Self-custody checklist

This checklist only applies to significant amounts of money that would make you sad if lost. As the quantity increases, so does the need for higher security.

Checkpoint 1. Reliable BIP39 mnemonic

Correctly generated, making sure it’s actually random without trusting any software. CC was not the first wallet to generate weak entropy seed phrases and it won’t be the last. 

Just don’t take the risk. 

A simple and trust less method IMO is printing the word list, cutting it into pieces of paper and blindly pulling out 23 random words. Use offline HW to find the 24th word which cannot be calculated manually. This way you pick 23 words yourself and rely on a third party to generate the checksum only.

For the ultra paranoid: mix different entropy sources using SeedXOR logic offline HW (test the SeedXOR logic first). 

Finally, 12 words are supposed to be ok, but I would stick to 24 words for higher security.

If you hold funds on addresses that don’t comply with this first checkpoint you should generate another seed phrase and move funds diligently.

Checkpoint 2. Keep the secret offline

The BIP39 world list (AKA seed phrase/ mnemonic) has never been stored/exposed to an online device. No phone pictures, no phone SeedQR scan, no digital text files, never used in a hot wallet, and you know that other persons cannot have had access to it. 

Of course, never type into any website and never share it with anyone.

Notice that a seed phrase previously used on a hot wallet will not become safer for being loaded into a cold/HW wallet, because the secret has already been exposed. 

If you hold funds on addresses derived from a mnemonic that has or may have been exposed to the internet or any other person, you definitively should generate another one and move funds diligently.

Check point 3. Redundancy

If you lose the seed phrase you probably lose access to your funds, so you should store redundant physical copies of it in different locations. Preferably on fire & water resistant material.

Or use a recovery scheme “2 out of 3”, see next point. 

Check point 4. Physical compromise

What if someone else finds a copy and knows how to use it? Or he/she takes a picture with their phone? Having redundant copies to meet checkpoint 3 seems incompatible with keeping your seeds secret, but there are a number of possibilities to deal with this dichotomy:

• Passphrase. An additional security layer. Mnemonic and passphrase are combined by the HW wallet to generate different private keys and addresses. Attackers need both to access funds. But if you lose one of them you lose access to your funds, this is a “2 out of 2” scheme. Store them separately and redundantly. It is safer than single-sig, but it is easier to lose access to your funds.

• SeedXOR recovery scheme “2 out of 3”. Lets call S the seed where the funds are. Generate other 2 random valid BIP39 seeds: A and B. Then XOR S with A and with B to generate C. Now S can be recovered XORing A with B with C. So you store A,B on one location; A,C on another and B, C on a third place. Effectively creating a “2 out of 3” scheme where finding one location provides no information about S. There are several HW wallets that allow SeedXOR logic.

• SSS “k out of n”. This is called Shamir Secret Sharing encoding. It's a technique to store/transmit information redundantly where you need at least ‘k’ parts or “shares” out of n to restore the original information. k-1 or fewer shares provide no information about the original secret. For example 3 out of 5, 4 out of 8, etc. In order to merge shares you must know what is the value of ‘k’ and each share id (share 1, share 2, etc)

  • Trezor implements Shamir with SLIP39, which is a standard they created unilaterally. It uses a different word list than the BIP39 standard, because the id of each share and the ‘k’ is stored along the SLIP39 word list. The problem: very few manufacturers have adhered to SLIP39. An SLIP39 mnemonic cannot be translated into BIP39 as far as I know.

  • Seedmate implements Shamir over BIP39 seeds, and the user has to write the share id and k next to each share. Shares are BIP39 seeds of the same size. You could leave some decoy funds on the shares. When merging, the result is the original BIP39 mnemonic. The problem: you need a Seedmate to merge shares, or use the HTML backup tool strictly offline. 

• Use invisible ink. Sometimes simpler is better. 

• Keep copies well hidden.

• Obfuscation. You may choose to make reversible transformations to your BIP39 seed ‘S’, to generate another valid BIP39 seed ‘X’ so if someone has physical access to X he/she would not have access to your funds unless he/she guesses correctly the transformation needed to go back to S. You could leave some decoy funds on seed X. An obfuscation example is to increase each word by N units. 

• BTC only: multi-sig & multi-vendor, it is a security mechanism for Bitcoin wallets that requires more than one key to authorize and send a transaction. Users generally setup a “2 out of 3” scheme (it could be 3-5, 5-9 or any other), using 3 different HW wallet manufacturers. Example: Bitbox, Trezor and Jade. Additionally the user needs to keep a descriptor file that holds setup details. Losing this file leads to loss of funds. Multisig is the final boss of self-custody.

All these options increase security at the expense of increased complexity. They can be combined in several ways, like multi sig with passphrases and mnemonics hidden with invisible ink. It is a trade-off, you have to find the right spot for you.

I did not mention custodial services because that is no self-custody. There are mixed approaches where a third party holds one of the keys of a multi-sig scheme.  

Check point 5. Test it.

Whatever the scheme you choose, test it thoroughly before moving significant amounts of money. Clear every HW wallet and build it from scratch again from every option, test every k-n combination. Generate receiving addresses, send small transactions, check you can spend it. Then you can move the bulk of the money.

At least twice a year check your backups and practice restoring the scheme.

Check point 6. Write down the treasury map

Prepare instructions for your family to recover funds if something happens to you, and to make sure you don’t forget. The place to store this document may be on you WILL, where only you are allowed to access. This is because... can you trust your wife?

Do not put the seed phrases along with the “treasury map”, the treasury map contains the location of the seeds and instructions to rebuild the self custody scheme.

Check point 7. Privacy 

Avoid KYC exchanges, learn how to use P2P networks. 

Use anonymous payment methods and anonymous physical delivery when buying HW wallets and other related products.

You don’t want to be on those companies' databases as a BTC/crypto holder, as these will eventually be leaked/hacked, and bad actors may physically attack you at home.

Unfortunately, self custody is a complex puzzle that requires a lot of work and study. It is not for everyone and it is one of the reasons mass adoption will not be easy.

As you can see, most of the self custody good practices are not necessarily done by a hardware wallet. It's all about keeping a secret safe, not losing it, not exposing it.