Where is the safest place to store your Bitcoin?

Editor’s Note: Since the recent hacking incident of a well-known crypto hardware wallet provider, we explore the real safety of different types of wallets that hold our digital currencies.

Filipinos are putting meaningful amounts of money into digital currencies. But for something that might represent a life’s savings, we’re still surprisingly unserious about wallet security.

The most common advice is to put your holdings in a hardware wallet, a small device that keeps your private keys, the secret controlling your Bitcoin, isolated from the internet. When you spend, it signs the transaction without handing the key to your computer. For most people, this is genuinely good security.

But “good” is not the same as “safe enough.”

A hardware wallet protects you well from one nightmare: your computer gets infected with malware that steals your key. It doesn’t protect you from a firmware bug, bad randomness, physical coercion, lost backups, or someone finding the notebook where you wrote your seed phrase.

We got a nasty reminder of this recently when Coldcard, one of the most popular Bitcoin hardware wallets, had a firmware bug that helped attackers steal roughly $70 million in Bitcoin. Victims didn’t need to be online. The firmware generated private keys without true randomness, making them crackable, even with the device powered off and disconnected from the grid.

Are hardware wallets still safe?

A hardware wallet only protects against a class of attacks, it doesn’t mean it’s invincible to everything. 

The uncomfortable part of self-custody is that while we may have eliminated the bank, we have also inherited the responsibility of the bank’s security department.

Then, how do we secure our Bitcoin?

Let’s go with Murphy’s Law and assume that in any system, something is always bound to go wrong. The goal becomes less about finding a wallet that can never fail, and more about designing a system where one failure isn’t enough to wipe you out.

Hardware wallets are still great, I just wouldn’t make one tiny piece of hardware the only thing standing between an attacker and my life savings. 

This is where multisig wallets becomes interesting.

Instead of one key authorizing a transaction, you require multiple independent keys, say a 2-of-3 setup with three devices from three different vendors, any two needed to move funds. If one is compromised, lost, or destroyed, you still have two others. 

It sounds almost embarrassingly simple: don’t put all your eggs in one cryptographic basket.

“But this is way too fussy, I move my Bitcoin a lot!”

Security isn’t useful if it’s so inconvenient you work around it. That’s why trading desks and custodians lean into MPC, or Multi-Party Computation, wallets. With MPC you don’t need multiple devices, key shares live across your social login, phone passkey, or an OTP, so it feels like regular 2FA. 

There’s still a catch: not everything wearing the “MPC” label works perfectly. Some wallets use Shamir’s Secret Sharing, which splits an already-complete key into pieces and reassembles the whole thing every time you sign, recreating a single point of failure at the worst possible moment. Others route key shares through the provider’s own servers, where the company can potentially see them in use.

The more rigorous version is a threshold signature scheme, or TSS, where the complete key does not need to be assembled anywhere, including during signing. This gets you much closer to the idea of having no single point of failure while keeping the experience relatively convenient.

But TSS isn’t a silver bullet either. Its security still depends on the protocol, the implementation, and the infrastructure running the signing process. You’re not eliminating trust, just relocating it from a hardware chip to a software team. 

A nuanced approach

So here’s what I tell my friends:For moderate security without much fuss: an MPC wallet can work.

For strong security if you don’t move funds often: multisig.

For serious amounts: consider combining different security models, such as a multisig setup where at least two signatories use MPC.

There’s no version of this where you get both maximum convenience and maximum security. But this is much better than entrusting your life on a single hardware and praying that nobody ever cracks it.Self-custody was never about finding a wallet that can’t fail. It’s about favoring non-brittle systems, ones where no single failure, not a bug, not a stolen phone, not a bad update from five years ago, is enough to take everything.