Not Your Keys, Not Your Coins: The Real Way to Store Crypto

Almost everyone who holds crypto is one mistake away from losing all of it. Not to a market crash, to a lost key, a signed approval, or a company that was never holding the coins it claimed. Here is how custody actually works, what the tradeoffs really are, and where the Ledger story fits in.

Key facts

• A wallet does not store coins. It stores the private key that controls them. Whoever holds the key (or its seed phrase backup) holds the funds.
• Hot wallets are the main theft surface. Wallet drainers and Web3 phishing stole about $494 million in 2024, up 67 percent year on year, mostly through malicious signatures, not stolen keys.
• Hardware wallets move the risk, they do not remove it. Ledger's 2020 marketing breach exposed roughly 1 million emails, and Ledger's own lab showed an unpatchable seed-extraction attack on Trezor devices that lack a secure element.
• Ledger Recover (launched October 2023) shards your seed and sends encrypted fragments to three custodians over the internet. It is optional, but it exposed a deeper truth: with closed firmware, you trust the maker, not just the chip.
• For serious sums, multisig and collaborative custody (Casa, Unchained, around $250 per year) plus steel backups remove single points of failure. The cost is complexity: more security means more ways to lock yourself out.

There is one sentence that decides whether you keep your crypto: a wallet does not hold your coins, it holds the key to them. The coins live on the blockchain. Your wallet holds the private key, a long secret number that proves you have the right to move them. Control the key, control the money. Lose the key, lose the money. Let someone else hold the key, and you are trusting them, not the code.

That private key is almost never written down directly. Instead, most wallets show you a seed phrase, usually 12 or 24 ordinary words (the BIP39 standard). Those words are a human-readable backup of the key. Anyone who reads them can rebuild your wallet on any device, anywhere, with no password and no permission. This is the whole game. Everything below is about who can reach that secret, and how hard you make it for them.

The five ways crypto actually disappears

Self-custody has a clear threat model. Money is lost in five ways, and a good setup defends against all five at once, which is exactly why it is hard.

Remote theft. Malware, phishing, fake apps, and wallet drainers that trick you into signing a transaction that hands over your tokens. This is the most common loss for active users.

Physical theft and coercion. Someone finds your seed phrase in a drawer, or forces you to unlock the wallet. Security researchers call the second one the "$5 wrench attack": all the cryptography in the world does not help if someone with a wrench is standing over you.

Loss. A dead drive, a thrown-away backup, a forgotten password, a seed phrase no one can find. No support line can reset this. Lost keys are one of the largest sources of permanently gone Bitcoin.

Custodial failure. You never held the keys at all. The exchange did, and the exchange failed.

Death. The keys die with you, or they are so well hidden that your family never finds them. Inheritance is the part almost everyone ignores until it is too late.

Not your keys, not your coins

The phrase sounds like a slogan. It is a description of two of the largest losses in the history of the asset class.

Mt. Gox, the dominant Bitcoin exchange of its era, handled over 70 percent of all Bitcoin trading volume at its peak. It filed for bankruptcy protection in Tokyo on 28 February 2014 after losing more than 850,000 BTC, roughly 750,000 of them belonging to customers and about 100,000 its own, around 7 percent of all Bitcoin in existence and worth near $473 million at the time. Later analysis concluded the coins had been drained from its hot wallet gradually, starting as early as 2011, while customers saw normal balances on their screens.

FTX was the modern repeat. FTX, FTX US, Alameda Research, and more than 130 affiliated entities filed for Chapter 11 in Delaware on 11 November 2022. FTX had lent more than half of customer funds to its own trading firm, Alameda, something its own terms of service explicitly forbade ("None of the Digital Assets in your Account are the property of, or shall or may be loaned to, FTX Trading"), and used a software backdoor to hide it. Its founder later told investors the company needed about $8 billion to cover user assets. Between $1 and $2 billion in customer funds could not be accounted for in the days after the collapse.

