How to Secure Crypto: Threat Model and Security Levels

Take Mark. He bought bitcoin on an exchange in 2021, then moved it to a hardware wallet. He wrote the twenty-four words on a sheet of paper and put it in the drawer with his documents. Five years later the neighbour upstairs flooded his flat. The device survived. The paper didn’t. While the device worked, nobody noticed the problem. When it broke, the only backup was smeared handwriting on wet paper.

Mark is made up, but the pattern is real. Crypto losses rarely look like a hacker attack from a film. More often it’s water, a lost phone, a clicked link, or a relative who didn’t know what they were holding. Securing crypto means surviving all of these scenarios at once.

This text is a map. It shows what you’re defending against, how to match the level of protection to the amount, and where to find the details. The details are in separate guides, linked along the way.

All the levels below share one rule: add a layer only when you understand what it protects and what it complicates in return. A safeguard that neither the owner nor the family understands is one more source of risk.

What you’re protecting against

Choosing protection starts with a list of threats. There are four, and each needs a different defence.

Loss or destruction. Fire, flood, moving house, a clear-out, broken hardware. Defence: two copies of the seed in two different places, on a medium that survives water and fire.

Theft. A burglary, malware on your computer, someone who knows your hiding place. Defence: a hardware wallet that signs transactions inside the device, and a backup that gives no access just by being found (a passphrase, a split seed, a 2-of-3 wallet).

Fraud and phishing. A fake exchange site, a “support agent” asking for your seed, an email about “wallet verification”. No hardware helps here, because the victim hands over the keys. The defence is one rule: never type your seed anywhere except the device that restores it. Trezor states that it never asks for your recovery seed, PIN or passphrase, and you can treat anyone who asks in the same way.

Death or incapacity. The threat people think of last, and the one with the worst outcome: the funds exist, but nobody knows how to reach them. The defence is access instructions for your family and a test that a loved one can follow them. The legal side is covered in the pillar crypto inheritance.

These threats pull in opposite directions. The better you hide the keys from a thief, the harder it is for your family, or for you in ten years, to reach them. Good security is a trade-off you make on purpose.

Exchange or your own wallet

On an exchange you don’t hold the private keys. The exchange does, and you hold an entry in its database and a right to withdraw. This is the custodial model. With your own wallet the keys are yours, which is self-custody. We compare the two, including what happens when an exchange fails and after the account holder dies, in the pillar exchange vs self-custody.

An exchange works well for buying, selling and short-term holding. For holding over years it has three weak points. The account can be blocked, and you have nobody to appeal to beyond the terms of service. Access depends on a phone, an email and identity verification, things your family usually won’t have after your death. And exchanges have been targets of attacks and have gone insolvent.

Your own wallet moves the responsibility to you. Nobody will reset your password if you lose the seed. That’s the fair price of control, and it’s why the rest of this text is about how to carry that responsibility.

If most of your funds sit on an exchange today, the first step is simple: move to your own wallet as much as you can’t afford to lose in an account freeze. Leave the rest for trading.

Hardware wallet: what it does and doesn’t do

A hardware wallet keeps the private key in a separate device and signs transactions inside it. The computer sees only the finished, signed transaction. An infected laptop can’t pull the key out of the device. We cover choosing a model and the differences between devices in the pillar hardware wallet, and the term is explained in the glossary entry hardware wallet.

It’s worth saying clearly what the device doesn’t do. It doesn’t store the funds, because those are on the network. It isn’t the only way in: if it breaks, you restore the wallet from the seed phrase. It doesn’t protect you from a fraudster you give the words to. And it isn’t protection forever, because it needs software updates and a check that in three years you can still operate it.

Buy the device from the manufacturer or an authorised shop and check that the packaging hasn’t been opened. Never use a device that comes with a seed already written on a card. Your own hardware must generate the seed at first start-up.

Seed backup: the biggest source of losses

A hardware wallet has one point on which everything depends: the seed phrase, usually 12 or 24 words. The BIP39 standard describes how these words become the master key. Whoever has the words has the funds. Whoever doesn’t have them has nothing, even when holding your device in their hand.

Rules that are enough for most people:

1. Write the words on paper or stamp them into steel. Manufacturers, Trezor among them, advise against digital copies and recommend metal as protection from fire and water.
2. Make two copies and keep them in two places, for example at home and with a trusted person or in a safe deposit box.
3. Don’t photograph them, type them into notes, email them or keep them in a password manager.
4. Check that the copy is legible and complete before you send the first funds to the wallet.

You’ll find a table of storage media and a way to check the backup in the guide how to store your seed phrase.

Passphrase and split seed: when to add a layer

A passphrase, or the 25th word, is an extra password that together with the seed defines the wallet. Under BIP39 every passphrase creates a valid but different wallet, so the same word list with a wrong passphrase opens an empty wallet. That’s the upside: a thief who finds your seed backup doesn’t get the funds. It’s also the risk: a typo or a forgotten passphrase means a loss, and no checksum will tell you the passphrase was wrong. The details are in the guide passphrase and the 25th word.

The second method is splitting the seed into parts that are worthless alone. The SLIP39 standard, also called Shamir, does this mathematically: you need a set number of shares, for example two out of three. It requires a device and software that support it, and the shares look different from the 12 or 24 BIP39 words. More in the guide Shamir and SLIP39 and in the glossary entry SLIP39 and Shamir.

