Bitcoin Self-Custody Checklist: 44 Steps

Self-custody means you — not an exchange, not a bank, not a company — hold the keys to your Bitcoin. It’s the entire point of the protocol. It also puts the backups in your hands: one mistake with your seed phrase (the list of recovery words that backs up your wallet), or one overlooked security practice, can cost you your Bitcoin permanently. Unlike an exchange’s risks, those are risks you can reduce directly, and this checklist shows how.

This checklist covers everything you need to secure your Bitcoin, in 44 steps. It’s organized into six categories: wallet setup, seed backup, security hygiene, privacy practices, inheritance planning, and ongoing maintenance. Work through each item in order. Check them off as you complete them. Revisit this list annually.

Category 1: Wallet Setup

1. Choose a reputable hardware wallet. Your hardware wallet is the foundation of your self-custody setup. Pick a device from an established maker with a screen of its own, so you can check every address and amount there. Two features add assurance: a secure element (a chip built to resist physical attacks) and open-source firmware (the software that runs inside the device) that anyone can audit. Many devices have both and some rely on one; Hardware Wallets Explained weighs the trade-off. See our Hardware Wallet Buying Guide for detailed comparisons of every major device on the market.
2. Buy new, directly from the maker’s own store. Never purchase hardware wallets from third-party sellers on Amazon, eBay, or any marketplace. A device tampered with before it reaches you can steal everything you later put on it, and no seal or authenticity check can catch every hidden modification. If the maker’s store doesn’t deliver to you, use a reseller listed on the maker’s own website, and check our security advisories first: in October 2026 Ledger confirmed a hidden implant that copied the recovery words during setup in a device sold by CryptoBilis, one of its authorised resellers in Southeast Asia.
3. Verify package integrity on arrival. Check the seals, the bag or box, and any serial number against the maker’s description, then run the authenticity check in the maker’s app (Ledger’s Genuine Check, Trezor Suite’s check of the security chip, the BitBoxApp’s attestation check). If anything looks opened or resealed, contact the manufacturer for a replacement. Stop and contact the maker if the device arrives with words already on the backup card, a PIN supplied in the box, or a wallet already set up. How to Set Up a Hardware Wallet lists each maker’s checks.
4. Update firmware before generating your seed. Devices can ship with older firmware (a Trezor ships with none, and Trezor Suite installs it during setup). Connect the device to the manufacturer’s official app and install any firmware update it offers before creating your wallet, so your backup is made by current, fixed software. A Coldcard has no app of its own: set its PIN first (step 6 says how to choose one), then install its firmware from a microSD card, following Coinkite’s setup guide for your model. Before you start, look up your model in our security advisories.
5. Generate your seed phrase on the device. Let the hardware wallet create your seed inside itself, away from your computer. A Ledger shows 24 BIP39 words and a Coldcard lets you choose 12 or 24; Trezor Safe models make a 20-word backup by default (a different standard, SLIP-39), so 20 words there is normal. A BitBox02 makes 24 BIP39 words and by default saves them, unencrypted, to its microSD card: anyone who gets the card can take your Bitcoin, so keep it private and away from the device, and consider writing the words down as well. Both 12 and 24 BIP39 words are safe when the randomness behind them is real; for long-term savings, 24 give a free extra margin. Word count sets the maximum randomness, not the actual randomness: if a Coldcard made your seed, run our two-minute Coldcard check, because a seed made on affected older firmware must be replaced even after a firmware update. Write down every word, numbered, on paper during setup — you’ll add a durable copy in the next section. Seed Phrases Explained covers the formats.
6. Set a strong PIN you’ll remember. Your device asks for it at its own point: a Coldcard or a Ledger asks first, before the seed, so read this step before you start. Use at least 6 digits, or 8 if your device allows it (a BitBox02 asks for a device password instead). Avoid obvious patterns (1234, birth dates, repeated digits). The PIN protects against physical access to your device. After too many wrong tries the device erases itself (a Coldcard stops working for good); with a tested backup, your Bitcoin is safe, because you restore it on a reset or new device.
7. Consider adding a passphrase (25th word) once the basics work. A passphrase creates a completely separate hidden wallet behind your standard wallet, so someone who finds your words can’t reach the funds behind it as long as the passphrase is too strong to guess, and the wallet without the passphrase can hold a believable decoy amount. Pick it long and at random rather than inventing it: anyone with your words can test guesses on their own computer, with no limit on tries. Add it after your words are safely stored and tested, and test the passphrase wallet from your written copy before funding it. If you use one, understand that the passphrase must be backed up separately from the seed phrase — losing either one means losing access to the funds in the passphrase-protected wallet.
8. Test a receive-and-verify cycle. Generate a receive address in your wallet software. Verify, character by character, that the hardware wallet’s own screen shows the same address. Send a small test amount and wait until your wallet software shows it with at least one confirmation.
9. Consider a multisig setup for significant holdings. If you hold more than you’re comfortable securing with a single key, a multisig configuration (a wallet that needs signatures from several keys, such as any 2 of 3) eliminates single points of failure. Use hardware wallets from at least two different manufacturers, and ideally a different manufacturer for each key, so one maker’s flaw reaches only one key (unless two of the brands share firmware code). With only two makers, one of them made two of your keys, which in a 2-of-3 is enough to spend. Store a copy of the wallet descriptor (one line of text recording the threshold, the address type and every key’s extended public key, which wallet software needs to find the coins) with each seed backup: with only two of three seeds, the lost key’s extended public key can’t be recalculated, so you need the descriptor, or another saved copy of the wallet setup, to find your coins. The descriptor can’t spend, but it shows your whole balance, so keep it as private as the seeds. Multisig Wallets Explained shows what to back up.

