Jameson Lopp warns Bitcoin holders against giving up self-custody
Recent wallet-security failures have renewed calls for managed custody. Casa chief security officer Jameson Lopp argues that handing over control does not make Bitcoin risk-free. He says holders should strengthen their custody practices and plan for recovery, rather than assume an exchange or ETF eliminates the risks.
- Self-custody and institutional custody carry different risks.
- Multisig reduces reliance on one key, but adds complexity.
- Recovery and inheritance plans are part of security.
In an open letter dated Oct. 22, Lopp urged Casa clients and the Bitcoin community not to treat recent attacks as a reason to give up direct control. The letter did not state the year. Lopp said many of the attack methods making headlines were already known to security professionals. Real incidents, though, make those risks harder for ordinary holders to brush aside.
The incidents include weak recovery-seed generation, compromised hardware-wallet distribution, stolen funds and sophisticated scams. In August, crypto.news reported record inflows to OKX and separately reported growing interest in managed custody at the exchange. The reports do not establish that the Coldcard incident caused those inflows.
ETFs offer exposure, not control of the coins
Self-custody means holding the private keys that authorize transactions. If you lose those keys or someone else gets them, you may lose access to the funds. With managed custody, an institution holds the keys for you.
A Bitcoin ETF works differently. Investors buy fund shares that track Bitcoin’s price, rather than depositing their own Bitcoin with the fund. They get price exposure but do not directly control or transfer the underlying coins. Lopp’s concern is that fund investors and custodian customers depend on institutions and their decisions, including how they respond to freezes or seizure orders.
ETFs and custodians are not inherently unsuitable. They can be practical for people who do not want to manage keys. The trade-off is straightforward: with self-custody, the owner handles security and recovery. With managed custody, the owner must trust a provider. Neither option removes every risk.
What the wallet incidents reveal
The Coldcard case involved a firmware configuration error dating back to March 2021. The error led affected devices to generate recovery seeds with a weaker source of randomness. A recovery seed is the backup information used to restore a wallet. Randomness makes its keys difficult to guess.
An Aug. 3 report described suspected Bitcoin thefts worth nearly $90 million at the time and cited Kraken chief security officer Nick Percoco’s call for independent testing of wallet seed generation. According to the report, attackers could reconstruct private keys linked to vulnerable seeds without physically accessing the devices or obtaining the recovery phrases. The figure was a reported estimate, not a confirmed final loss. Coldcard released corrected firmware. Users whose seeds were generated by the vulnerable process needed to create new wallets and transfer their holdings.
A separate investigation published Oct. 13 described compromised Ledger hardware wallets distributed through Southeast Asian reseller CryptoBilis. Ledger confirmed an unauthorized hardware implant had been found in one affected device. The investigation did not establish that Ledger’s own systems or direct sales channels had been compromised.
On Oct. 18, Qubic disclosed a wallet-security breach involving approximately 2.94 trillion QU tokens, worth $1.4 million, taken from 1, 404 wallets. Developers traced the incident to insufficient randomness in certain recovery seeds and later fixed the affected software.
The incidents highlight several possible weak points: seed-generation software, device distribution and wallet security. An offline device cannot protect funds if its keys were generated insecurely or it was compromised before reaching its owner.
Build security around recovery, not just prevention
Lopp recommends multisignature, or multisig, wallets. A multisig wallet requires approval from multiple private keys before a transaction can proceed. Its setup sets a threshold for how many keys must approve a transaction. That way, losing or compromising one key does not have to mean losing control of the funds.
Lopp also recommends keeping keys in different locations and using hardware from different supply chains. This helps prevent a single theft, location-specific disaster or shared product weakness from taking away every route to recovery. But scattering keys is not a security plan by itself. Owners need to know which keys are required, where they are and how to use them if something goes wrong.
Extra layers can create extra opportunities for mistakes. A multisig setup its owner cannot operate, or trusted beneficiaries cannot recover, can leave funds inaccessible. Lopp does not present multisig as a complete fix or prescribe one setup for everyone. Whatever the arrangement, it should be tested, and the recovery process should be clear without exposing the keys unnecessarily.
Inheritance planning matters for the same reason. Holders should think about how trusted people could access their funds if illness, incapacity or death prevents them from managing their wallets. Lopp raises the need to plan but does not propose a specific procedure.
Casa offers assisted self-custody services without taking possession of customers’ private keys. That assistance can help people manage custody, but they still need to understand how access works and how to recover their funds.
Key questions about Bitcoin self-custody
-
What is the trade-off between self-custody and managed custody?
Self-custody gives the holder direct control, but makes them responsible for security and recovery. Managed custody can reduce the burden of managing keys, but requires trust in an institution and does not eliminate risks such as freezes or seizures.
-
Does a Bitcoin ETF give investors control of Bitcoin?
No. An ETF provides price exposure through fund shares. Investors do not directly control or transfer the underlying coins.
-
Did the Coldcard incident establish a confirmed $90 million loss?
No. An Aug. 3 report described suspected thefts worth nearly $90 million at the time. That was not a confirmed final loss figure.
-
Does an offline hardware wallet guarantee safety?
No. Seed-generation flaws and compromised devices show that security also depends on how keys are created, how devices reach users and whether the recovery plan works.
The practical lesson is that not every Bitcoin holder has to manage keys alone. Changing custody arrangements shifts responsibility and risk, but does not erase them. Whatever you choose, security depends on knowing who controls access, how that access could fail and how it can be restored.
