Your Bitcoin Sovereignty Plan: Putting Everything Together

Bitcoin self custody isn’t one decision; it’s a set of habits and tools that build on each other. Across five courses you’ve learned how Bitcoin works, how to hold your own keys, the economics behind it and how to run your own infrastructure. In this course you learned to keep your coins private, to check the software you install and hide your connection, and to keep your savings safe for the rest of your life and beyond it.

“Not your keys, not your coins” is the starting point, not the destination. This lesson, Lesson 5.11, recaps the ten lessons of Course 5, then turns everything from all five courses into a plan you can act on: what to do first, what to do next, and how to check yourself once a year. It ends with ten questions. If an answer feels shaky, the link takes you back to the lesson: mastery comes from practice, not one read-through.

Course 5 in Review

The ten lessons fall into four parts: how you’re tracked and the everyday habit that stops most of it, the software and connections you rely on, getting coins without an exchange record of your name and breaking links that already exist, and keeping your savings safe for life.

Part 1: How You’re Tracked, and the Everyday Fix

Lesson 5.1 — Bitcoin Privacy: Why It Matters and How Chain Analysis Works
Bitcoin is pseudonymous, not anonymous: every transaction is public, and once one of your addresses is tied to your name, analysts can read much of the rest. Their main tools are the common-input-ownership heuristic (coins spent together are assumed to have one owner), change detection, timing and amounts, and above all the records of exchanges that checked your ID. Your threat model, a plain answer to “who might want to know, and what could they do with it?”, decides which defences are worth the effort. A balance linked to your name is a physical risk too.

Lesson 5.2 — UTXO Management and Coin Control
Your wallet holds separate coins (UTXOs), each with its own public history. Label every coin when it arrives, choose coins by hand (“Send Selected” in Sparrow), and never spend coins of different privacy levels together: the result is only as private as the least private coin. Consolidate only coins from the same source, and only when fees are near the floor. Fees depend on a transaction’s size, so fewer inputs mean cheaper payments, and a stuck payment can be bumped with RBF or CPFP.

Part 2: Your Software and Your Connection

Lesson 5.3 — How to Verify Bitcoin Software Before You Install It
A checksum proves your copy matches the list the developers published; a signature proves the developers published that list. Do both, with signing keys you fetched from somewhere other than the download and whose fingerprint you confirmed in two places. You checked Bitcoin Core, signed by several builders who each rebuilt it and got identical files (reproducible builds), then Sparrow, StartOS’s signed images and Umbrel’s checksum and timestamp, and learned to read every result, from the normal “not certified” warning to a check that never looked at your file. Verification proves who published a file, not that its code is safe.

Lesson 5.4 — Network Privacy: Tor, VPNs and Your Own Node
Every balance check and every payment reaches some computer along with your IP address. Your own node keeps your addresses off strangers’ servers; Tor keeps your IP address from the servers and peers you connect to, because no single relay sees both who you are and where you go. A VPN gives one company both. You put Sparrow and a home node on Tor, met private broadcast (on Bitcoin Core 32.1 or later), learned to check the peer list instead of trusting a switch, and saw what a Lightning service provider and a BOLT 11 invoice reveal about you.

Part 3: Private Coins

Lesson 5.5 — Buying Bitcoin Without KYC
Buying without an identity check keeps your name out of exchange records, though a seller you pay by bank transfer still sees it and usually knows where the coins went. If you own no bitcoin yet, start small on Bisq Easy (no deposit and no trading fee, but you pay first and rely on the seller’s reputation) or HodlHodl (the seller’s bitcoin sits in escrow before you pay); RoboSats and Bisq 1 ask both sides for a deposit. Receive on-chain payouts to a fresh address and label the coin “no-KYC” (RoboSats usually pays a Lightning invoice instead), and expect a premium of a few percent, or 5–15% on Bisq Easy. In person, hand over cash only after the first confirmation.

