Part Four · How do I buy it, keep it, and use it? · Chapter 10
Keeping it safe
“Your keys, your bitcoin. Not your keys, not your bitcoin.”Andreas M. Antonopoulos, a line he has repeated since at least 2016.This page in the book: yourbitcoinbasics.com/ch10
Have the book open?Everything this chapter points to is here: the activities, a model answer for Check yourself, current numbers, and the sources with links.No book yet?
Today’s numbers
Bitcoin, right now
Bitcoin that existabout 20.1 millionof 21,000,000 that will ever exist
21M
95.67% issued. The last tiny fraction arrives around the year 2140.Block heightabout 969,000pages in the ledger since January 3, 2009
A new page about every 10 minutes.
Next halvingabout 81,000blocks to go
61% of the way through this four-year cycle.
Expected around spring 2028. New bitcoin per block then drops from 3.125 to 1.5625.
One dollar buysabout 1,200sats today
$20about 24,000$100about 120,000
One bitcoin is 100,000,000 sats, so nobody has to buy a whole one.No price chart here on purpose. Chapter 6 covers price.
What you will be able to do
By the end of Chapter 10
01Explain what “not your keys, not your coins” means, and tell the story of one exchange collapse that proves it.
02Place yourself on the custody ladder, say what each rung protects against and what it asks of you, and explain why the top rung is not the right place for everyone.
03Write down and store a seed phrase so it survives fire, theft, and forgetfulness, and list the things never to do with it.
Try it
Do it on your phone or laptop
- Back up and restore an empty wallet. Fifteen minutes on your phone, and no money involved.
- Install a self-custody phone wallet. Phoenix, Muun and BlueWallet were named above, and the chapter page lists others. Choose one that shows you a seed phrase during setup.
- Set up a new wallet. When the words appear, write them on paper, numbered. Do not screenshot them, even now, even with nothing in it. Practice the habit.
- Find the wallet’s receive address and copy its first six characters onto the same paper.
- Delete the app. Yes, really. There is nothing in it.
- Reinstall it, choose “restore” or “import,” and type in your 12 words.
- What a restore screen looks like, drawn from a typical phone wallet: numbered boxes for the words, in order, with the app checking each word against the list as you type. Yours will differ in layout and not in parts.
- Find the receive address again and compare the first six characters. If they match, you have just done what Mt. Gox’s customers couldn't do. You rebuilt access from words alone.
- Now decide what to do with the paper. Keep it as your first real backup, or tear it up because you will make a fresh one later. Either way, notice how it feels in your hands.
The restore drill
Empty wallet only. No money involved. Tick each step as you do it. Never type your words into this page or any website. They go only into the wallet app on your own phone.
Do the first six characters match what is on your paper?
You just rebuilt access from words alone, which is what Mt. Gox’s customers could not do. Now decide about the paper: keep it as your first real backup, or tear it up because you will make a fresh one before you put money in.
Do not put money in yet. Check the words against your paper, in order, one at a time. Some wallets show a new address every time you open the receive screen; if yours does, look for a list of addresses and compare the first one. If it still does not match, delete the app and do the drill again from the start. A drill that fails with nothing in it is the cheapest lesson you will ever get.
Coming to this page: Screenshots of the backup and restore in each wallet named in the chapter.
Check yourself
Did it stick?
Rate yourself: yes, mostly, or not yet. Not yet means reread that section. It does not mean you failed.
- I can explain “not your keys, not your coins” in one breath and back it with Mt. Gox or FTX.
- I can name the four rungs of the custody ladder and say what each protects against.
- I can say who, if anyone, pays me back if bitcoin is stolen from each rung, and why FDIC insurance does not apply.
- I can explain why the top rung is not the right place for everyone, and what a fund or an exchange trades away.
- I can say which rung I am on and what would move me up the ladder.
- I can describe how to write down and store a seed phrase, and list four things never to do with it.
- I can explain, in plain words, why a device that was never online could still lose its keys in 2026.
Scenario
Your brother-in-law says, “I leave mine on the exchange. It’s insured, and I’d just lose the words anyway.” What do you say?
Say your answer out loud first. Then open the model response.
Show the model response
“Insured” usually means the company insures itself against some kinds of theft from its own systems. It is not FDIC insurance, which does not cover bitcoin, and it is not a promise to make you whole. If an exchange freezes withdrawals or fails, you become a creditor in a bankruptcy, the way FTX customers did in 2022. Holding your own keys is not for everyone. If you do it, the words go on paper, in two safe places, and you practice a restore with an empty wallet first, so losing them is not a guess.
A fair objection
“Isn’t self-custody just moving the risk from a company to me? I am not a security expert. A company at least has one.”
