Key Security: Hardware Wallets, Cold Storage & Backups

Everything in this part reduces to one uncomfortable truth: whoever controls the keys controls the coins, and there is no one to appeal to. No password reset, no fraud department, no chargeback. That finality is the source of Bitcoin’s censorship-resistance and the reason key security is a genuine discipline rather than an afterthought. This page is about matching how you store keys to the threats you actually face.

Hot vs cold: where the key meets the internet

The single most important axis is whether the private key ever touches an internet-connected device.

HOT  ── key lives on an online device (phone, laptop, exchange)
        convenient · higher attack surface · for small, spending amounts

COLD ── key is generated and stored OFFLINE, never on a networked machine
        inconvenient · drastically smaller attack surface · for savings

A practical setup mirrors a physical wallet vs a vault: a small hot wallet for day-to-day spending you can afford to lose, and a cold store for the bulk of your savings.

Hardware wallets and air-gapping

A hardware wallet is a purpose-built device that generates and stores keys in a secure element and signs transactions internally — the private key never leaves the device. You send it an unsigned transaction (often as a PSBT); it signs inside and returns only the signature. Even if the computer it’s plugged into is riddled with malware, the key stays sealed.

   [online computer]            [hardware wallet]
   builds unsigned tx  ──PSBT──►  shows amount + address on its OWN screen
                                  user verifies + approves
                       ◄─sig────  signs internally, key never exposed
   broadcasts signed tx

Verify on the device’s own screen

Malware’s favorite trick is swapping the destination address on your computer screen. The defense is to confirm the amount and address on the hardware wallet’s own display before approving — that screen is outside the malware’s reach. “Air-gapped” setups go further, transferring PSBTs by QR code or SD card so the signing device never connects to anything.

Backups: surviving loss, not just theft

Theft is only half the risk; loss destroys just as many coins. Your backup is the seed phrase (see Seed Phrases (BIP39)) — and for multisig, also the descriptor. Principles that actually matter:

• The backup is the words, not the device. A hardware wallet can be lost, bricked, or discontinued; the seed restores your coins into any compatible wallet.
• Redundancy beats secrecy theater. Multiple copies in separate physical locations protect against fire, flood, and loss. Metal backups survive what paper doesn’t.
• Test your recovery before you fund it. A backup you’ve never restored from is a hypothesis, not a backup.
• Never digitize the seed. No photos, no cloud notes, no password manager, no email to yourself — the moment it touches an online device, it’s a hot secret.

Think in threat models

There is no single “most secure” setup — only the right tradeoff for your adversaries. Name the threat, then choose the defense:

Threat	Primary defense
Malware on your computer	Hardware wallet; verify on-device
Remote theft / exchange hack	Self-custody (cold storage) — “not your keys, not your coins”
Losing a single key/device	Multisig (e.g. 2-of-3) or a tested seed backup
Fire / flood / physical loss	Geographically separated, durable (metal) backups
Coercion (“$5 wrench attack”)	Passphrase decoy wallet; keep holdings private
You die / incapacitation	Documented inheritance plan; multisig with a trusted party

The two ways everyone loses coins

Almost every real loss is one of: (1) the seed was stored somewhere an attacker could reach (a photo, a cloud file, a phishing site), or (2) the only backup was lost/destroyed and never tested. Defend both ends — secrecy and redundancy — because over-securing one while neglecting the other is how careful people still lose everything.

It actually happened — the hard drive in a Welsh landfill (2013)

The most famous “loss, not theft” story belongs to James Howells, an IT worker in Newport, Wales. In 2013 he threw out a hard drive holding the private keys to roughly 8,000 BTC he’d mined years earlier. The drive went to the local landfill, where it remains. He has spent the years since trying to get permission to excavate the site — offering the council a cut, proposing machine-assisted searches — and as of the mid-2020s has recovered nothing; a UK court dismissed his case in 2025. The lesson is the one this page keeps making: there is no recovery desk. A backup that lives in exactly one place, unprotected, is a single accident away from permanent loss.