Lesson 5.6 — CoinJoin in 2026: How Bitcoin Mixing Works
A CoinJoin is one transaction built by several people, with many outputs in matching amounts, so outsiders can’t tell which of those outputs is yours, though change, timing or outside information can narrow it down; nobody ever holds your coins. A coordinator can stop rounds and may learn which outputs are yours, but it can’t steal. As of November 2026 the working tools are Wasabi with an independent coordinator, Ginger, Ashigaru and JoinMarket NG; the original JoinMarket software is archived and unsafe. Count the cost first, and spend each mixed coin on its own. PayJoin is the lighter step: the person you pay adds a coin of their own, so an ordinary-looking payment defeats the common-input rule.

Part 4: Keeping It Safe for Life

Lesson 5.7 — Multisig Wallets Explained
A 2-of-3 wallet survives one lost key and stops a thief who has one key. Every signing device should know the whole wallet, so it can check addresses and change on its own screen. Back up every seed and store a copy of the output descriptor with each one: two seeds can’t recreate the lost key’s xpub, so to find your coins you need the descriptor or another saved copy of the wallet, such as the coordinator’s wallet file or a Coldcard it’s registered on. The descriptor can’t spend, but it shows your whole balance and history, and so do all the xpubs together, so keep them as private as the seeds.

Lesson 5.8 — Multisig in Practice: Sparrow, Nunchuk, Casa and Unchained
Sparrow and Nunchuk’s free tier leave all three keys with you; Casa, Nunchuk’s paid plans and Unchained hold one key to help with recovery, and in exchange they see your whole wallet. With each of them, your own keys can still move your coins without the provider, as long as you’ve kept what recovery needs, starting with the descriptor. You also met signing devices from different makers that work well together, and the setup order: save the descriptor, set the wallet up on every device, check the first address on each screen, and test with a small amount.

Lesson 5.9 — Bitcoin Inheritance Planning
Your heirs need knowledge, access and ability, and your plan should also cover a stretch when you’re alive but unable to act. Split the paperwork: a letter of instructions with no secrets, and a sealed access sheet kept somewhere else; seed words go in neither. Multisig and timelock wallets such as Liana build recovery into the coins themselves, but your heirs will also need the descriptor, and a timelock has to be refreshed before each coin’s delay runs out.

Lesson 5.10 — Physical Security, Coercion and Keeping Quiet
Attackers choose people they believe hold bitcoin, and reported wrench attacks reached a record in 2025. Keep amounts private, keep Bitcoin talk away from your real name, and give companies as little data as you can, because databases leak. Carry only spending money, keep the keys to your savings in more than one place, and make large sums slow to move. A decoy helps only if it’s believable. If you are ever threatened, comply: property can be replaced, you can’t.

Lesson 5.11 — Your Bitcoin Sovereignty Plan (this lesson)
The rest of this page: the five layers of sovereignty, a checklist in order of priority, a scorecard and a maintenance rhythm.

The Complete Sovereignty Stack

Think of sovereignty as five layers. A weak layer undermines the ones above it.

Layer 1: Knowledge (Course 1)

From Bitcoin Fundamentals: what Bitcoin is and the problem it solves, how keys, transactions and blocks work, who enforces the rules, and why the 21 million limit matters. This is what lets you spot scams and judge claims for yourself.

Layer 2: Self-Custody (Course 2)

From Bitcoin Wallets & Self-Custody: you hold your own keys on hardware wallets, protect your seed phrases, move coins off exchanges safely and recognise the scams aimed at people who hold their own keys. The seed phrase is your ultimate backup, and your biggest weakness if it’s mishandled.

Layer 3: Economic Understanding (Course 3)

From Bitcoin Mining & Economics: how mining issues new coins, how halvings cut that issuance, what miners earn, why fees will have to pay for security as the subsidy shrinks, and how ETFs and dollar-cost averaging work. This is what keeps you steady through volatility, and it helps you tell argument from hype: popular price models such as stock-to-flow are disputed, and none of them is a forecast you can rely on.