Category 2: Seed Phrase Backup

10. Transfer your seed phrase to a metal backup. Paper degrades, burns, and dissolves in water. Metal seed storage plates (stamped or engraved stainless steel or titanium) survive house fires, floods, and decades of storage. The design matters as much as the metal: in independent stress tests, some designs lose or shift their parts in heat or under crushing, and aluminium melts too close to house-fire temperatures. Seed Phrase Storage compares the main designs. See our metal seed backup guide for product comparisons, stress-test results and recommendations.
11. Store the metal backup in a secure, fireproof location. A home safe (fire-rated for at least 1 hour), a bank safe deposit box, or a dedicated secure storage facility. The location should protect against fire, flood, theft, and unauthorized access. Keep it away from your hardware wallet, so one theft or fire can’t take both, and label nothing “bitcoin”.
12. Create a geographically distributed backup. Don’t store all copies of your seed in one building. If your home burns down, you need a backup elsewhere. Consider a second metal plate in a bank safe deposit box, a relative’s safe in another city, or a secure storage facility. Keep two or three complete copies; never cut the words into parts kept in different places, which makes the seed easier to lose or to guess. If you want your backup in pieces, use a scheme built for it: SLIP-39 shares or multisig.
13. Decide what happens to the setup paper. Once your metal backup is made and tested, the paper from the initial setup either becomes one of your two or three complete copies, sealed in a tamper-evident bag somewhere dry, or you destroy it. Paper is the weakest form of seed storage, and every copy beyond the ones you planned is one more that someone who shouldn’t have it could find.
14. Test recovery from your backup before adding savings. This is the step most people skip, and it’s the most important. Start with your device’s built-in backup check (Trezor’s Check backup, Ledger’s Recovery Check app, or a temporary seed on a Coldcard Mk4 or later): you type the words from your metal or paper backup on the device, and it tells you whether they match, without erasing anything. On a Trezor Model One, the standard check has you type the words on the computer instead, so choose Advanced recovery there: the computer never learns your words. On a BitBox02, choose Show recovery words in the BitBoxApp and answer the device’s word check from your written copy; its Check backup option only tests the microSD card. Only after that passes, you can also do a full restore on a second hardware wallet that accepts your backup type, or reset yours and restore, and check that the same first receive address and your test payment appear. On a Coldcard the reset is Destroy Seed (Advanced/Tools, then Danger Zone, then Seed Functions): your PIN stays, and you restore with Import Existing. Destroy Seed also erases the Coldcard’s settings, multisig wallets and Trick PINs, and only a Coldcard backup file brings those back, so once you have set any of them up, keep to the temporary-seed check. Nuke Device, in the same Danger Zone menu, makes the Coldcard unusable for good. Never wipe your only device before the built-in check passes: if the backup were wrong, you would lock yourself out. If it doesn’t match, keep the device as it is and find the mistake while you still have access to your funds; if you can’t find it, move the funds to a new wallet with a fresh, checked backup. Our backup test guide covers each brand.
15. If using a passphrase, back it up separately. Your passphrase must be stored in a different location than every copy of your seed phrase. Anyone who has both your seed and passphrase can access your hidden wallet. Store the passphrase in a second safe or another secure location, and record where it is only on the sealed access sheet of your inheritance plan (item 31).
16. Document the derivation path. Most modern wallets use standard derivation paths, the route a wallet follows from your seed to your addresses (m/84'/0'/0' for native SegWit), but non-standard paths exist. Next to your seed backup, note which wallet made the words, which standard they use (BIP39 or SLIP-39), the address type and any non-standard path, so that future recovery isn’t complicated by guessing which path your wallet used. For multisig and timelock wallets, the wallet descriptor does this job and is essential (items 9 and 33). Keep the passphrase off this note. Bitcoin Address Types and Derivation Paths explains what to record.

