Trezor: Someone Always Holds Your Keys. It Should Be You.

By Danny Sanders, Chief Commercial Officer, Trezor

If you own a hardware wallet and you have spent the last few days worried, I completely understand. The recent Coldcard incident was serious, and real people lost real money, which is never something to wave away. One company made a serious mistake on one of the core jobs a hardware wallet has, generating solid randomness for the seed, and that has hurt a lot of real people. But at the same time, it was not a crack in the idea of self-custody, nor that hardware wallets in general can no longer be trusted.

It is worth being clear about what actually happened, without the noise. The wallets that were drained were built with weak randomness at the moment they were created. That is a specific flaw in a specific company’s product, and it has no effect on how other manufacturers’ devices generate their keys. If your wallet was made properly in the first place, nothing about this incident touches you. Your funds sit exactly where they did a week ago, protected by exactly what protected them before.

So the first thing I would say is this. Do not let fear redesign your setup. Fear is a poor engineer. It pushes people to bolt on complexity they do not understand, and complexity you do not understand is its own kind of risk.

There is a lot of talk right now about multisignature wallets, the kind that need several keys to move funds. Multisig is a genuinely good tool, and for someone holding a very large amount of Bitcoin it can make real sense, because it means no single device, and no single vendor, can put everything at risk. Trezor has supported multisig since 2014 and is one of the most widely used devices in these setups. But for many people it is more than they need. Not all Bitcoin is meant to be locked away forever, and for the coins you actually use, multisig quickly becomes a burden rather than a help. For a lot of people, a simple single-sig setup does the job well. One seed, written down properly and stored safely. Clear and manageable. Multisig also has real footguns, from falling below the required threshold or correct construction, to the genuine difficulty of backing it up and restoring it correctly, and the easily managed versions carry a yearly fee. It is simply not for everyone.

And if you are new to all of this, please do not let a bad week scare you off before you have started. Self-custody is a skill, and like any skill it rewards practice more than panic. Start small.

There is another reaction to this incident that I understand but want to gently push back on. In the days since the news broke, some Bitcoin has moved back onto exchanges and into custodial products, as people decide that letting a company look after their coins feels easier and safer. The instinct is human. But I think it gets the lesson backwards.

Here is the thing that does not go away, no matter how you arrange it. Someone always holds the keys to your Bitcoin. The only question is who. If it is not you, then it is a company, and you are trusting that company to be honest, competent and still standing tomorrow.

We have watched, more than once, what happens when that trust is misplaced. Exchanges have been hacked. Custodians have collapsed. People who believed their coins were safe with someone else have learned, too late, that the coins were never really in their hands at all. The entire reason Bitcoin exists is so that your money can be truly yours, rather than a balance a company shows you and promises is safe. To hold your own keys is simply to take that promise into your own hands.

At this point a fair reader might say, but I am being asked to trust a wallet company instead of an exchange, so what is the real difference? It is a good question, and the answer matters. When you leave your coins with a custodian, you hand over the coins themselves. You are trusting that company to stay solvent, stay honest and still be there tomorrow, and if it fails, your money goes with it. When you use a hardware wallet, you never hand the coins to anyone. You hold them. What you rely on is narrower, that the tool was built correctly. And because our code is open for anyone to inspect, that is something you or an independent expert can actually check, rather than a leap of faith. One kind of trust is verifiable. The other you simply have to hope is well placed.

This is not a claim that self-custody carries no responsibility. It plainly does. But the responsibility is the price of actually owning something, and it is a price we think is worth paying. Handing your keys to a custodian does not remove the risk. It just moves it somewhere you cannot see and cannot control, and it puts you back inside the very system Bitcoin was built to escape.

If responsibility is the honest catch with self-custody, then the work worth doing is making that responsibility feel light. This is the part I care about most, and it is the reason I do this job.

For a long time the industry quietly accepted that self-custody was the difficult, slightly intimidating option, and that convenience would always belong to the exchanges. I have come to believe the opposite of what that assumption implies. Convenience has done more to shape where people keep their Bitcoin than difficulty ever has. Most people do not leave their coins on an exchange because they have weighed up the risk of that exchange failing and decided it is worth it. They leave them there because it took thirty seconds and felt familiar. If we want more people to own their keys, the answer is not to lecture them about why they should. It is to make owning your keys feel as natural and as effortless as the apps they already use every day.

That is the standard we hold ourselves to across the whole industry. Not self-custody that is merely possible for the technical few, but self-custody that feels obvious and easy for anyone. Security was never about how hardcore or elaborate a setup looks, dicerolls and air-gaps and the rest. Those things can offer a sense of safety that does not always match the reality. What matters is getting the everyday version of self-custody right, because that is the version most people will actually use. A solid single-signature wallet is a perfectly good baseline, and anyone who wants to can scale up from there.

There is one more thread running through this whole conversation, and it matters more after an incident like this, not less. If you are going to hold your own keys, you deserve to know that the tool you are trusting actually does what it claims. And the honest way to earn that trust is not to ask for it. It is to let people check.

This is why our firmware and the design of our devices are open source. Anyone can read exactly how a Trezor works, including precisely how it creates the randomness that protects your funds. Openness alone is not a magic shield, and I would be wary of anyone who tells you it is. Open code only helps if people actually look at it, and if others build on top of it, which pulls even more eyes onto the code. So we do everything we can to make sure they do.

We run a bug bounty programme that pays independent researchers to find flaws and report them, which turns “someone could inspect this” into a real reason for them to try. And because the code is public, the door to scrutiny is open every single day, not just on the occasions a company chooses to invite someone in.

Transparency is not something we bolt on at the end. It shapes how we build from the start. The point of Bitcoin was never that you should have to trust a new set of institutions instead of the old ones. It was that you should not have to trust blindly at all. You should be able to verify. A wallet company that asks for your faith while keeping its workings hidden has missed that point entirely.

So no, this difficult week does not mean hardware wallets are broken, and it does not mean self-custody was a mistake. It means what it has always meant. Owning your own money asks something of you. That is not a weakness in the idea. It is simply what ownership is. And a hard week like this one does more than cause pain. It forces the whole industry to run deeper audits and ask harder questions, with more scrutiny on this code than ever before, from researchers, from new tools, and from the wider community. It does not feel like it today, but self-custody is quietly getting stronger, faster than almost any other part of this space.

Someone is going to hold the keys to your Bitcoin. It is telling that over the past week we have welcomed many new people to Trezor, a good number of them coming from Coldcard, people who care about self-custody and have no intention of giving it up. We will look after them the way we have looked after everyone for the past twelve years, by keeping them safe. After everything we have all watched happen, I still believe the safest hands for your Bitcoin are your own. Your money, finally and fully yours.

_________________________________________________________________________

Bitcoin.com accepts no responsibility or liability, and shall not be liable, whether directly or indirectly, for any loss, damage, claim, cost, or expense of any kind, whether actual, alleged, or consequential, arising out of or in connection with the use of, or reliance upon, any content, goods, or services referenced in this article. Any reliance placed on such information is strictly at the reader’s own risk.