Layer 4: Infrastructure (Course 4)

From Lightning Network & Bitcoin Nodes: you run your own full node, which checks every block and transaction, and your wallet relies on it instead of trusting someone else’s view. Lightning is there if you need fast, small payments; it’s optional for sovereignty, and if you run a Lightning node, its backups and watchtowers come with it.

Layer 5: Security and Privacy (Course 5)

This course: keep your coins private (chain analysis and how to resist it, coin control, buying without KYC, CoinJoin and PayJoin), check your tools (verified software, your node and wallet on Tor), and keep your savings safe for life (multisig against single points of failure, an inheritance plan so your bitcoin outlives you, and physical security).

Self-Custody Best Practices Checklist

These 15 self custody best practices are grouped into four steps, in order of priority. Finish step 1 before worrying about step 4: losing access hurts far more than leaking privacy.

Step 1: Don’t lose it (do this first)

1. Hardware wallet secured: a strong PIN, a safe place, and current firmware, installed only through the maker’s own app or from a file you verified. Check our security advisories for your model.
2. Seed phrase backed up on durable material (metal survives fire and water) and stored securely. See seed phrase storage.
3. Seed and passphrase apart: if you use a passphrase, it’s stored somewhere other than its seed.
4. Recovery tested: you have restored the wallet from its backup at least once and seen the right addresses. Our backup test guide shows how.
5. Someone knows: at least one trusted person knows you hold bitcoin and where your letter of instructions is (inheritance planning). Nobody beyond them needs to know.

Step 2: Verify it yourself

6. Software verified: before installing wallet software, node software or a node image, you check both the signature on the list of checksums and your file’s checksum against that list. How to Verify Bitcoin Software Before You Install It walks through it, and our guide to verifying a Bitcoin Core download keeps the commands on one page.
7. Your own node: your wallet connects to your own Bitcoin Core or Electrum server, not someone else’s. See Setting Up a Bitcoin Node.
8. Tor on: your node makes its outgoing peer connections over Tor (and I2P if you like) with clearnet switched off, and your wallet reaches your node through its .onion address when you’re away from home. Peers can tie a transaction to your IP address when your node first passes it on, so the node’s own connections matter most; on Bitcoin Core 32.1 or later, private broadcast also hides where your transactions start. Network Privacy: Tor, VPNs and Your Own Node shows the settings for Sparrow, Umbrel, StartOS and Bitcoin Core, and how to check that they worked.

Step 3: Remove single points of failure

9. Multisig above your loss threshold: savings you couldn’t afford to lose sit in a 2-of-3 (or higher) wallet with keys in separate places, on devices from at least two makers and ideally a different maker for each key (Multisig Wallets Explained, Multisig in Practice).
10. Descriptor backed up: a copy of the multisig wallet descriptor is stored with each seed backup, and every signing device knows the wallet (registered on devices that support it). It reveals your balance, so treat it as private: never in a shared folder, and encrypted if you keep a digital copy. If Unchained holds one of your keys, follow its advice on the file instead (Multisig in Practice).
11. Inheritance plan written: a letter of instructions with no secrets, plus a sealed access sheet stored elsewhere. If you use a timelock wallet, the refresh dates are in your calendar.
12. No single point of failure: no single lost device, document or person can cost you your bitcoin, and no single thief can take it. That includes your home and what you carry: neither holds enough keys to spend your savings (physical security).

Step 4: Privacy habits

13. Coins labelled and chosen by hand: every coin is labelled by source, you use coin control, and you never spend exchange coins with private ones or mixed coins with unmixed ones.
14. Holdings kept private: you don’t advertise what you hold, online or in person, you keep Bitcoin talk away from your real name (physical security), and you buy without KYC where it matters to you.
15. Review scheduled: a yearly reminder to check backups, update the inheritance documents and test recovery. Our self-custody checklist gives a structure for it.

The Sovereignty Scorecard

Rate yourself from 1 to 5 in each category: 1 means you haven’t started, 5 means it’s in place, tested and maintained.

