Best Practices for Storing Large Amounts of Bitcoin Safely

When a single hardware wallet stops being enough

A single hardware wallet is an excellent tool for moderate holdings. For most people sitting on somewhere between $1,000 and $50,000 in BTC, a reputable device with a passphrase and a carefully stored seed phrase is already more secure than almost any alternative. The weak link at that size is usually the user — not the device.

Once your stack grows into six figures and beyond, the shape of the risk changes. You are no longer mainly worried about a malicious link or a fake wallet app. You are worried about: a break-in at your home, a house fire that destroys both the device and your only paper backup, a sudden medical emergency that leaves your family unable to recover funds, a moving-house accident, or a family dispute that ends up in court.

There is no sharp threshold, but most experienced self-custody holders start layering additional protection somewhere in the $100,000+ range. The principle is simple: the loss of any single location, any single device, or any single person should not be enough to lose the coins. A single hardware wallet cannot deliver that property no matter how carefully you use it.

Multi-signature (multisig) setups

A multisig wallet requires more than one key to sign a transaction. The most common configuration for self-custody is 2-of-3: three keys exist, any two of them are enough to spend, and no single key on its own can move funds. The keys are usually held on three different hardware wallets in three different locations.

The point is simple. A thief who finds one device and one passphrase gets nothing. A fire that destroys one location does not touch the other two. If you lose one key, you still have two — and can rebuild to 2-of-3 at a new device. The cost is added complexity, a slightly more involved recovery process, and worse ergonomics for small frequent spends, which is why multisig is typically used for long-term cold storage, not day-to-day wallets.

Tools to look at: Sparrow Wallet and Nunchuk for self-hosted multisig with your own hardware, Casa and Unchained for collaborative-custody multisig where a third party holds one of the keys as a recovery partner. There is no single "best" option — the right choice depends on how technical you are, how much you trust a third party in the loop, and how your heirs would realistically work with the setup if you were not around.

Geographic seed distribution with Shamir

If multisig feels too operationally heavy, there is a lighter option: split a single seed phrase into multiple shares using Shamir's Secret Sharing. The widely-supported implementation in hardware wallets is the SLIP39 standard, most notably available on Trezor. You choose a threshold — for example 2-of-3 shares — and each share is a short list of words that means nothing on its own.

In practice, that might look like: one share in a fireproof safe at home, one with a family member in another city, one in a bank safety-deposit box. Any two of them reconstruct the seed; any one of them, stolen, is useless. You can find the reference implementation described in the Trezor Shamir Backup documentation.

Shamir is simpler to operate than multisig — there is only one wallet behind it and the on-chain footprint is identical to a normal single-sig spend. The trade-off is that at the moment of recovery, the shares are combined back into a single seed on one device. For some threat models that is acceptable; for very large holdings, multisig is usually considered stronger because the private keys never live together at any point.

Inheritance planning — the hardest problem

Self-custody has a problem every bank account solves by default: what happens when you die. Your heirs need a path to access the Bitcoin without you being in the room, and that path must not be so easy that someone else can walk down it while you are still alive. Most families get this wrong by doing nothing.

No option is perfect. The worst option is "my family will figure it out" — the overwhelming evidence from the last decade is that they will not. Pick an approach, write it down clearly enough that a non-technical spouse could follow it with a phone call to one trusted helper, and revisit it at least once a year.

Operational security for large holders

Multisig and Shamir defend against impersonal risks — fire, theft, loss. Operational security defends against targeted risks: someone who has specifically decided that you are worth attacking. The moment your holdings are large enough to matter, opsec stops being paranoia and starts being maintenance.

None of this is about living in fear. It is about making sure that the size of your holdings is information you control. Physical threats to known crypto holders — from SIM swaps that cascade into full account takeovers, to home invasions at addresses pulled from public records — have happened often enough to be taken seriously at this tier.

The boring-but-critical annual review

Most of the large-holder losses we read about do not come from dramatic hacks. They come from drift: a seed phrase that got moved during a renovation and never put back, a passphrase no one can quite remember, a firmware update that changed a derivation path, an inheritance document that still names an ex-partner.

Book the review as a recurring calendar event with a specific date — not "some time in April". An annual review you actually do is worth vastly more than a perfect security architecture you never verify.

Frequently asked questions