Is Self-Custody Safe When You Hold Millions?

The short answer is yes. Self-custody can be safe at seven and eight figures, but only when it is engineered as a system rather than treated as a single device in a drawer. The protocol layer is not the weak point, because keys built on modern cryptography are not being brute-forced. The failures happen at the human and operational layers: a phrase written on paper, a signature approved without verification, one person who alone knows where the keys live.

For an investor holding a large balance, the question is not custodial versus self-custody in the abstract. It is whether your setup survives a targeted attacker, a house fire, a hardware failure, your own death, and a phishing attempt on the same day. Most personal setups cannot. A properly designed one can, and the difference comes down to design rather than budget.

For a review of your own position, our crypto risk management consulting work exists for that purpose.

What the 2025 Threat Data Actually Shows

Chainalysis reported that more than $3.4 billion in crypto was stolen during 2025, with the February 2025 Bybit exchange breach alone accounting for roughly $1.5 billion. That single incident stands as the largest crypto heist on record, and the FBI attributed it to North Korea's Lazarus Group.

Two details matter for anyone holding their own keys. The exchange was using multisig and was still drained, because attackers compromised the software supply chain of the signing interface rather than the keys. Reviewers on hardware wallets were blind-signing a fraudulent transaction that looked routine on screen. That was an operational failure, not a break in the cryptography, and the same failure works against individuals.

Chainalysis also recorded roughly 158,000 individual wallet compromise incidents across 2025, affecting about 80,000 unique victims and accounting for around $713 million. Personal wallet theft as a share of value stolen fell from 44% in 2024 to about 20% in 2025, which suggests better practices are working, though the raw victim count remains high. Most compromises trace back to credential handling, which is why seed phrase discipline remains the highest-value habit a holder can build.

The physical threat is rising fastest. CertiK counted 72 verified physical coercion incidents, commonly called wrench attacks, during 2025, with confirmed losses above $40.9 million and a sharp year-over-year increase. The January 2025 kidnapping of a Ledger co-founder, in which attackers severed a finger to force cooperation, changed how serious holders think about privacy. An attacker pointing a weapon at you does not care how strong your passphrase is.

The Four Custody Architectures

Each model trades control for complexity and recoverability differently, and the right choice depends on your balance and appetite for operational work.

Single Hardware Wallet

One hardware wallet protects one private key, usually backed by a twelve or twenty-four word seed phrase. It is simple, inexpensive, and a single point of failure: if the seed is found, phished, or extracted under coercion the funds are gone, and if it is lost with no backup they are equally gone.

Single-sig is defensible for spending wallets and smaller balances, and understanding the difference between hot and cold wallets helps you decide where a single device belongs. It is not appropriate as sole protection for a large long-term holding.

Multisignature

Multisig requires multiple independent keys to authorize any transaction, such as two-of-three or three-of-five. Each is a complete private key, typically on a separate hardware wallet in a separate location, and the signing policy is encoded on-chain, which makes it publicly auditable.

The strength is structural: no single compromised key, lost device, or coerced signature can move funds, so an attacker must defeat several keys across several locations. This is the workhorse architecture for large self-custody, though quality varies by chain. The cost is complexity, meaning several devices, several backups, and a descriptor that must itself be backed up.

Multi-Party Computation

MPC splits a private key into encrypted shares across parties or devices, which collaboratively produce a valid signature without the full key ever being reconstructed. It is fast, works across chains, and hides the signing structure from public view.

The tradeoffs are real. MPC depends on a vendor's protocol, which introduces provider dependency and less on-chain auditability than multisig, and there is no widely trusted way for an individual to set it up alone. It is common in institutional custody, much less so in personal setups.

Collaborative Custody

Collaborative custody is a multisig arrangement in which you hold most keys and a specialist provider holds one, commonly two-of-three. You move funds independently with your own two keys, and the provider's key helps you recover if you lose one. Casa, Unchained, and Nunchuk operate here.

Because it is built on open multisig standards, recovery does not depend on the provider surviving: you can rebuild from your own keys and the public descriptor even if the firm disappears. This suits investors who want multisig security without administering every key personally, and is often the most practical fit at scale.