By the numbers — how much Bitcoin is simply gone

Lost keys aren’t an edge case; they’re a meaningful slice of the entire supply.

total BTC that will ever exist        = 21,000,000
estimated permanently lost            ≈ ~20% of mined supply (millions of BTC)   [analyst estimates]
coins mined by Satoshi, never moved   ≈ ~1,000,000 BTC

Estimates vary and can’t be exact — by definition you can’t prove a coin is unreachable, only infer it from coins that have never moved across many years. But the direction is clear: a large fraction of all Bitcoin has been removed from circulation by lost seeds, discarded drives, and forgotten passphrases. Every one of those is a key-security failure that this page’s habits — redundancy, tested backups, metal over paper — are designed to prevent.

The architect’s lens

Step back from the checklists and ask the five questions that turn an implementer into an architect — here the “mechanism” is the storage design itself:

• Why does it exist? Because the ledger answers only to a valid signature and has no recovery desk — so the hot/cold split, hardware signing, and redundant backups exist to keep the key both unreachable by attackers and un-loseable by you.
• What problem does it solve? Two distinct failure modes at once: theft (a hardware wallet signs internally so the key never leaves the secure element, even on a malware-riddled PC) and loss (the backup is the seed words, redundant in metal across locations, so a bricked or landfilled device costs nothing).
• What are the trade-offs? Every notch toward safety costs convenience and adds a new loss vector: cold storage is slow to spend; air-gapping means QR/SD-card friction; redundant copies multiply places a thief could find one. Over-securing secrecy while neglecting redundancy (or vice-versa) is how careful people still lose everything — recall the ~20% of mined supply believed permanently gone.
• When is this the wrong design? Match the setup to your threat model, not to maximalism — a small day-to-day balance belongs in a convenient hot wallet, not behind an air-gapped multisig; the elaborate vault is for savings you can’t afford to lose.
• What breaks if I remove it? Drop the on-device address verification and malware silently swaps your destination; skip the tested, redundant backup and a single fire, theft, or discarded drive is permanent — there is no chargeback to undo it.

The thread

How does this help untrusting strangers agree on one ledger? The ledger will faithfully enforce whoever proves key ownership — it cannot tell a rightful owner from a thief, and it will never reverse a valid signature. That impartiality is exactly what makes Bitcoin trustless for strangers, and exactly why the responsibility for guarding the keys lands entirely on you. Key security is the price of a system that trusts math instead of institutions.

Check your understanding

1. Define hot vs cold storage and give an appropriate use for each.
2. How does a hardware wallet keep your key safe even when plugged into a malware-infected computer?
3. Why is verifying the address on the hardware wallet’s own screen essential?
4. State two backup principles and explain the failure each one prevents.
5. Pick any two threats from the table and name the defense that specifically counters each.

Show answers

1. Hot = the private key lives on an internet-connected device (phone, laptop, exchange) — convenient, higher attack surface, suited to small spending amounts. Cold = the key is generated and stored offline, never on a networked machine — inconvenient but drastically smaller attack surface, suited to savings.
2. A hardware wallet generates and stores the key in a secure element and signs transactions internally — you send it an unsigned transaction (often a PSBT), it signs inside and returns only the signature, so the key never leaves the device even on a malware-riddled computer.
3. Malware’s favorite trick is swapping the destination address on your computer screen. The hardware wallet’s own display is outside the malware’s reach, so confirming the amount and address there is the only way to be sure you’re signing what you intend.
4. Any two of: the backup is the words, not the device (a device can be lost/bricked/discontinued, but the seed restores into any compatible wallet); redundancy beats secrecy theater (multiple copies in separate locations survive fire/flood/loss); test recovery before funding (an untested backup is a hypothesis); never digitize the seed (the moment it touches an online device it becomes a hot secret).
5. Any two, e.g.: Malware on your computer → hardware wallet, verify on-device; Remote theft / exchange hack → self-custody/cold storage (“not your keys, not your coins”); Fire/flood/physical loss → geographically separated durable (metal) backups; Coercion ($5 wrench) → passphrase decoy wallet and keeping holdings private.