My answer
Yes, in part. Self-custody moves the risk to you, and for a lot of people the truth is that they are the bigger risk. More bitcoin has been lost to mistakes than to thieves and bankrupt exchanges combined, and I said so under Worth repeating.
Two things are still true. First, the company’s expert protects the company. When FTX failed, its security team was fine. Its customers were creditors. A well-run exchange reduces the chance of a hack, and does nothing about the chance of a freeze, a bad loan or a fraud, because those come from the company itself. Second, the ladder exists because “company or me” is a false choice. A phone wallet with a tested paper backup is not expert work. It is the level of care people already give to a passport. Collaborative custody exists for people who want their own keys with someone on call. And an audited custodian, chosen with open eyes for a small amount, is a defensible rung for the person who knows they will lose the paper. In 2026 the objection gained a second argument: the 2026 stories in this chapter showed that careful self-custody can still fail through someone else’s mistake. That is why the first rung now includes a fund as well as an exchange.
The chapter does not ask you to become an expert. It asks you to know which promise you are holding, and from whom.
Want a second opinion with sources? The Bitcoin Evidence Base answers claims like this one.
Don’t confuse
a seed phrase vs a passwordA password can be reset; a seed phrase cannot. Anyone with your 12 words owns everything.
a hot wallet vs a cold walletA hot wallet lives on an internet-connected phone; a cold wallet is a hardware device kept offline.
a seed phrase vs a PINthe 12 words rebuild every key in the wallet and can never be changed; the PIN only unlocks the app on one device and can be reset. The words are the money. The PIN is the door.
Go deeper
Watch, read, explore
Watch · 5 min
Hardware wallets are riskier than you think
Jack Mallers on the hidden trust in a device’s supply chain. Pair it with the chapter’s tables.The Jack Mallers ShowRead · BrowseBitcoin security resources
A long, careful reading list on keys and backups.lopp.netProducts and services named are examples, not recommendations. I have no financial relationship with any of them.
Words from this chapter
Sources
The 17 notes for Chapter 10
- Mt. Gox Co., Ltd., petition for civil rehabilitation, Tokyo District Court, February 28, 2014, reporting a loss of about 750,000 customer bitcoin and 100,000 of its own; withdrawals halted February 7, 2014 (Duane Morris LLP, client alert, March 2014, duanemorris.com, retrieved September 2026; CoinDesk, “Mt. Gox Files for Bankruptcy,” February 28, 2014, coindesk.com, retrieved September 2026). Recovery of about 200,000 coins in an old-format wallet, confirmed March 7, 2014 and announced March 20, 2014 (CNBC, “Mt.Gox says it found 200,000 bitcoins in ‘forgotten’ wallet,” March 20, 2014, cnbc.com, retrieved September 2026). Share of trading: about 70% of bitcoin transactions in 2013 (Stanford Review, “What happened at MtGox?,” April 22, 2014, stanfordreview.org; CoinDesk, “The Legacy of Mt. Gox,” May 4, 2023, coindesk.com; both retrieved September 2026). Repayments: Mt. Gox rehabilitation trustee Nobuaki Kobayashi, “Notice regarding Commencement of Repayments in Bitcoin and Bitcoin Cash,” June 24, 2024, and repayment progress notices July and August 2024, mtgox.com, retrieved September 2026; CoinDesk, “Mt. Gox to Begin Repayments in July,” June 24, 2024, coindesk.com, retrieved September 2026.
- CNBC, “Bitcoin falls below $200, making some investors worry about downward spiral,” January 14, 2015, cnbc.com, retrieved September 2026 (2013 top of about $1,150; January 14, 2015 low of about $170); Federal Reserve Bank of St. Louis, FRED series CBBTCUSD (Coinbase bitcoin price), daily closes of $204 on January 15, 2015 and $199 on January 16, 2015, fred.stlouisfed.org, retrieved September 2026.
- FTX Trading Ltd. and affiliates, voluntary Chapter 11 petitions, U.S. Bankruptcy Court for the District of Delaware, November 11, 2022; John J. Ray III, written testimony before the House Financial Services Committee, December 13, 2022 (commingling of FTX.com customer assets with Alameda Research); U.S. Attorney’s Office, Southern District of New York, press release on the sentencing of Samuel Bankman-Fried, March 28, 2024, justice.gov, retrieved September 2026 (“stealing over $8 billion of his customers’ money”). Bahamas headquarters: CoinDesk, September 27, 2022, coindesk.com, retrieved September 2026. FTX Arena naming rights (Miami, 2021, 19 years, $135 million) and Bahamas base: NPR, November 24, 2022, npr.org, retrieved September 2026. Super Bowl LVI commercial with Larry David, February 2022, and Tom Brady endorsement: CBS News, cbsnews.com, retrieved September 2026.