Category	What to Evaluate	Your Score (1–5)
Key Management	Hardware wallet security, durable seed backups, passphrase kept apart, multisig where the amount justifies it
Node Operation	Your own full node, your wallet connected to it, software verified before every install and kept up to date
Privacy Practices	Fresh addresses, labels and coin control, exchange coins kept apart, coins bought without KYC where it matters, node and wallet on Tor
Inheritance Planning	A written plan, heirs who know it exists, a tested recovery guide, a current access sheet
Physical Security / OpSec	Your operational security (OpSec, the everyday habits that keep what you hold to yourself): holdings not disclosed, little personal data left with companies, no single place (your home included) and nothing you carry holding enough keys to spend your savings, and three layers sized for coercion: a small spending wallet, a believable decoy if you use one, such as a passphrase wallet, and savings that take hours or days to move (physical security)
Backup Testing	Recovery from seed tested, multisig rebuilt from backups, inheritance dry run done

Reading your score:

• 25–30: a strong setup. Keep it maintained and stay current.
• 18–24: a good base. Work on your lowest categories first.
• 12–17: real gaps. Start with key management and inheritance, which guard against the worst losses.
• Below 12: go back to step 1 of the checklist and work through it in order.

Maintaining Your Setup

Annual Tasks

• Test your backups: use your hardware wallet’s built-in backup check, or restore the seed on a spare hardware wallet, and check you see the right addresses. Never type the seed into a computer or phone; our backup test guide shows both methods.
• Review your inheritance plan: documents current, locations still safe, contacts still right.
• Audit your coins: check labels, and consolidate small coins of the same source while fees are low.
• Check your timelocks: if you use a timelock wallet such as Liana, make sure no coin is close to its recovery date. This yearly look is a check, not the deadline: refresh whenever the wallet says a refresh is due, before each coin’s delay runs out. A delay counted from when a coin arrived can’t be longer than 65,535 blocks, about 15 months, so even the longest delay needs a refresh at least that often, and a delay shorter than a year means refreshing more than once a year.

Quarterly Tasks

• Update software: wallet apps and node software (Bitcoin Core, your Electrum server), after verifying the downloads.
• Check firmware: look for hardware wallet updates from the maker, and install them only through its own app or from a file you verified.
• Check Tor after updates: an update or a restore can quietly bring clearnet back, so look at your node’s peer list again: only Tor (and I2P) peers should appear.
• If you run a Lightning node: check channel health and update the node software.

Ongoing Awareness

• Security notices: watch for flaws in your wallet, devices or node software; our advisories page lists recent ones with what to do.
• Data leaks: if a shop or service you’ve used leaks its customer data, treat unexpected visits, calls and messages about your bitcoin with extra care.
• Protocol changes: follow Bitcoin Core releases and proposals that could affect your setup.
• Fees: keep an eye on the fee market for cheap consolidation windows.

The “Not Your Keys, Not Your Coins” Principle Revisited

When you first met “not your keys, not your coins” in Course 1, and again in Course 2, it was a reason to move bitcoin off exchanges. Five courses later, it means more:

• Verifying for yourself: your own node checks your transactions, and you check the software you run before you install it
• Protecting your privacy with coin control, careful buying and Tor, because what can be seen can be blocked, and a balance that can be seen can make you a target
• Removing single points of failure with multisig, so no single lost device or burgled house ends your savings
• Keeping quiet about what you hold, because cryptography can’t protect you from someone standing in front of you
• Planning beyond your lifetime, so your family can inherit what you built
• Understanding the money well enough to hold steady through uncertainty

Exchange collapses, frozen accounts and closed platforms throughout Bitcoin’s history show this isn’t theory. Sovereignty is practical insurance against third parties that can fail, seize or restrict.

Continuing Your Education

Two concrete next steps:

1. Do step 1 of the checklist this week, starting with a recovery test. It’s the step that prevents the worst outcome.
2. Read Mastering Bitcoin by Andreas M. Antonopoulos and David A. Harding, the standard technical book, which you can read for free on GitHub.

When you build your multisig wallet, our Sparrow multisig tutorial walks through every screen. Privacy tools change fastest of all: before you use one, check it against the dated table in the CoinJoin lesson and on the project’s own site.