Both cases share one structural fact: the customers had account balances, not coins. The exchange held the keys. When the exchange failed, the keys, and the money, were gone. Self-custody exists to remove that single point of failure. It also hands you the entire burden of not failing yourself.

Hot wallets: convenience, and the drainer economy

A hot wallet is software on an internet-connected device: a browser extension like MetaMask or Phantom, or a mobile app. The private key lives on that device. This is what makes hot wallets fast and useful for daily spending and for interacting with DeFi, and it is also exactly what makes them the soft target. If the key is on a device that talks to the internet, anything that compromises the device or fools the user can reach the key.

The modern attack rarely steals the key directly. It steals a signature. According to ScamSniffer's 2024 report, wallet drainers and Web3 phishing took about $494 million from roughly 332,000 addresses that year, up 67 percent on 2023. Most of it came not from cracked keys but from victims approving malicious transactions: about 56.7 percent through "Permit" signatures (an off-chain token approval under the EIP-2612 standard) and 31.9 percent through "setOwner" operations that hand control of a contract to the attacker. You did not get hacked. You clicked "approve."

This is an industry now. "Drainer as a service" kits rent the malware to affiliates for a cut. Inferno Drainer, active from late 2022, stole at least $80 million from more than 130,000 victims, taking a 20 percent cut and passing 80 percent to its affiliate customers, before exiting and later handing its platform to another crew. Treat a hot wallet the way you treat the cash in your physical wallet: enough for the day, never your savings.

Cold wallets: what hardware really protects

A cold wallet keeps the private key on a device that never exposes it to the internet. A hardware wallet (Ledger, Trezor, Coldcard, Keystone, BitBox) signs transactions internally and sends out only the signed result, so the key itself, in theory, never leaves. This defeats the entire category of remote theft that drains hot wallets. It does not defeat physical attacks, supply-chain tampering, or the user being tricked into signing something bad on a real site.

Two design debates matter. The first is the secure element versus the open microcontroller. A secure element is a tamper-resistant chip built to resist physical extraction, the same kind used in passports and bank cards. Devices without one are easier to audit (open source) but, it turns out, easier to physically break. Ledger's own security lab, Donjon, demonstrated a fault-injection attack that extracts the seed from Trezor One, Trezor T, and KeepKey in minutes with about $100 of equipment, an attack rooted in those devices having no secure element and which, in their words, "cannot be patched." The seed comes out encrypted, so an attacker still has to brute-force the PIN, and a strong passphrase fully defeats it. Note the source: Donjon is owned by a direct competitor. The findings were independently reproduced and acknowledged by Trezor's maker, but read them with that in mind.

The second debate is the connection: USB or Bluetooth (convenient) versus air-gapped signing by QR code or microSD card (no wired link to a possibly compromised computer at all). For large balances, air-gapped is the stricter choice.

Hardware is not a magic shield, and the maker is part of your threat model. In July 2020, Ledger disclosed that an attacker had reached its e-commerce and marketing database through an exposed API key and taken roughly 1 million email addresses, with name, postal address, and phone number for about 9,500 customers. No coins or devices were touched, but the leak handed criminals a list of confirmed crypto owners with home addresses, and a wave of phishing and physical threats followed. The lesson: buying a hardware wallet ties your real-world identity to the fact that you hold crypto, and that data has to be protected too.

The Ledger Recover question

In May 2023, Ledger announced a feature called Ledger Recover, and set off the most revealing trust debate the hardware-wallet world has had. Understanding why is worth more than any product review.

Here is what it does. Ledger Recover (an optional paid subscription, $9.99 per month, launched 24 October 2023) backs up your seed by encrypting it inside the Secure Element, splitting it into three fragments using Shamir's Secret Sharing, and sending each encrypted fragment to a different custodian: Ledger, Coincover, and EscrowTech. No single custodian holds the whole seed. To recover, you verify your identity with an ID and a selfie through a provider called Onfido, and any two of the three custodians return their fragments to rebuild the key on a device.