The Concrete Threat Model at Seven and Eight Figures

The first cluster is digital deception. Phishing sites, fake applications, and malicious extensions harvest seed phrases or trick you into signing a transaction you did not intend. Address poisoning seeds your history with a lookalike address so you copy the wrong destination next time, and clipboard malware swaps a pasted address for the attacker's. All three exploit one weakness: you trust what your screen shows you.

The second cluster is compromise of the tools. Tampered firmware, malicious updates, and compromised signing interfaces took down Bybit, and supply-chain attacks are increasingly preferred against well-defended targets. Social engineering sits alongside it, with attackers impersonating support staff or trusted contacts.

The third cluster is physical and structural. The wrench attack defeats any protection living entirely in your head, and SIM swap attacks hijack the phone number anchoring account recovery. Single points of failure compound everything: one person holding all the knowledge, one location holding a device and its backup, one seed controlling the whole balance.

A strong architecture neutralizes most of these structurally. For a quick read on where your setup sits, our crypto security quiz is a reasonable diagnostic.

A Reference Security Architecture

Adapt the key count and geography to your circumstances, and rehearse the design before funding it fully.

Choosing a Quorum

A two-of-three or three-of-five multisig forms the base. Two-of-three gives loss tolerance, since any one key can fail without locking you out, and theft resistance, since any one key can be compromised without loss. Three-of-five raises both thresholds and suits larger balances. Use hardware wallets from more than one manufacturer so one vendor flaw cannot affect every key.

Distributing Keys Geographically

Never store a device and its backup in the same place. Spread keys across separate secure locations: a home safe, a bank safety deposit box, a second property. Separation defeats fire, flood, burglary, and the wrench attack at once, because no location grants enough keys to move anything. Our guide to safe crypto storage for high net worth investors and family offices covers choosing them.

Using Hardware Wallets Correctly

Keys should be generated and stored offline on dedicated hardware; if you are building this layer for the first time, start with the fundamentals of cold storage setup. Verify the receiving address on the device screen, not only on your computer, every time, and confirm firmware through official channels only. Never enter a seed phrase into any website or recovery tool, because a legitimate hardware wallet will never ask for it on a connected screen.

Adding a Passphrase

A BIP39 passphrase, sometimes called the twenty-fifth word, adds a secret supplied alongside the seed phrase, so even an attacker holding all your words cannot reach the funds. Use at least thirteen to fourteen random characters. The tradeoff is severe: a forgotten passphrase is unrecoverable, so it must be backed up as carefully as the seed and included in your succession plan. Passphrases pair best with multisig, where they add depth without becoming a new point of failure.

Backing Up on Durable Media

Record seed phrases on fireproof and waterproof metal plates rather than paper, and never digitally: no screenshots, no cloud notes, no email, no password manager holding the raw seed. Store multiple copies across separate locations, and back up the multisig descriptor too, since you need it to reconstruct the wallet even holding every key. Our cold storage book covers it.

Building Verification Habits

Most losses at the interface layer are preventable with ordinary discipline. Verify addresses character by character on the device, and send a small test transaction before any large one. Treat every unexpected message, urgent request, or unsolicited support contact as hostile until proven otherwise, and assume the screen can lie. The broader habits appear in our guide to cryptocurrency security.

Reducing Your Public Footprint

Do not advertise holdings, avoid linking your identity to large on-chain balances, and be deliberate about who knows what you hold. Operational privacy is a real control against targeted attacks.

Inheritance and Succession Planning

This is the most neglected risk at scale. The properties that make crypto seizure-resistant make it uninheritable by default, so if you alone can reach the keys, your death becomes a permanent loss to your family. The multisig structure is the primary tool: distribute keys so a spouse, adult child, or trustee reaches the threshold once you are gone, without any single party acting prematurely.

Keep seed phrases out of your will. In the United States, wills enter probate and become public record, so anyone could drain the wallet before your heirs are notified. Instead, hold a sealed package of instructions, device locations, and recovery steps with an estate attorney or in bank safekeeping, separated so no single document grants full control. Time-locked arrangements and collaborative custody providers both transfer access to heirs under defined conditions.

All of this belongs inside your estate and tax strategy, particularly given the federal estate tax exemption set at $15 million per person and $30 million for married couples under the July 2025 law, with a 40% rate above. Then test it: have a trusted party run a recovery drill on a small balance before the instructions are needed.

