Self-Custody Is Not One Problem. It's Seven. Meet the SeReCoLiPrInGo.

It Was Never Just a Hardware Wallet

Ask anyone how to "do self-custody right" and you'll get the same answer: buy a hardware wallet, write down the seed phrase, maybe add a passphrase if you're feeling careful. Expand that to three devices in a 2-of-3 multisig when the money gets serious. Done.

Except it isn't done. That answer solves exactly one problem — keeping a private key away from remote hackers — and self-custody is not one problem. It's seven.

A hardware wallet is a great answer to "can someone hack this from across the internet." It is a bad answer to "can my spouse get to this if I'm hit by a bus", "can I be forced to hand it over at 2am", or "will an heir be able to prove where this came from in twenty years". Different questions, different failure modes. One box on a desk does not answer all of them — and treating it like it does is how careful, ordinary people lose everything. Not to hackers or thieves. But to a fire, a forgotten passphrase, or an heir who has no idea where to even start.

The Seven Domains — SeReCoLiPrInGo

There's a name for the seven questions a Bitcoin setup actually has to answer: SeReCoLiPrInGo — Security, Resilience, Coercion, Liquidity, Privacy, Inheritance, Governance. Clumsy to say out loud, easy to remember, and once you see all seven side by side, most setups you've heard of turn out to be designed for two or three of them, at most.

Security

If someone gets hold of some of your material, can they still spend?

Most people only picture one attacker: a hacker on the other side of the internet. A hardware wallet handles that one well — the key never touches a connected device. But Security also has to survive a stranger who already knows you hold Bitcoin and has a few hours alone with you, or a legal order that only has to reach one jurisdiction. Same word, different attacker, different answer required.

Resilience

Can you actually recover after a device dies, a file corrupts, or years pass without anyone touching the setup?

Ask it this way instead: if nobody touched this setup for five years, would the exact same keys and paperwork still open it? Software gets discontinued, hardware gets bricked, and "I'll remember the derivation path" quietly becomes the real point of failure — not theft. And, perhaps the most understated failure mode of all: do you actually remember the strong passphrase you chose — right now, without looking anything up?

Coercion

Can someone force a spend out of you right now, under pressure?

This is the wrench attack: no clever cryptography required, just someone standing over you demanding access. If you can open the whole thing yourself in ten minutes, so can anyone who convinces or forces you to. Real resistance usually means giving up some control on purpose — a delay, a decoy balance, a key you genuinely don't hold day-to-day. Don't put too much faith in plausible deniability alone, though: an attacker running a coercion play often knows more than you'd expect, and once they suspect they're competing with you for a hidden "prize" instead of just collecting what you handed over, the encounter tends to escalate, not calm down.

Liquidity

Can you actually spend when life requires it, without giving up and taking a shortcut that undoes everything else?

A vault that takes three days and two phone calls to open is a great vault and a terrible way to pay a plumber who's standing in your kitchen. Friction is a feature on money that's built to sit for years — and the reason people quietly abandon good security the moment that same friction lands on money they actually need to move.

Privacy

Can an outside observer tell you're a holder, size your stash, or trace what you do with it?

This splits in two: does anyone know you hold Bitcoin at all — an exchange's KYC record, a loose comment at dinner — and can anyone watching the blockchain tell your wallets apart from anyone else's. A 2-of-3 multisig address, for what it's worth, announces itself on-chain to anyone who bothers to look.

Inheritance

Can someone who isn't you carry this forward if you die or lose capacity, without inventing a process from scratch?

This is really succession — incapacity counts just as much as death, and it's arguably the harder case, since there's no death certificate to trigger anything. The real test isn't "did I write it down?" — it's "can someone who's never seen this before, panicking or grieving, actually follow what I wrote?"

Governance

Who's actually accountable for the whole thing: who can change it, who runs it if something happens, and can it survive contact with taxes, regulators, and courts — not just Bitcoin's own rules?

Most individual readers can skim this one for now — it matters most once real money, multiple decision-makers, or professionals are involved. Who's allowed to update the setup years from now? Who actually runs the process when something happens, instead of just holding documentation nobody's ever tested? We'll come back to this one at the end — it's the domain hardware-wallet advice never even pretends to answer.

They Compete

A setup that optimizes hard for Coercion resistance usually gives up Liquidity — the same friction that stops a mugger from forcing a spend also slows you down when you need to move fast. Optimize for Inheritance and Privacy usually leaks — an heir who can find the funds is, by definition, someone else who knows where to look. There is no setup that maxes out all seven at once. There is only the setup that trades the right ones away, on purpose.

The "My Bitcoin" Fallacy

The most common design trap in self-custody is believing "my bitcoin" has to be one thing, held one way, under one setup.

Try to build a single architecture that scores well on all seven domains at once, and you run into many traps. Three of the most common ones are:

The Security Trap. You want $10,000 of spending money safe from a mugging, so you put it behind a 3-of-5 multisig with geographically distributed keys and timelocks. Technically secure. Also useless — the setup is now too cumbersome to actually spend from, and Liquidity is gone.

The Coercion Trap. You want your entire life savings safe from a wrench attack, so the whole stack sits behind delayed spending paths and plausible-deniability tricks. That works, right up until you need to move money fast for a real emergency — and the same delay that protects you from an attacker is now stopping you too.

The Inheritance Trap. You want your heirs to access everything smoothly when you die, so you simplify the access path for the entire pool. Now 100% of your wealth is one simple path away from anyone who finds it — for as long as you're still alive to lose it.

