Where do your keys belong?

How the tool chooses

Behind the six questions sits a scoring table. Every answer card hands out zero to four points to each of the four forms of custody: your own hardware wallet, a software wallet on a phone or computer, custody by a provider, or the combination of a small amount kept to hand and a large rest kept offline. At the end the form with the highest total wins, and when scores are level the combination goes first, then the hardware wallet. The bars in the result show all four totals in relation to the winner so that you can see how close or how clear the answer is. Two questions carry the most weight: the amount, and the question of who you trust with the keys. The question about a storage place acts as a brake: anyone without a safe place for a word list on paper gets zero points for the hardware wallet and for the combination, along with a plain warning.

Custody by someone else, or your own keys

The one big fork is this: who holds the private key? If it sits with a provider, your balance is a claim against that company. BaFin, the German financial supervisory authority, pointed out in its warning of 22 August 2022 that crypto-assets are not covered by deposit protection and that investor compensation schemes as a rule do not apply either. What is left in an insolvency depends on whether the assets can be separated out from the estate. How real that is became clear in the insolvency of a large trading venue in November 2022, when customer balances were frozen overnight. If you hold the keys yourself there is no counterparty, but there is no reset button either: nobody can restore a lost word list.

Within self-custody people separate hot wallets from cold ones. Hot means the device holding the key is connected to the network, so a phone or a computer. Cold means the key has never been online and the device signs payments on its own. Both work from the same backup, the word list under the BIP 39 standard. From 128 to 256 bits of randomness come 12 to 24 words, and 12 or 24 are the usual counts. Those words are the key, not the device. Anyone who photographs them, keeps them in a notes app or uploads them to a cloud has effectively handed custody away again. The German Federal Office for Information Security (Bundesamt für Sicherheit in der Informationstechnik) advises accordingly against holding large sums in a wallet on a PC or smartphone, and in favour of keeping several backups.

Where the finder stops

Six questions are a rough sorting, not a security audit. The finder does not know your device, knows nothing about how you live and cannot judge whether a provider holds a licence under the European regulation on markets in crypto-assets. It names no makers, no trading venues and no apps, because any recommendation depends on the individual case and because products age faster than principles. Special cases stay outside as well: shared custody with several signatures, arrangements for relatives after a death, custody inside a business. And finally, no form of custody protects against the most common damage of all, namely somebody willingly transferring money or typing in a word list because they were asked to. Against that route only suspicion helps.

Frequently asked questions

Sources