When to Combine Self-Custody With a Qualified Custodian

At scale, a blend of self-custody and third-party custody is frequently strongest.

Self-custody carries no insurance. If a balance is lost or stolen there is no recovery and no policy to claim against, though asset tracing can sometimes assist after a theft. Qualified custodians operate under regulatory oversight with segregated accounts and professional key management, and they carry crime insurance. Coverage runs into the hundreds of millions, with some offering cold-storage insurance up to $250 million per account and Lloyd's-backed policies reaching higher limits.

Under SEC rules, qualified custodians include banks, registered broker-dealers, and state-chartered trust companies. That layer provides something self-custody cannot replicate, so consider a split: a core position in a well-engineered self-custody multisig for sovereignty, and another portion with a qualified insured custodian for protection and continuity. The right ratio depends on your risk tolerance, jurisdiction, and estate structure.

The Mistakes That Cause Total Loss

Certain errors appear repeatedly in post-mortems, and nearly all are structural. The most common is storing an entire balance behind a single seed on a single device, or keeping that device and its backup in the same location. Typing a seed into a website or recovery tool is the fastest route to losing everything, and storing it in cloud notes, photos, or email achieves the same outcome more slowly. Approving transfers without verifying the address on the hardware screen causes an enormous share of preventable losses, and assuming multisig alone is enough while blind-signing what the interface displays is what happened at Bybit.

On the planning side, having no succession plan is common and putting keys into a will is worse, while a passphrase you have not backed up redundantly turns a security feature into a liability. Publicly linking your identity to a large balance invites the fastest-growing physical threats. Underneath all of these sits the deepest mistake: treating custody as a one-time setup rather than a system tested and reviewed as balances and threats change.

Conclusion

Self-custody is safe at seven and eight figures when designed as a resilient system, and dangerous when it is a single device protecting everything you own. The cryptography has never been the problem. The failures are human and operational: unverified signatures, single points of failure, physical coercion, and the absence of a succession plan. Multisig with independent keys, real geographic distribution, disciplined verification, durable backups, and a tested inheritance plan turn self-custody into a defensible position, and for many investors the strongest answer pairs that core with a qualified insured custodian.

The right design depends on your holdings, threat exposure, family situation, and jurisdiction. If you are securing a large balance, a structured review with specialists is a reasonable next step. CryptoConsultz helps investors design and stress-test custody architectures through our personal investor consulting engagements.

Frequently Asked Questions

Is self-custody safer than keeping crypto on an exchange?

For a large long-term holding, self-custody removes exchange counterparty risk, meaning the risk that the platform is hacked, freezes withdrawals, or fails outright, and the Bybit breach showed exchanges remain prime targets. The tradeoff is full responsibility for keys, backups, and succession. Poorly executed self-custody is more dangerous than a reputable insured custodian; well-executed self-custody is stronger.

How many keys should a multisig have for millions in crypto?

A two-of-three multisig is a sound base for most large holders, because it tolerates the loss of any one key while resisting the compromise of any one key. Larger balances and family arrangements often move to three-of-five. Use hardware wallets from more than one manufacturer and store keys in separate locations, since keys stored together give far less protection than the configuration suggests.

Does a passphrase protect me from a physical wrench attack?

Only partially. A passphrase protects against someone who finds your seed words alone, but offers nothing if an attacker forces you to cooperate in real time. Geographic key distribution through multisig is the stronger defense, because no location gives an attacker enough keys to move funds. Not being known as a large holder is also a meaningful control.

Can I insure a self-custodied crypto balance?

Retail insurance for self-custodied crypto is very limited and generally unavailable at scale. This is why many large holders place part of their balance with a qualified custodian carrying crime insurance while keeping a core position in self-custody, capturing both sovereignty and protection.

What happens to my crypto if I die without a plan?

Without a plan it is very likely lost permanently, because keys only you can access die with you. Build succession into the multisig structure so trusted parties can reach the threshold, store sealed instructions with an estate attorney or in bank safekeeping, never place seed phrases in a will, and test recovery on a small balance while you can still supervise it.

At what balance should I stop using a single hardware wallet?

There is no fixed threshold, but a single hardware wallet is hard to justify as sole protection once its loss would be materially damaging to your finances, a point most investors reach well below seven figures. Single-sig remains reasonable for spending funds; a large long-term holding warrants multisig or collaborative custody.