- United States v. Bankman-Fried, U.S. District Court, Southern District of New York; U.S. Attorney’s Office, Southern District of New York, statement on the conviction of Samuel Bankman-Fried on seven counts, November 2, 2023, and press release on his sentencing to 25 years in prison, March 28, 2024, justice.gov, retrieved September 2026.
- FTX debtors, proposed valuation of customer claims at petition-date prices, filed December 27, 2023, U.S. Bankruptcy Court for the District of Delaware, setting bitcoin at $16,871 as of November 11, 2022 (Bitcoin.com News, December 28, 2023, news.bitcoin.com, retrieved September 2026; Cointelegraph, “FTX debtors propose $16,871 Bitcoin price for creditor claims,” December 2023, cointelegraph.com, retrieved September 2026). Plan of reorganization confirmed October 7, 2024 (The National, October 12, 2024, thenationalnews.com, retrieved September 2026).
- Voyager Digital, Chapter 11 petition, July 5, 2022; Celsius Network, Chapter 11 petition, July 13, 2022; BlockFi, Chapter 11 petition, November 28, 2022 (American Bar Association, Business Law Today, “The Crypto Bankruptcy Wave,” March 2023, americanbar.org, retrieved September 2026). Coinbase data breach: Coinbase Global, Form 8-K, May 14, 2025, sec.gov, and Help Net Security, “Coinbase suffers data breach, gets extorted (but won’t pay),” May 15, 2025, helpnetsecurity.com, retrieved October 2026 (support contractors bribed for customer names, addresses and account data; Coinbase refused a $20 million ransom).
- Ontario Securities Commission, QuadrigaCX: A Review by Staff of the Ontario Securities Commission, June 2020, and OSC news release, “OSC publishes investigative report of QuadrigaCX,” June 2020, osc.ca, retrieved September 2026 (Gerald Cotten died in India in December 2018; the exchange collapsed in early 2019; the OSC found about $115 million of the $169 million shortfall came from Cotten’s fraudulent trading rather than lost passwords).
- Blockstream Store, Jade $67 to $79, Jade Core $99, Jade Plus $149 to $169, store.blockstream.com, retrieved September 2026; Trezor Safe 3 $79, Safe 5 $169, Safe 7 $249 (BitDegree comparison, updated September 29, 2026, bitdegree.org; bitcoins.tools, March 2026); Ledger Nano S Plus $79, Nano X $149, Nano Gen5 $179, Flex $249, Stax $399 (Coin Bureau, Ledger review, June 24, 2026, coinbureau.com, retrieved September 2026). Trezor and Ledger store pages load prices dynamically and could not be captured directly.
- Palatinus, Rusnak, Voisine and Bowe, “Mnemonic code for generating deterministic keys,” BIP-39, 2013.
- The manufacturer’s own security disclosure and technical write-up, July 30, 2026, on its website and blog, retrieved September 2026 (flaw introduced March 2021 with a firmware update; seed generation fell back to a software random-number routine instead of the hardware generator; effective search space about 40 bits on older models and about 72 bits on newer ones, against 128 intended; seeds made with at least 50 private dice rolls not exposed by this issue alone; updating firmware does not repair an existing seed). Follow-up analysis: TRM Labs, “The Largest Hardware Wallet Exploit of 2026,” August 5, 2026, trmlabs.com, retrieved September 2026. [Stacey: the maker is not named here or in the text, per your rule. The full citation with the company name is in the sources file for the website. Decide whether print should name it.]
- Galaxy Research (Alex Thorn), on-chain tracing of the sweep waves, as reported by TFTC, August 5, 2026, tftc.io (“zero multisig wallets have been identified in any of the high-confidence promoted waves”); Decrypt, August 14, 2026, decrypt.co (more than 5,200 addresses drained, about 1,778 bitcoin confirmed); crypto.news, August 4, 2026; all retrieved September 2026.