Both methods add protection and add the risk of a mistake. Don’t add them just in case. Add them when the amount is large enough that theft worries you more than a mistake, and when you (or your family) know how to use them.

2-of-3 multisig: when one key isn’t enough

A multisig 2-of-3 wallet has three keys, and any two are needed to send funds. Losing one key doesn’t end the story. Stealing one key gives the thief nothing. A trusted person holding one key can’t send funds alone. This setup solves both main problems at once: theft and loss.

The price is concrete. You need three devices or keys, coordinating software such as Sparrow or Nunchuk, and one more backup: the wallet configuration, which records the public keys of all three participants. Two seeds alone aren’t enough, because from two seeds you can’t work out the third public key. In its documentation, Nunchuk lists the seeds and the configuration file as the two things needed to recover a wallet.

We set up 2-of-3 wallets for bitcoin. For other cryptocurrencies we suggest moving to a hardware wallet with a solid backup. When 2-of-3 makes sense, what it costs and how to avoid mistakes is covered in the guide 2-of-3 multisig wallet: who is it for. The term is also explained in the glossary entry 2-of-3 wallet.

Security levels by amount

There’s no threshold in euros above which you “must” use multisig. The line depends on what a loss means to you. Someone for whom losing the funds would change their life plans should protect them more strongly than someone knowingly risking a small sum. The table shows a reasonable minimum for several situations.

Situation	Reasonable minimum	What to add next
An amount for buying and experimenting that you can afford to lose	Exchange with a strong password and 2FA through an app or hardware key	Withdraw to your own address as the amount grows
A loss would hurt but wouldn’t change your plans	Hardware wallet, seed on steel or paper, two copies in two places	Recovery test, a note for your family
A loss would change your life plans	The same plus a passphrase or split seed, if you know how to use them	Access instructions for your family, an annual test
Bitcoin is a large part of your wealth	2-of-3 wallet with a copy of the configuration and a recovery test involving a second person	Annual review and updates
Shared funds for a family or business, several people with access	Multisig with defined roles, documentation, regular tests	Review every year and after every change in the family

The table describes a minimum, not a ceiling. If you don’t know which row you’re in, pick the higher one. Security that’s too strong can be simplified later, but a loss can’t be undone.

Most common mistakes

The same mistakes lead to losses again and again: one copy of the seed, a photo on the phone, a passphrase known only to the owner, a wallet that was never restored from its backup. The full list with the question “how do I check this for myself” is in the guide common crypto security mistakes. A printable version is the 10-step checklist.

Phishing and everyday habits

The weakest link is often a person in a hurry, not the hardware. A few habits close most of the doors scammers use.

1. Type site addresses by hand or open them from a bookmark. Don’t click a link from an email, text or messenger, even if it looks like a message from your exchange.
2. Download wallet apps only from the manufacturer’s site. Fake apps in app stores imitate well-known wallets.
3. Trust nobody who contacts you first about crypto: not “technical support”, not an “investment adviser”, not a person who knows your balance.
4. Before sending a larger amount, check the recipient’s address on the device screen, not on the computer screen. An infected computer can swap the address, while the device screen shows what you’re really signing.
5. For a first deposit to a new address, send a small test amount first.

None of these habits needs technical knowledge. They only ask you to slow down when someone is rushing you.

Recovery test

A safeguard nobody has tested is only an assumption. A recovery test answers one question: can I rebuild access to the funds from the backup alone, without the original device? How it goes:

1. Do it with a small amount in the wallet, or with a new wallet holding a small sum.
2. Reset the device or use a second device from the same manufacturer.
3. Restore the wallet from the seed backup only, and add the passphrase if you use one.
4. Compare the first address with the one the original wallet showed.
5. With multisig, restore the wallet from two seeds and the configuration backup on a computer you don’t use day to day.

You never type the seed into an app or onto a site you don’t recognise. The device and the manufacturer’s software are enough for the test. For a larger amount, repeat the test once a year, because software changes and paper fades.

A plan for your family

The layers described above protect you from strangers. Families usually fail for a different reason: they don’t know the crypto exists, don’t know where the backup is, and don’t know what to do with it. Access instructions for your family are a short document that says what you have, where it is, in what order to run it, and what not to do. It doesn’t contain the seed. It points to where the seed is and who has access to it.

What such instructions contain is described in the guide family access instructions: what to include. A will, inheritance and documents are a matter for a notary or lawyer, not for us. Start with the pillar crypto inheritance.

Where to start this week

You don’t have to do everything at once. An order that usually works:

1. Count how much you have on exchanges and how much in your own wallets. Write it down for yourself only.
2. Look at your seed backup today: is it there, is it legible, is it in two places?
3. Check whether anyone in your family knows the crypto exists. One sentence is enough.
4. Schedule a recovery test for the coming weekend.

If you want someone to go through this list with you, a check-up is an hour’s online conversation from €50, after which you get a list of risks, most urgent first. We never see your seed or keys and have no access to your funds. After the check-up you can order a setup: choosing hardware, a 2-of-3 setup in Sparrow or Nunchuk, and a recovery test with us. You type in the seeds yourself. To start on your own, begin with the checklist.