On paper, it is a reasonable answer to the "I lost my seed phrase" problem that loses people their coins forever. The uproar was not really about the feature. It was about what the feature proved.

For years, Ledger's marketing told users their keys "never leave the Secure Element." Recover required the seed (in encrypted shards) to leave the device and travel over the internet. In the storm that followed, an official Ledger account posted, then deleted, a now-infamous admission: that it is, and always had been, technically possible to write firmware that facilitates key extraction. That single sentence reframed everything. If a firmware update can be written to export the seed, then the security of every Ledger ultimately rests on trusting Ledger's firmware, which is closed source and cannot be independently inspected. As the security researcher Laurence Day put it, "Ledger's code is closed source, so nobody can review what the update is actually doing." Trezor's Pavol Rusnak was blunter: "For a hardware wallet to transmit the seed or shares that can reconstruct the seed over the internet fundamentally alters the security threat model."

There was a second concern. Because Recover ties encrypted shards to a verified identity held by custodians, those shards become something a government could, in principle, subpoena. Ledger's leadership acknowledged it would comply with valid legal requests, which for a certain kind of holder defeats the entire point of self-custody.

Ledger paused the rollout under public pressure, its CEO committed to open-sourcing more of the operating system over time, and its CTO defended the underlying tradeoff as acceptable for mainstream users who value recoverability over maximalist purity. Both can be true. The honest takeaway is not "Ledger is unsafe." It is narrower and more useful: a closed-firmware hardware wallet asks you to trust the company, not only the silicon. If your threat model includes the company itself, or a future firmware update, that is the line that matters, and it is why the most cautious holders prefer fully open-source, air-gapped devices and never enable cloud recovery of any kind.

Maximum security: the tools, and the trap

Above a single hardware wallet sits a set of techniques that serious holders combine. Each adds protection. Each also adds a new way to lose access. That tension is the whole subject.

The passphrase (the "25th word"). A BIP39 passphrase is an extra secret added on top of your seed words. It creates a separate hidden wallet and defeats anyone who finds only your 24 words, including the Trezor extraction attack above. The catch: to match the security of a 24-word seed, that passphrase would need to be around 37 random characters, and if you forget it, the funds are unrecoverable. There is no reset.

Multisignature. A multisig wallet requires several keys to approve a transaction, for example two of three (2-of-3) or three of five (3-of-5). No single device, location, or person can move funds alone, which kills the single point of failure that defines a normal wallet. On Ethereum, Safe (formerly Gnosis Safe) is the standard smart-contract multisig. The cost is operational complexity, which is its own risk.

Sharded backups. SLIP39, created by Trezor's maker, splits one backup into multiple shares with a threshold, say three of five, where no single share reveals anything about the secret and only the threshold number combined can rebuild it. It is the same math Ledger Recover uses, except you hold all the shares, with no custodian and no internet.

Steel, not paper. A seed written on paper burns, soaks, and fades. Stamped or engraved on a steel plate, it survives house fires and floods. For any backup you intend to keep for years, metal is the baseline, and the shares should sit in more than one physical location so a single fire or burglary cannot take all of them.

The trap is obvious once you see it: every layer you add to stop a thief also adds a door you can lock yourself out of. The right amount of security is the most you can operate reliably for a decade, not the most that exists.

When you bring in help

Between holding everything yourself and trusting an exchange sits a middle path: collaborative custody, where a service holds one key in a multisig setup but can never move your funds alone.

Casa runs a multikey vault, with its Standard plan at $250 per year built as a 2-of-3 where you control two keys and Casa holds one emergency "Recovery Key." Casa cannot touch your funds (it holds only one of three), but it can guide you through replacing a lost key and passing access to an heir. Its higher tiers use a five-key vault. Unchained offers the Bitcoin-only equivalent, collaborative-multisig vaults and a Bitcoin IRA at $250 per year, with premium "Signature" tiers running $4,500 to $7,500 per year for people who want a dedicated relationship manager. These services exist because the hardest problems in self-custody are not cryptographic, they are human: losing a key, and dying.