Frequently Asked Questions

I’m overwhelmed by the checklist. Where should I start?

With step 1: a hardware wallet with a properly stored seed backup, a recovery test, and one trusted person who knows a plan exists. Those cover the two worst failures: you losing access, and your heirs never finding it. Then move on one item at a time.

Do I really need to run my own node?

It’s the only way to check transactions without trusting anyone. A wallet connected to someone else’s server trusts that server to report your balance correctly, and tells it which addresses are yours. A trusted friend’s node is a reasonable step in between; for significant holdings, your own node is strongly recommended.

How do I know when my setup is “good enough”?

When it fits what you hold and the risks you face. A modest amount on one hardware wallet with a tested seed backup is a sound setup. Generational wealth on that same single-key setup is not. Scale your setup with your holdings.

What’s the single most common mistake Bitcoiners make with self-custody?

We have no reliable statistics, but one of the most common is never testing the backup. A seed you’ve never restored from is a seed you’re hoping works. Test once with a small amount, and again after any change to your setup.

Is it worth paying for a managed multisig service?

For many people, yes. Services such as Casa or Unchained cost little compared with what they protect, reduce the room for mistakes, and help with inheritance. In exchange, they see your whole wallet and you depend on their process, although your own keys can still move your coins without them if you’ve kept the descriptor and what else recovery needs. If you have the skills and the discipline to run your own setup for 10 to 20 years, you can do without; be honest about whether you do.

Check Your Understanding

1. A friend runs a Lightning node, uses CoinJoin and has a beautiful labelling system, but has never restored their wallet from its seed. What should they do first, and why?

Answer

Test the recovery, with the hardware wallet’s built-in backup check or by restoring the written backup onto a spare hardware wallet, never by typing the words into a computer. It’s in step 1 because an untested backup can fail silently, and losing access costs far more than any privacy leak. Privacy habits and Lightning come after the basics work (step 1 of the checklist above; our backup test guide shows both methods).

2. Your Sparrow wallet holds a 0.05 BTC exchange withdrawal and a 0.002 BTC coin you bought on Bisq Easy. You want to pay 0.0015 BTC from the private coin. What do you do, and why not let the wallet choose?

Answer

In the UTXOs tab, freeze the exchange coin, select the Bisq coin, click “Send Selected” and check that the transaction diagram shows that one input before you sign. The wallet doesn’t know where your coins came from: it might pay from the exchange coin, which the exchange can follow to the person you pay, or spend both coins together, and the common-input heuristic would then tie the Bisq coin to your name for good. That’s why every coin gets a label when it arrives (Lesson 5.2, Lesson 5.5).

3. A video tutorial links to “Sparrow 2.5.6” on a file-sharing site and prints the file’s SHA-256 checksum in its description. Your download matches it. Is it safe to install?

Answer

No. A matching checksum only proves your copy is the file that list describes, and here the same person posted both. Download from sparrowwallet.com, import Craig Raw’s key from Keybase, confirm its fingerprint against the one on Sparrow’s download page, and check that GPG reports a “Good signature” on the manifest. Only then check your installer against the manifest. Both checks must pass (Lesson 5.3).

4. A friend says: “I connect Sparrow to a public Electrum server over Tor, so my wallet is private.” What does Tor hide here, and what doesn’t it?

Answer

Tor hides their IP address from the server. The server still receives every address in the wallet, together, so it can link them, add up the balance and read the history; only their own node keeps the addresses at home. Tor also changes nothing on the blockchain, so coin control matters as much as before. Their own node and Tor close different leaks, and they need both (Lesson 5.4).

5. Someone from a local meetup offers to sell you 0.01 BTC for cash. Where do you meet, and when do you hand over the money?

Answer

In a busy public place, never a hotel room or a car park, with someone you trust, carrying only the cash the trade needs. Hand the cash over only once the payment to a fresh address of yours has at least one confirmation, or take it over Lightning, where a payment is final when it arrives. An unconfirmed payment can still be replaced with one that pays the coins back to the sender, and since Bitcoin Core 28.0 nodes accept such replacements by default. Then label the coin “no-KYC”. Trading on a peer-to-peer platform, where you never meet, is safer still (Lesson 5.5, Lesson 5.10).

