Is your custody setup actually safe?

The honest test of a custody setup is not how many keys it has. It is how many separate things have to fail before the bitcoin is gone, and who is responsible for keeping those things separate for the next twenty years. Most setups score far worse on that test than their owners believe, and the reason is almost never cryptography.

After a hardware wallet entropy failure in July 2026 emptied wallets that had been generated on affected firmware, the two most common reactions were to add dice rolls and to add hardware devices. Both are reasonable instincts. Neither answers the question, and understanding why is the difference between a setup that survives the next failure and one that only survived the last one.

How many dice rolls is enough?

Dice address one specific problem: whether the randomness used to create a key can be trusted. If a device generates your key from a predictable source, no amount of care elsewhere saves you, so rolling your own entropy is a genuine fix for a genuine weakness. Vendor guidance during the 2026 incident pointed advanced users at a dedicated dice-entropy path for exactly this reason.

Then the question becomes uncomfortable. The dice fix your entropy on the assumption that you rolled a fair die, that you rolled it enough times, that you recorded every roll correctly, that you did not unconsciously stop early, and, critically, that the firmware hashing your rolls does what its documentation says. That last assumption is the same category of trust that just failed. You have not removed the vendor from the process. You have moved where you are trusting them.

Now assume you did all of it perfectly. You have one excellently-generated key. If it sits in a single-signature wallet, you still have one key, one device, one place it can be lost, stolen, or destroyed, and one person who knows how to recover it. Perfect entropy in a single-signature wallet is a perfectly random single point of failure.

So the answer to “how many dice rolls is enough” is that it is the wrong unit. Dice measure the quality of one key. Custody is a question about the number of independent things protecting all of your bitcoin, sustained over decades. A better key does not change that number.

How many hardware devices is enough?

The instinct to add devices is closer to right, because it is reaching for independence. But the count only means something if the devices fail for different reasons.

Three hardware wallets from the same manufacturer, running the same firmware, share one code path, one supply chain, one entropy implementation, and one vendor whose security team either finds a defect or does not. A defect in that shared foundation reaches all three keys simultaneously. That is precisely what turned the 2026 entropy failure from a series of individual losses into a structural event: multisig holders discovered their independent keys had never been independent.

Three devices from three manufacturers is materially better. Now a firmware defect at one vendor takes one key, and the threshold holds. This is the strongest argument for multi-vendor multisig, and the security researchers who made it publicly during the incident were right to make it.

And the question keeps going. Where are those three devices? If they are in one house, a fire, a burglary, or a flood reaches all three regardless of how many vendors made them. Geographic separation is not a refinement of the plan, it is part of whether the plan exists. So now the devices are in three locations, which means three sets of physical security, three firmware update paths you are responsible for tracking, and three recovery procedures you need to remember or record. Recording them creates a document that is itself a target.

Every device you add to increase independence also adds an operational obligation, and obligations decay. They decay when you move house, when you change jobs, when you get sick, and completely when you die.

Count failure domains, not devices

The unit that actually measures custody is the failure domain: an independent party or system that must fail before you lose access. Keys that share a manufacturer, a firmware build, an entropy path, a building, or a single human operator all sit inside one domain, no matter how many separate objects they occupy.

This is why a five-of-seven multisig built from one vendor's devices can be weaker than a two-of-three built from three vendors, and why both can be weaker than they look if every key is in the same city and only one person understands the recovery.

All distributed custody is not equal

Distribution is a spectrum, and the differences between points on it are larger than the marketing suggests. Our Custody Independence Standard breaks it into four questions: are the vendors independent, are the entropy sources independent, can any single party move funds alone, and who sustains all of that over time.

Read the fourth column carefully, because it is where the real distinctions live.

Self-managed multi-vendor multisig is the strongest answer available to an individual, and we score it that way. It can satisfy vendor, entropy, and control independence completely. What it cannot do is carry itself. The holder is the firmware tracker, the geographic separation, the recovery tester, and the succession plan. When that person is diligent, the setup is excellent. When that person is unavailable, it is frequently unrecoverable.

Collaborative custody adds a genuine structural improvement: the provider holds a key and cannot move funds alone, so the holder gains a partner without surrendering control. That is real sovereignty and deserves credit. It also leaves vendor and entropy independence in the holder's hands, because the holder chooses the devices their own keys are generated on. A collaborative setup where the holder's keys come from two units of the same model has a provider key and one vendor domain, not three independent ones. The operational burden of separation and heir handoff also stays largely with the holder, and the heir generally needs to be technical enough to sign.

Qualified single-custodian custody inverts the trade. Segregation, legal title, insurance, and operational discipline are typically strong, and the holder carries almost no burden. Independence of control is absent by construction: one institution can move the assets, so its compromise, insolvency, or unilateral action is the whole risk.

Multi-institution custody is the arrangement where independence is structural rather than maintained by the holder. Separate institutions generate keys under their own ceremonies and controls, hold them in separate jurisdictions, and no single one, including the platform the client deals with, can move funds alone. The keys do not share a firmware build or an entropy implementation, because they were not created by the same process. The holder verifies the arrangement on-chain rather than maintaining it in person.

The trade there is real and should be stated plainly: it introduces institutional counterparties, ongoing fees, and a relationship you have to evaluate. It is not self-custody and does not pretend to be. What it does is move the fourth pillar off one person's shoulders, which is the pillar most self-managed setups eventually fail.

The four questions to ask about your own setup

What to actually do

If your bitcoin sits behind a single key from a single vendor, raising your failure-domain count is the highest-value change available to you, and it matters more than which specific product you pick.

If you have the discipline and the time, multi-vendor multisig with real geographic separation and a tested, documented recovery is an excellent answer, and you should write the succession plan before you need it. If you would rather not be the person maintaining that for the next twenty years, the institutional arrangements exist for that reason, and the honest cost is fees and counterparty relationships rather than complexity.

What does not work is the middle: nominal distribution that looks like a plan. Several keys from one vendor, in one place, understood by one person. That configuration carries the cost and complexity of distributed custody with a failure-domain count of one.

Compare specific arrangements against the four pillars on our platform scores, or work through the custody assessment to see where your current setup sits.