LOG-011 ·
Self-Custody Is a Skill, Not a Purchase
Buying a hardware wallet makes you self-sovereign the way buying running shoes makes you a runner. I drill quarterly, and I publish my drill times.
- Words
- 686
- Est. read
- 3.0 min
- Confidence
- 0.94
- Topics
- self-custody, security, practice
The self-custody industry sells devices, and devices are the least important part. A hardware signer is a $70 solution to the easy problem (keeping a key offline) bolted onto the hard problem, which is operational: can you, under stress, without the vendor, recover access to your own money? That is not a product feature. That is a skill, and skills decay measurably unless drilled.
I hold a deliberately modest amount of self-custodied bitcoin, sized by the rule from my household audit: some fraction of money should require no one's permission to move. Today's entry is about the practice regimen around it, because the regimen is the custody. Everything else is shopping.
The failure data that shaped the regimen
Chainalysis has estimated that millions of bitcoin, plausibly 17 to 23 percent of the supply, are lost. Not stolen: lost. Keys discarded, passphrases forgotten, heirs uninformed. Read the forum postmortems, as I have (a file of 40+ cases, categorized), and the striking pattern is that hardware failure is almost never the cause. The causes are human, and they cluster:
| Failure mode | Share of my case file |
|---|---|
| Backup never made or never tested | 38% |
| Passphrase forgotten | 23% |
| Backup lost to fire, flood, move, tidy spouse | 15% |
| Inheritance failure (holder died, family locked out) | 13% |
| Scam or coerced disclosure | 8% |
| Device failure with no backup | 3% |
Every dollar in that table was guarded by cryptography that worked perfectly. The vault held; the operator failed. So the regimen targets the operator.
The quarterly drill
Once per quarter, on a calendar reminder, I run a full recovery drill: restore access from backup materials alone, onto a spare device, as if the primary had been destroyed. No peeking at the primary. Timed, logged, graded.
My last eight drills, median time to a verified restored wallet: 22 minutes. Worst: 41 minutes (2025 Q1, when I discovered one word in a backup was ambiguous in my own handwriting; a laminated reprint fixed what could have someday been a five-figure penmanship error). That drill alone justified the entire practice. A flaw in a backup is free to find during a drill and catastrophic to find during a recovery.
The drill also has a written family component. My wife, who does not care about any of this and should not have to, can follow a sealed instruction document from step one to recovered funds. Tested annually with her actually doing it: 55 minutes, one clarification needed, document revised. Inheritance failure is 13% of my case file and 0% of my plan.
The three rules that do the work
Rule one: the backup is the asset. The device is a convenience. Steel backup plates, two locations, checked on a schedule. Paper burns at 233 °C; house fires run 600 to 1,100 °C. This is a measurable, solvable problem and most people solve it with a sticky note.
Rule two: complexity is a risk, not a flex. Multisig, passphrases, exotic schemes: each layer subtracts vendor risk and adds operator risk, and operator risk is the dominant term in the table above. My setup is simpler than what the enthusiasts recommend, on purpose. I sized the complexity to what the family drill can pass, not to what impresses a forum.
Rule three: never hold more than your regimen can carry. The correct amount of self-custody scales with demonstrated operational competence. Mine is logged. If I skip two consecutive drills, my own written policy requires moving funds back toward custodial arrangements. Sovereignty without maintenance is just risk with better branding.
The general principle
This entry is filed under money but it is not about money. Self-hosted email, backups, servers, solar: every sovereign system is a skill wearing a product costume, and the industry around each will always sell you the costume. The recurring discovery of this log is that autonomy is purchased in drills, not in devices.
Confidence in the central claim, that untested custody fails at the operator and not the cryptography: 0.94, and my case file keeps rounding it upward. Buy the device if you like. Then put the drill on the calendar, because the calendar is the product.