What does self-custody actually make you responsible for?

Self-custody is usually described as taking control. It is more accurate to describe it as taking a job — an unpaid operational role with no colleagues, no supervisor, no error-correction process and no insurance.

The seed is the asset

Modern wallets derive every key you will ever use from a single secret, usually recorded as 12 or 24 words. That recovery phrase is not a password to your wallet; it is your wallet. Anyone holding it holds everything derived from it, on every chain, forever. Any hardware you own is a convenience wrapped around that secret.

A hardware wallet keeps the key inside a device and signs transactions there, so the key never touches an internet-connected computer. That defends against one specific attack — malware extracting the key — and against nothing else. It does not stop you signing a transaction that does something other than what you believed. It does not stop you sending to the wrong address. It does not restore a destroyed backup.

Two failure directions that fight each other

Every self-custody control moves risk along one axis at the expense of the other.

• Loss — you cannot sign. Destroyed backup, forgotten passphrase, an unrecorded derivation path, a death in the family.
• Theft — someone else can sign. Photographed seed, cloud backup, compromised device, coercion, a pre-initialised device bought from a marketplace seller who already knows the words.

Write the seed down in five places and you have nearly eliminated loss while multiplying theft surface fivefold. Memorise it and tell nobody and you have done the reverse. There is no configuration that minimises both, which is why serious setups stop trying and use quorums instead — the subject of the next lesson.

The arithmetic of backups, and the mistake in it

Suppose one backup copy has a 2% chance of being unavailable at the moment you need it. Three independent copies fail together with probability 0.02³ — about 8 in a million. That is the case for redundancy, and it is why people make three copies.

Now put all three copies in the same house. A fire, a flood, a burglary or a house move takes them as one event, so the effective failure rate collapses back toward 2% — a 2,500-fold difference produced entirely by an assumption nobody wrote down. This is the same correlation error that ruins diversified portfolios in a crisis, appearing in a safe-deposit box instead of a correlation matrix. Redundancy is worth what its independence is worth.

The failure modes that are actually common

Dramatic thefts get the coverage; mundane errors do most of the damage.

• Address substitution. Clipboard malware swaps the destination as you paste. Address poisoning seeds your transaction history with a lookalike address so you copy it from your own records later.
• Blind signing. Approving a transaction you cannot read on a device that shows a hash rather than an intent. The single most common route to a drained wallet in DeFi is granting an unlimited spending allowance to a contract that later turns out to be hostile or upgradeable.
• Untested backups. A backup that has never been restored is a hypothesis. Word 13 was written illegibly; the passphrase was never recorded; the derivation path was non-standard. All discovered at the worst possible time.
• Coercion. Publicly known holdings plus a physical address is a risk no cryptography addresses.

Try it now

1. Run a recovery drill. On a wiped device or an empty wallet, restore from your written backup and confirm the addresses match. An untested backup is not a backup — it is a belief about a backup.
2. List every copy of your seed and mark which copies share a single failure event: same building, same safe, same person, same cloud account. Count how many independent copies you actually have.
3. On a block explorer's token-approval view, check the open spending allowances for an address you control. Note any unlimited approvals still granted to contracts you no longer use.