One policy, applied to an entire stack, is always either too rigid for real life or too loose for a real threat. There's no fixing that with a smarter single setup. The fix is not building one setup at all.

Split It Instead

Bitcoin doesn't have to be one pile. Most people who get this right end up with something like three piles instead:

Cold — the vault. The bulk of it. Rarely touched, built to survive decades, custodians, disasters, and death. No single point of failure, strong backup, timelocks (on-chain or off-chain), sometimes a trust or a family office in the loop. Slow to spend from, on purpose.

Warm — the reserve. A working buffer. Rebalancing, big purchases, restocking the hot wallet. A single hardware wallet with a passphrase, or a simple 2-of-3, kept somewhere reachable in an afternoon, not a flight.

Hot — the spending layer. Pocket money. Small enough that losing it to a mugging or a bad click barely registers. A mobile Lightning wallet, an eCash mint, whatever's fastest.

None of these is "the" setup. They're pieces of one. The vault doesn't need to be liquid — that's the reserve's job. The reserve doesn't need to survive a wrench attack in ten minutes — that's what the vault behind it is for. Split by purpose, and each piece can actually be good at the two or three domains it's meant for, instead of mediocre at all seven.

Two Different Questions Hiding Inside "Multisig"

Here's a mix-up that quietly wrecks more setups than hackers do: treating "who can spend this" and "will this survive" as the same question.

Authorization is who can spend, and under what rule — one key, two-of-three keys, whatever you chose. Bitcoin's network enforces this automatically, forever, whether or not you ever write anything down.

Backup is whether the material behind that rule will still exist, and still be usable, in ten years, by you or by whoever comes after you. Bitcoin's network has zero opinion on this. It's entirely on you — paper, metal, a Shamir-style split across people you trust, whatever you chose.

For years, a huge amount of Bitcoin content has run the same script — scare you with a single-seed catastrophe (a house fire, a flood, a burglary while you're not home), then hand you multisig as the complete, sovereign fix. Multisig is a genuinely excellent answer to one question: who can spend. Say that enough times, attached to enough fear, and "multisig solves this" starts feeling like settled fact instead of an answer to one question out of seven. If that sounds familiar, you didn't imagine it, and you weren't wrong to believe it — it's just incomplete, and the rest of this article is what got left out.

Multisig answers the first question. It does not automatically answer the second — and the most common real-world multisig failure isn't a stolen key, it's an heir with two of three seed phrases and no idea what script type, derivation path, or coordinator software the original wallet used. The keys survived. The "descriptor" didn't. Both need a backup plan. Usually only the first gets one.

It Was Never Just a Hardware Wallet, Part Two

Back to where we started: "buy a hardware wallet" was never wrong, exactly. It's an answer to one domain, dressed up as an answer to all seven. The other six don't go away just because nobody mentioned them.

This is where Governance actually shows up for most people who need it — not as paperwork for its own sake, but as the answer to "who is actually running this, and will it hold up outside of Bitcoin's own rules". A few examples that rarely make it into hardware-wallet marketing:

Someone has to be allowed to change the setup — swap a custodian, update a threshold, move money between tiers — and that someone needs to be named, not assumed. Someone has to actually run a succession event when it happens, not just hope the paperwork explains itself to a grieving spouse. And someone has to think about the version of this that regulators and tax authorities see, not just the version the blockchain sees.

That last one is the one almost nobody plans for: fully private, no-KYC Bitcoin can feel like the responsible, sovereign choice today — and it can turn into a real problem twenty years from now, when an heir needs to prove where the money came from to an exchange, a tax office, or a court, and there's no trail to show. Privacy and Governance pull in opposite directions here, and pretending they don't is itself a decision, whether anyone meant to make it or not.

None of this means everyone needs a trust, a lawyer, and a family office. It means multisig was never going to be the whole answer, for the same reason a hardware wallet wasn't — it answers one or two domains well, and the other five are still sitting there, unanswered, whether anyone looked at them or not. For most people, that gap closes with a notebook and an honest conversation with a spouse. For people managing real, multi-generational wealth, it closes with the kind of professional help the Governance domain exists to describe.

What We're Building Next

Seven domains and three tiers is the map. What we want to build next is a way to actually use it: a radar chart with seven axes, one shape per pile you hold — hot, warm, cold, or anything else — overlaid on top of each other, so you can see at a glance where your whole stack is strong, and where it's quietly leaning on the same two or three domains everywhere.

We're still working out how to ask the right questions to generate that shape honestly, without pretending something this human reduces cleanly to a score. If you've got opinions — especially if you've tried grading your own setup and found the existing quizzes too shallow — we'd rather build this with input than ship it and hope. (More on how to get involved soon.)

TL;DR

• Self-custody isn't one problem. It's seven: Security, Resilience, Coercion, Liquidity, Privacy, Inheritance, Governance — SeReCoLiPrInGo.
• No setup maxes out all seven at once. Every setup trades some away, on purpose or by accident.
• Don't build one setup for everything. Split into piles by purpose: cold (the vault, rarely touched), warm (a working reserve), hot (spending money).
• Multisig answers "who can spend," not "will this survive." Both need their own backup plan — the most common real-world multisig failure is a lost descriptor, not a stolen key.
• Governance — who's actually accountable for the whole thing, years from now — matters most once real money, multiple people, or professionals are involved.
• We're building a way to score your own stack against all seven at a glance. Coming soon.