Category 3: Security Hygiene

17. Never enter your seed phrase on a computer or phone. Your seed phrase should only ever exist on your hardware wallet and on your physical backup. Never type it into a website, app, email, text message, cloud document, password manager, or any digital device. Any software that asks for your seed phrase is either your hardware wallet’s recovery process or a scam.
18. Never photograph or screenshot your seed phrase. Photos sync to cloud services (iCloud, Google Photos) automatically. Screenshots are stored in predictable locations. Both are accessible to malware, hackers, and anyone with access to your account. Keep your seed phrase strictly offline and physical.
19. Keep the computer you use for Bitcoin clean (a dedicated one is better). With a hardware wallet, your keys never touch the computer, so malware there goes after what you see and install: fake wallet apps, fake update prompts and swapped addresses. Keep the operating system updated, install wallet software only from the project’s official site after verifying the download, and avoid browser extensions you don’t need. A dedicated computer, or a separate user account used only for Bitcoin, narrows what malware can reach.
20. Verify addresses on the hardware wallet screen before sending. Always confirm the receiving address on your hardware wallet’s physical display before approving a transaction. A compromised computer can display one address while substituting another in the actual transaction. The hardware wallet screen is your ground truth. Compare the address it shows with the recipient’s original (on their screen, their invoice, or read aloud), not with your monitor or clipboard: clipboard malware can swap the address before the device ever sees it. If the address on the device doesn’t match, reject the transaction. The Scams That Empty Self-Custody Wallets shows how address swaps work.
21. Enable 2FA on all exchange accounts used for buying. If you use an exchange to purchase Bitcoin before withdrawing to your hardware wallet, secure that exchange account with two-factor authentication (2FA, a second proof of identity besides your password) from a hardware security key, such as a YubiKey. SMS-based 2FA is vulnerable to SIM swap attacks, in which an attacker takes over your phone number. Authenticator apps are acceptable but not ideal. Keep as little on the exchange as you can, for as short a time as you can; Your First Withdrawal shows how to move your coins to your hardware wallet safely.
22. Keep your hardware wallet firmware updated. Check for firmware updates quarterly. Install them promptly. Outdated firmware may contain known vulnerabilities. Install updates only through the manufacturer’s own app or from a file you verified, and check our security advisories for your model.
23. Be skeptical of unsolicited messages about your Bitcoin. Phishing attacks targeting Bitcoin holders are increasingly sophisticated, including AI-generated emails and messages that impersonate wallet manufacturers, exchanges, and support teams. No legitimate company will ever ask for your seed phrase. No “support agent” needs your recovery words. The Scams That Empty Self-Custody Wallets shows how each of these tricks works.
24. Physically secure your hardware wallet. Treat your hardware wallet like cash. Don’t leave it in plain sight. Travel without the keys to your savings, and carry only spending money. A decoy can help if you’re coerced: a passphrase wallet, or a duress PIN on devices such as Coldcard that opens a separate wallet. It works only if its balance is believable for what an attacker thinks you hold, and attackers know these features exist, so making large sums slow to move (multisig keys in separate places) matters more. If you are ever threatened, hand over what is asked: your life comes first. Physical Security, Coercion and Keeping Quiet explains how to set this up.