6. You hold a 0.004 BTC coin withdrawn from an exchange that verified you, and a shop’s payment page offers PayJoin. Which helps more here, CoinJoin or PayJoin, and what does PayJoin leave visible?

Answer

For a coin this small, CoinJoin is hard to justify: it couldn’t even enter Ashigaru’s smallest pool, 0.025 BTC, and small amounts are one of the cases where mixing is rarely worth its cost. If your wallet supports it, the PayJoin adds privacy to a payment you were making anyway: the shop adds a coin of its own, so the common-input rule gives the wrong answer and neither output shows the amount paid. It leaves two things visible: the shop sees your coin and your change, and the exchange can still follow its coin into this payment, where one of the two outputs is your change. PayJoin blurs that trail; only a CoinJoin cuts it. Never send a PayJoin with the original, archived JoinMarket software (Lesson 5.6).

7. You keep your multisig descriptor in a shared family cloud folder “so it’s never lost”, and you’ve pasted the xpub of your single-key spending wallet into a portfolio app. What have you given away?

Answer

Neither can move a single sat, but both show everything. Anyone who opens the folder, or gets into the account, can see every address in the multisig wallet, its balance and its full history, now and in the future; the portfolio app’s operator can see every coin your spending wallet holds and every coin it will receive. That tells strangers what you’re worth, which is a safety problem as well as a privacy one. Keep a copy of the descriptor with each seed backup instead, encrypt any digital copy, and keep xpubs out of third-party services (Lesson 5.1, Lesson 5.7, Lesson 5.10).

8. You hold two of the three keys of an Unchained vault. If Unchained disappeared tomorrow, what would you need to move your coins, and when do you have to get it?

Answer

Your two hardware keys and the wallet configuration file, the descriptor, which you import into Unchained’s open-source Caravan or another coordinator such as Sparrow. You download that file from your vault while your account works, so you need it before Unchained is gone. Unchained keeps a copy for you and recommends that most clients leave the file with it, so your own copy is a choice to make now; if you keep one, store it offline and in a different place from your keys, as Unchained advises. With Casa the same idea applies: save the descriptor and the Sovereign Recovery email while Casa is running, and on its Standard plan keep your phone, because the phone key leaves the app only as an emergency export (Lesson 5.8).

9. You set up Liana with a recovery path of about a year for your partner, and plan to look at it once a year at your annual review. What can go wrong, and how do you prevent it?

Answer

Each coin’s clock starts when it arrives in the wallet. If you refresh late, say after 14 months, the recovery key can already spend the coins whose delay has run out, while you’re still alive. Refresh, by sending the coins to yourself, before each coin’s delay runs out: when Liana says a refresh is due, not only at the yearly review. Each refresh costs a normal network fee, and your partner will need the wallet descriptor as well as the recovery key (Lesson 5.9).

10. Your savings are in a 2-of-3: one key on a hardware wallet at home, one in a safe-deposit box, and one with a co-signing service set to wait 24 hours. Your phone holds a small spending wallet. Someone breaks in and demands your bitcoin. What can they take, and what do you do?

Answer

On the spot, only what moves at once: the phone’s spending wallet, and a decoy if you set one up. Your savings need either a trip to the safe-deposit box or the service’s 24-hour wait, so “I can’t move it right now” is simply true. A delay has limits, since an attacker could try to wait it out, which is why the small layer you can hand over at once matters. Comply, hand over what you can move, and state the facts calmly: property can be replaced, you can’t. Afterwards, get safe and report it, treat every key, PIN and passphrase you revealed as known, move what’s left to a new wallet created on a device the attackers never touched, and ask investigators to keep your name out of the news (Lesson 5.10, Lesson 5.7).

Practical guides

• Bitcoin Self-Custody Checklist: 44 Steps