Security advice for Bitcoin tends to arrive as a shopping list. Buy this device, install that app, use this network. It skips the only question that decides whether any of it is worth doing: what would actually have to go wrong for you to lose your Bitcoin?
Answering that is called threat modelling. It sounds technical. It is really just three questions asked honestly.
The three questions
1. What are you protecting?
Be specific, and use real numbers privately. Protecting a few hundred pounds of Bitcoin held on an exchange is a different job from protecting a holding that would change your family's life if it vanished. The second deserves more of your time and money. The first mostly needs you to stop reusing passwords.
Include the things that are not coins. Your seed phrase is the holding. So is the piece of paper in the drawer, the note in your password manager, and the person who knows where both are.
2. Who are you protecting it from?
This is where most people go wrong, in both directions. They either imagine nobody would bother targeting them, or they imagine a state intelligence agency. Realistically, the people who take Bitcoin from ordinary holders are:
- Opportunists running phishing at scale, who need you to click once
- Criminals who bought a leaked customer list and know roughly what you hold
- Someone who took over your phone number and then your email
- An exchange that fails, freezes, or gets breached while holding your coins
- In rare but rising cases, people willing to turn up at your door
- Most often of all: you, in six years, unable to find the backup
Nothing on this site will protect you from a determined nation state, and any site claiming otherwise is selling something. Everything on this site is aimed squarely at the list above, because that list is what actually happens.
3. What is it worth spending?
Security has a cost in money, time, and inconvenience, and inconvenient systems get abandoned or, worse, cause the loss they were meant to prevent. A setup so clever that your family cannot recover it is not secure. It is a delayed loss.
A sensible rule: the effort should scale with the holding, and every measure should survive the question what happens if I am not here to explain this?
Write down, on paper, the sequence of events that would have to occur for you to lose everything tomorrow. Most people find they can describe it in two or three steps, and that those steps are ordinary rather than exotic. Those steps are your threat model, and the rest of this site is organised around closing them.
The three levels
Every article and recommendation here is badged with one of three levels, so you always know who a step is for. They are cumulative: Level 2 assumes Level 1 is done, Level 3 assumes both.
Most people reading this need Level 1 completely, some of Level 2, and none of Level 3. That is not a failure. Choosing the right level is the whole skill.
Level 1 · Essential
Who it is for: everyone holding an amount of Bitcoin they would be upset to lose.
This level closes the attacks that account for the overwhelming majority of real losses. If you do nothing else on this site, do this, and understand that it is not optional at any holding size worth the name.
- Hardware wallet, bought directly from the manufacturer
- Seed phrase stored properly, offline, in more than one place
- A password manager, and unique passwords everywhere
- Two factor authentication that is not text messages
- Knowing what phishing looks like before it arrives
- Never discussing your holdings with anyone who does not need to know
Start with the 30 minute setup guide, which does all of the above in one sitting.
Level 2 · Private
Who it is for: people who want to reduce how much of their life is discoverable, and how easily their holdings can be linked to their name and address.
Level 1 stops your Bitcoin being taken. Level 2 reduces the chance you are selected as a target in the first place. That distinction matters more every year, because the lists attackers work from increasingly come from data that was collected legitimately and then leaked.
- Email aliases, so one leak does not expose every account
- A separate number for account recovery, not your everyday SIM
- A VPN, used with a clear understanding of what it does and does not hide
- Minimising what exchanges know and hold about you
- Basic coin control, so your transactions leak less
- An inheritance plan, written down, that does not expose you while you are alive
Level 3 · Hardened
Who it is for: significant holdings, or an elevated risk profile: a public association with Bitcoin, a business that makes you visible, or a specific reason to believe you are known.
Level 3 measures carry real costs and real risks of self-inflicted loss. A passphrase you cannot reproduce is indistinguishable from a stolen wallet. Multisig you do not understand is a slower way to lose coins. Approach this level deliberately, and rehearse recovery before you rely on any of it.
- Passphrases, and the trade-offs that come with them
- Multisig custody, with recovery tested before it matters
- Dedicated devices used for nothing else
- Network segmentation at home
- Hardened mobile operating systems
Where to go next
If you want the context before the checklist, read why Bitcoin is not anonymous and how people actually lose Bitcoin. If you would rather start doing something, go straight to the 30 minute setup.