- Ledger, security disclosure confirming a hardware implant in devices sold by a reseller, October 2026, ledger.com; Crypto Briefing, “Ledger confirms draining cases linked to CryptoBilis-sold devices,” October 11, 2026 (early estimates of $72 to $93 million from more than 300 wallets, most of it in USDT on Tron; the reseller sold in Indonesia, Malaysia, and the Philippines; Ledger’s direct channels unaffected), retrieved October 2026. Updated: CoinDesk, “Ledger says unauthorized implant found in at least one device sold by CryptoBilis,” October 12, 2026 ($86 to $93 million, more than 300 wallets); Bitquery on-chain count through October 16, 2026 (about $102 million across 335 wallets, 78% of it USDT); Help Net Security, “Hidden implant in Ledger hardware wallets linked to $93M theft,” October 12, 2026, helpnetsecurity.com; Bitcoin.com News, “Ledger Confirms Hidden Hardware Implant in Affected User’s Wallet” and “User Exposes Hidden Hardware Implant in European Ledger Wallet,” October 11, 2026, news.bitcoin.com; Protos, October 9, 2026, protos.com; all retrieved October 2026. Ledger customer data leak, December 2020: The Block, “A detailed look at the Ledger data leak,” December 2020, theblock.co, retrieved October 2026. Jack Mallers, “Hardware wallets are riskier than you think,” The Jack Mallers Show, Ask Jack segment, October 2026. Views on ETFs and self-custody (PlanB, Ophelia Snyder, Jameson Lopp, Adam Back): DigitalToday, citing Cointelegraph, October 13, 2026, digitaltoday.co.kr, retrieved October 2026. Who pays you back: FDIC, “Financial Products That Are Not Insured by the FDIC,” fdic.gov, and FDIC, “Advisory to FDIC-Insured Institutions Regarding Deposit Insurance and Dealings with Crypto Companies,” FIL-35-2022, July 29, 2022; SIPC, “What SIPC Protects,” sipc.org; iShares Bitcoin Trust ETF, Form 10-K for 2024, sec.gov (Coinbase Global commercial crime insurance of up to $320 million, shared among Coinbase’s customers and not specific to the Trust); Coinbase, “Insurance and Protections,” coinbase.com/legal/insurance (digital currency not FDIC or SIPC insured; crime policy excludes losses from compromised login credentials; USD pass-through FDIC coverage up to $250,000); Coinbase Global, Form 8-K, May 14, 2025 (voluntary reimbursement of eligible retail customers); Bybit hack of about $1.5 billion, February 21, 2025, with customer assets backed from company funds (Reuters, February 2025); Unchained, “Unchained vs AnchorWatch,” unchained.com (Unchained “does not sell consumer-facing custody insurance”; AnchorWatch minimum $250,000, premium 0.40% to 0.80% of insured value a year); No Bullshit Bitcoin, “AnchorWatch Launches in the U.S.,” January 7, 2025, nobsbitcoin.com; Crypto Briefing on Bitkey’s Emergency Exit Kit, 2025, cryptobriefing.com; Office of the Comptroller of the Currency, Interpretive Letter 1183, March 7, 2025, and FDIC, FIL-7-2025, March 28, 2025; all retrieved October 2026.
- Casa, pricing page, Standard plan $250 per year, casa.io, retrieved September 2026; Unchained, pricing page, Personal Vault $250 per year, unchained.com, retrieved September 2026.
- Bitkey (Block, Inc.), “How it works,” bitkey.world, retrieved September 2026 (2-of-3 multisig with one key on the phone, one in the hardware device and one on Bitkey’s server; “No seed phrase”).
- Chainalysis, bitcoin market analysis, June 2020, estimating about 3.7 million bitcoin unmoved for five years or more, about 20% of supply at the time, as reported by Decrypt, “Lost Bitcoin: 3.7 million Bitcoin are probably gone forever,” January 3, 2021, decrypt.co, retrieved September 2026; River Intelligence, “How Much Bitcoin Is Gone Forever?,” September 6, 2023, river.com, retrieved September 2026 (3 to 4 million bitcoin irreversibly lost).
- Howells v Newport City Council [2025] EWHC 22 (Ch), High Court of Justice, Chancery Division, judgment of HHJ Keyser KC, January 9, 2025, dismissing the claim over a hard drive holding the keys to 8,000 bitcoin discarded in August 2013 (Local Government Lawyer, January 10, 2025, localgovernmentlawyer.co.uk; Hausfeld, “Waste not, want not,” 2025, hausfeld.com; both retrieved September 2026).
- Andreas M. Antonopoulos, on Twitter after the August 2016 Bitfinex hack, “Your keys, your bitcoin. Not your keys, not your bitcoin,” as reported by Cointelegraph, “Antonopoulos: Your Keys, Your Bitcoin. Not Your Keys, Not Your Bitcoin,” August 10, 2016, cointelegraph.com, retrieved September 2026.
Found a broken link or a mistake? Write to [BOOK EMAIL] and I will fix it.
Finished the book? Two sentences help a lot.An honest Amazon review is how the next nervous beginner finds it. Say who you are and whether it helped.
Leave a review on Amazon