Self-custody without the fear: a threat model you can actually hold in your head

"Not your keys, not your coins" is a slogan, not a plan. The useful question is narrower: what are you defending against, and what are you willing to trade to defend against it?

Four failure modes, ranked by how often they actually happen

Notice the ordering. The dominant risk in self-custody is not a hacker — it is you, in five years, unable to find or interpret your own backup. Almost every over-engineered setup fails here: complexity added to defeat a rare threat multiplies the probability of the common one.

Deriving the rules

Once the threat model is explicit, the standard advice stops being arbitrary:

• Write the seed phrase on something durable — because loss of access is the top risk, and paper burns and fades.
• Store copies in two locations you control — because a single location makes fire and flood a total loss, while more than two multiplies theft surface.
• Never type a seed phrase into anything with a screen and a network — because phishing is the second risk, and this is the single behaviour that defeats it.
• Verify receive addresses on the hardware device itself — because malware that swaps clipboard addresses is cheap and common.
• Write down where things are, for someone else — because inheritance failure is loss of access wearing a different hat.

When custody is the right answer

For small balances you actively trade, a regulated custodian is a defensible choice, and pretending otherwise has cost people more than it has saved. The mistake is not using a custodian; it is using one without knowing whether your assets are segregated, what happens in insolvency, and whether the entity holding your funds is the one named on the app.

Self-custody is not a moral position. It is a decision to take on operational risk in exchange for removing counterparty risk.

Pick the one you are better equipped to manage, and be honest about which that is.