Two more options come up often. A bank safe deposit box (Schliessfach) is a sound place to store a steel seed backup or one multisig share, well protected against home fire and burglary. Know the limits: banks generally do not insure the contents, access can be restricted, and on the holder's death the box is typically sealed until the estate is settled, so it should never be the only copy. And crypto custody insurance exists, but it overwhelmingly covers institutional custodians and exchanges, not an individual's self-custodied seed phrase. For most people, the realistic "insurance" is redundancy: more than one backup, in more than one place, in more than one form.

The custody stack

Put together, good practice is not one wallet, it is a stack matched to how much is at stake.

Spending money goes in a hot wallet (MetaMask, Phantom). Keep the balance small, the way you would carry cash, and assume it can be drained if you sign the wrong thing.

Savings go on a single hardware wallet, ideally one with a secure element or an air-gapped open-source design, with the seed backed up on steel and stored somewhere a house fire cannot reach. Add a passphrase only if you are disciplined enough never to lose it.

Generational wealth goes into multisig, with keys in different locations and a written, tested inheritance plan, alone or with a collaborative-custody service so the setup survives your own mistakes and your own death.

The most common ways people lose crypto map directly onto this stack: signing malicious approvals from a hot wallet, leaving savings on an exchange that fails, losing the only copy of a seed, and dying without a plan. None of them are exotic. All of them are preventable. Match the protection to the amount, keep more than one backup, and never confuse an account balance with ownership.

Read the data, not the hype.

Frequently asked questions

What is the safest way to store cryptocurrency? There is no single safest wallet, only a setup matched to the amount. Day-to-day funds belong in a hot wallet with a small balance, savings on a hardware (cold) wallet with a steel seed backup, and large or generational holdings in a multisig setup across multiple locations, optionally with a collaborative-custody service. The common rule across all three: hold your own keys, and keep more than one backup in more than one place.

Is a hardware wallet like Ledger or Trezor completely safe? No device is completely safe. Hardware wallets defeat the remote theft that drains hot wallets, but they remain exposed to physical attacks, tampering, user error (signing a malicious transaction), and trust in the maker's firmware. Ledger's 2020 data breach and the demonstrated seed-extraction attack on secure-element-free Trezor devices both show that hardware shifts the risk rather than eliminating it.

What is the Ledger Recover controversy about? Ledger Recover (launched October 2023, $9.99 per month) backs up your seed by encrypting it, splitting it into three fragments, and sending each to a different custodian over the internet, with identity verification to recover. The backlash was less about the feature and more about what it revealed: Ledger's firmware is closed source and can, by the company's own admission, be written to extract the seed, which means users ultimately trust Ledger, not just the chip. The feature is optional and off by default.

How much crypto is lost through scams versus exchange failures? Both are large. Wallet drainers and Web3 phishing alone took about $494 million in 2024, mostly through victims signing malicious token approvals rather than through stolen keys. Custodial failures are larger and rarer: Mt. Gox lost over 850,000 BTC in 2014, and FTX left a customer shortfall its founder put near $8 billion in 2022. Lost and forgotten keys account for a large amount of permanently inaccessible coins on top of both.

Should I keep my seed phrase in a bank safe deposit box? It can be a good place for a steel backup or one multisig share, well protected from home fire and theft. But banks typically do not insure the contents, access can be limited, and the box is usually sealed on the holder's death until the estate is settled. Treat it as one location in a redundant setup, never the only copy, and never store a backup digitally (a photo, a cloud note, a text file), which turns a cold backup into a hot one.

This is independent research and education, not financial or security advice. Figures are sourced and dated where cited (ScamSniffer 2024, Group-IB, Ledger, Donjon, Casa, Unchained, court filings) and reflect the position at the time of writing. Verify current details before acting.