, freeze, and bankruptcy follows the same lesson: bitcoin on an exchange is an IOU, not bitcoin. The exchange holds the keys, so the exchange holds the risk, and you hold their promise. For amounts that matter, the promise is not enough. Move holdings you do not intend to trade into self-custody.
Complexity is not security. Every added component is something to misconfigure, forget, or fail to explain to heirs. The most secure setup is the simplest one that eliminates your actual single points of failure. A clean single-sig with a passphrase, metal backups in two locations, and a written inheritance plan beats a baroque multisig that nobody in the family understands.
You might, for years. Memory is not storage, and the failure mode is total: a forgotten passphrase does not lock you out with an error message, it silently opens an empty wallet. If a passphrase exists only in your head, your bitcoin has a single point of failure with a biological expiration date. Back it up physically, separately from the seed.
Obscurity helps until it does not. Data breaches, chain analysis, social circles, and lifestyle signals leak information constantly. Design your security as if your holdings were public, then enjoy privacy as a bonus layer. The holders who survive targeted attacks are the ones whose setups did not depend on staying unknown.
Later is the most expensive word in bitcoin security. Incapacity does not schedule itself, and every month without a plan is a month your family could face both grief and an unrecoverable estate. A basic plan (inventory page, instructions, named executor) takes an afternoon. The perfect plan can wait. The basic one cannot.
Open-source firmware is auditable, which is valuable, but almost no holder personally audits it. What open source actually gives you is the ability for experts to check the vendor's work, and a community that notices problems. You still need to buy from the manufacturer, verify genuineness on setup, and verify update signatures. Trust the process, not the label.
It is not. Splitting a single seed's words across locations protects against loss of one location but creates a theft problem: anyone who collects enough pieces reconstructs the whole key. Multisig and Shamir sharing are designed so that partial holdings are useless alone. How you split matters as much as whether you split.
No consumer bitcoin insurance policy covers the failure modes that actually lose coins: lost seeds, forgotten passphrases, coerced transfers. Policies cover narrow, defined events, usually around custodians and physical theft of devices. Carelessness voids the premise. Security first, insurance as a possible supplement, never the plan.
Security spending without a threat model is superstition. Work through these questions honestly before buying anything or changing your setup. Your answers determine which guides matter most to you.
Write down the amount, in bitcoin and in your local currency, and what fraction of your net worth it represents. A setup appropriate for 2 percent of net worth is not appropriate for 60 percent. Be specific: vague anxiety produces vague defenses.
List them in three tiers. Tier one, opportunists: burglars, pickpockets, malware authors spraying the internet. Tier two, targeted criminals: phishers who know you hold bitcoin, SIM swappers, home invaders. Tier three, powerful actors: corrupt insiders, state-level compulsion, legal adversaries in disputes. Most holders over-invest against tier three fantasies and under-invest against tier one and two realities. The wrench attack and SIM swap guides exist because tier two is where the losses are.
Right now, today: what one event, person, or object, if removed or compromised, loses everything? One seed phrase in one drawer. One passphrase in one head. One laptop with everything on it. Name it in one sentence. Your next security project is eliminating exactly that.
Walk the inheritance path mentally, step by step, as your least technical heir. Where is the inventory? Can they find the backups? Do the instructions assume knowledge they do not have? Does anyone have legal authority? If any step requires you to be alive to explain it, the plan is incomplete.
When did you last restore a wallet from backup? If the answer is never, schedule it: a spare device, a small amount, the full process, no notes the second time. A recovery you have performed is a fact. A recovery you have imagined is a story.
Security decays. Firmware ages, backups migrate, heirs grow up, laws change, coordinators shut down. Put a recurring review on the calendar: annually at minimum, plus a review after any life event (move, marriage, divorce, birth, death, new device). The setup that is never reviewed is the setup that fails silently.
Work the worksheet, then follow the reading paths in order. The guides turn each answer into action.
Every guide on this site follows the same contract with the reader:
The library grows from reader questions and from real loss patterns, not from trends. If a guide does not change what you do, it has not done its job.
Follow the reading paths in order: basics, then people-threats, then time-threats, then institutional. The paths are sequenced so each step protects you while you work on the next. Jumping to advanced multisig before your backups are in metal is like installing a vault door on a tent.
Three things, in order of frequency: keeping the seed phrase digital (photo, cloud note), keeping the passphrase only in memory, and having no inheritance plan at all. Fix those three and you have eliminated the majority of real-world loss scenarios. Everything else on this site is refinement.
The executor needs the full picture. Other heirs need to know a plan exists and roughly what to expect, without necessarily knowing amounts or locations today. Full disclosure to everyone maximizes both comfort and attack surface; calibrate by trust and maturity, and revisit as circumstances change.
Ask three questions: Have you handled self-custodied bitcoin in an estate before? Can you explain the difference between legal authority and technical access? Will you review my actual recovery instructions, not just the will? If the answers are vague, keep looking, and use the estate lawyer briefing guide to bring a willing attorney up to speed.
Nothing, if you set things up correctly. Your bitcoin lives on the blockchain, not in the device; the device is just a key holder. With your seed phrase (and passphrase, if used), you restore on any compatible wallet from any vendor. This is why standards-based seeds and tested backups matter more than brand loyalty, and why coordinator redundancy is documented for multisig users.
No. A public address (or extended public key) lets someone see your balance and transactions, which is a privacy leak, not a theft vector. Theft requires private keys or seed material. But treat address exposure seriously anyway: visibility is what turns a holder into a target.
Bitcoin security rewards the holder who starts now over the holder who plans perfectly later. This afternoon: read the single-sig vs multisig guide and decide your structure. This weekend: set up the hardware wallet, stamp the seed into metal, and write the recovery procedure. This month: build the custody map, brief your estate attorney, and rehearse recovery with your heirs.
Every guide on Fortress Bitcoin is free, plain-language, and ordered so that each step protects you while you work on the next. Browse the full library, pick your reading path above, and begin with the step in front of you. Your future self, and your family, will be glad you did.