Category 4: Privacy Practices

25. Never reuse Bitcoin addresses. Each time you receive Bitcoin, generate a new address. Address reuse links transactions together on the blockchain, making it trivial for chain analysis firms to track your holdings and spending patterns. Modern wallet apps show a fresh address each time you click Receive — use it.
26. Run your own Bitcoin node. When you use someone else’s node (including your wallet provider’s default node), you’re showing that third party your addresses and transaction history. Running your own node keeps your addresses and balance off other people’s servers. Connect your wallet software (Sparrow or Electrum, for example) to your own Bitcoin Core node or Electrum server instead of a public server. Setting Up Your Bitcoin Node walks through it.
27. Put your node and wallet on Tor. Even with your own node, the peers it connects to see your home IP address, and because your node is the first to announce the transactions you send, an observer connected to many nodes can guess where they started. Tor, a network of volunteer-run relays, hides your IP address from those peers. The common home node platforms don’t make Tor the only route by default: as of November 2026, Umbrel’s Bitcoin Node app connects to peers over clearnet (the ordinary internet), Tor and I2P (a second anonymity network), and StartOS uses every network it can reach. Set your node’s outgoing connections to Tor (and I2P if you like) with clearnet switched off, have your wallet reach your node through its .onion address when you’re away from home, and check the peer list again after every update. If your node runs Bitcoin Core 32.1 or later, you can also turn on private broadcast, an experimental setting that sends each transaction through Tor or I2P over its own short-lived connections. It covers transactions that Sparrow or an Electrum server such as Electrs or Fulcrum hands to your node, not those from Bitcoin Core’s built-in wallet. Network Privacy: Tor, VPNs and Your Own Node shows the settings for Sparrow, Umbrel, StartOS and Bitcoin Core.
28. Practice UTXO management. Understand which UTXOs (unspent transaction outputs, the separate coins your wallet holds) have different privacy levels. Bitcoin bought with KYC (“know your customer”, the identity check regulated exchanges carry out) is linked to your identity. Bitcoin bought without it isn’t tied to a verified ID, but the seller and your payment method can still link it to you. Spending these together in a single transaction links them permanently. Label every coin by its source when it arrives, and use coin control in Sparrow Wallet (its UTXOs tab and Send Selected button) or similar software to choose by hand which coins pay. UTXO Management and Coin Control walks through it step by step.
29. Consider collaborative privacy transactions for privacy-critical spends. A CoinJoin is one transaction built by several people in which many outputs come in matching amounts, so an observer can’t tell which of the matching outputs is yours, though change, timing or outside information can still narrow it down; nobody else ever holds your coins. The tools have changed a lot: US authorities seized Samourai Wallet’s servers, and with them its Whirlpool coordinator, in April 2024; zkSNACKs switched off Wasabi’s original coordinator on 1 June 2024; and the original JoinMarket software was announced as archived in April 2026. Its page now says “DO NOT USE THIS CODE”, and in every release that includes PayJoin (v0.7.0 to v0.9.12), sending a PayJoin payment can lose the full value of the coins you spend. If you still have a wallet in it, never send a PayJoin with it, and move the wallet to JoinMarket NG (our CoinJoin lesson links its migration guide). As of November 2026, the options that still work are Wasabi with an independent coordinator you choose, Ginger Wallet, Ashigaru (an independent relaunch of the Whirlpool design on its own coordinator, with an entry fee of 5% of the pool size) and JoinMarket NG, an independent reimplementation of the JoinMarket protocol that joins the same market (Jam 2.0, a web interface that runs on it, is in beta). A coordinator, the server that organises the rounds in most of these tools (JoinMarket NG has none), can’t steal your coins, but it can stop rounds and may learn which outputs are yours. For small amounts, or coins going back to an exchange that knows you, CoinJoin is rarely worth its cost, and the privacy is kept only if you spend each mixed coin on its own. PayJoin (BIP78) is a lighter step that other wallets still support: the person you pay adds a coin of their own, so an ordinary-looking payment breaks the common-input-ownership heuristic, the assumption that all the coins spent in one transaction belong to one person. Our CoinJoin lesson compares the tools, their costs and trade-offs in a dated table; check it, and the project’s own site, before you use one.
30. Don’t publicly disclose your Bitcoin holdings. Announcing how much Bitcoin you own — on social media, in person, or in online forums — makes you a target for physical attacks (“$5 wrench attacks”, where someone forces you to hand over your coins), phishing campaigns, and social engineering. Practice operational security. Don’t talk about specific amounts.

Category 5: Inheritance Planning

31. Create a written inheritance plan. Document how your heirs should access your Bitcoin after your death, or if you’re alive but can no longer manage it. Split it into two documents. A letter of instructions says what exists, whom to call, the wallet software to use, where the access sheet is held, and step-by-step recovery instructions for someone who has never used Bitcoin; it contains no secrets. A sealed access sheet, stored somewhere else, says where each seed backup and device is, the PINs, and where the passphrase is if you use one. Never write the seed words in either. Bitcoin Inheritance Planning includes a sample letter. See our complete guide to seed phrase inheritance and dead man’s switch options for detailed methods.
32. Inform your executor that Bitcoin exists. Your estate executor (or a trusted family member) needs to know three things: that you own Bitcoin, that a recovery plan exists, and where to find the recovery instructions. They don’t need the seed phrase — just enough information to locate your plan.
33. Consider a dead man’s switch for trustless inheritance. Tools like Liana wallet use Bitcoin timelocks to add a recovery path that opens only after a delay, counted from when each coin arrived in the wallet. If you stop moving your coins (because you died or became incapacitated), your designated heir’s recovery key becomes usable once that delay has passed. Your heir will also need the wallet descriptor, not just the key. No third party involved. See our multisig inheritance planning guide for advanced setups.
34. Test your inheritance plan. Have someone unfamiliar with your setup attempt to follow your written instructions and recover a small test wallet. If they can’t do it, your plan has gaps that need to be fixed while you’re alive.
35. Review and update annually. Your inheritance plan needs updates when you add new wallets, change your storage setup, move locations, or when family circumstances change (marriage, divorce, new children). Set an annual calendar reminder.

Category 6: Ongoing Maintenance

36. Check firmware updates quarterly. Set a recurring reminder to check for hardware wallet firmware updates every three months. Security patches are released periodically, and running outdated firmware is a preventable risk.
37. Verify your seed backup annually. Once a year, physically inspect your metal seed backup for corrosion, damage, or readability issues. If you can’t read every word clearly, create a new backup while you still have access to the wallet.
38. Review your UTXO set periodically. As you accumulate Bitcoin over time, your wallet may contain many small UTXOs that are expensive to spend individually. During periods of low network fees, consider consolidating small UTXOs — but be mindful of the privacy implications of consolidation (it links UTXOs together on-chain). Combine only coins from the same source, such as exchange coins with exchange coins, and never consolidate mixed coins; the coin control lesson explains when it pays.
39. Monitor your wallet software for updates. Keep Sparrow Wallet, Electrum, or whatever companion software you use up to date. Software updates often include security fixes, new hardware wallet support, and improved privacy features. Verify each download before you install it.
40. Stay informed about security threats. Follow reputable sources like Bitcoin Optech, hardware wallet manufacturer blogs, and Bitcoin-focused security researchers; our security advisories page lists recent flaws with what to do. New attack vectors are discovered periodically (like Dark Skippy, in which malicious firmware leaks your seed hidden inside ordinary signatures), and staying informed helps you evaluate whether your setup needs changes.
41. Test recovery from your backup annually. Once a year, run your device’s built-in backup check, or wipe a spare hardware wallet that accepts your backup type and recover it from your seed backup (a Trezor 20-word backup needs another Trezor or a SLIP-39 wallet). Add your passphrase if you use one, select the same address type, and confirm that the addresses and balance match. A word check covers only the words, so if you use a passphrase, also reopen the passphrase wallet from its written copy and confirm that it shows the same first receiving address as before. Type the words only on the hardware wallet, never into a computer or phone. This catches backup errors, hardware degradation, and firmware compatibility issues before they become critical.
42. Refresh timelocks if using a dead man’s switch. If you use Liana wallet or any timelock-based inheritance solution, refreshing the timelock is a required maintenance task: refresh whenever the wallet says a refresh is due, before each coin’s delay runs out. A delay counted from when a coin arrived can be at most 65,535 blocks, about 15 months, so even the longest delay needs a refresh at least that often. Missing a refresh deadline means your recovery path activates prematurely, while you’re still alive.
43. Re-evaluate your security model as your holdings grow. The security appropriate for $1,000 in Bitcoin is not the same as what’s appropriate for $100,000 or $1,000,000. As your holdings grow, consider upgrading from singlesig to multisig, adding geographic distribution, or using a collaborative custody service, which holds one of your multisig keys to help you recover and in exchange sees your whole wallet (Multisig in Practice compares them).
44. Maintain a relationship with the Bitcoin community. Self-custody means you’re your own bank, but it doesn’t mean you’re alone. Local Bitcoin meetups, online communities, and educational resources provide valuable support. Security practices evolve, and staying connected helps you keep up.

The Complete Checklist Summary

Frequently Asked Questions