Lesson 1 — The custody decision: when self-custody is right and when it isn't

There are four real custody choices, not two. The first is fully custodial — a regulated exchange or a custody firm holds the keys, you hold a claim. The second is single-signature hot wallet — a phone or browser-extension wallet where you hold the keys but they sit on an internet-connected device. The third is single-signature hardware wallet — you hold the keys, signing happens on a dedicated device that never exposes them. The fourth is multi-signature, where several keys (held by different devices, sometimes different people or services) must approve a transaction. Each has a different threat profile, a different operational cost, and a different failure mode.

Custodial is the right answer surprisingly often. You want to hold a few hundred dollars to learn on, you want to actively trade, you have no operational infrastructure, you live in a jurisdiction where self-custody creates legal exposure, or you simply value the recovery flow when something goes wrong. Custodial means you trust the custodian's security and solvency. The risk is that the custodian fails, gets hacked, or is compelled by court order. The trade-off is that they handle the parts of security most people are bad at.

Single-signature hot wallet is the right answer for day-to-day spending, for interacting with applications, and for amounts you can afford to lose. The risk is that anything that gets onto your device — a malicious extension, a sandbox-escape exploit, a phishing site that drains via an approval — also has access. The trade-off is convenience: you can sign anything in a second.

Single-signature hardware wallet is the right answer for the bulk of long-term holdings that you don't move often. The risk is concentrated in three places: the seed phrase (whoever has it owns the funds), the supply chain that delivered the device to you, and your own ability to follow the procedure correctly when restoring. The trade-off is friction — every transaction takes a deliberate, physical action.

Multi-signature is the right answer once your holdings cross a threshold where any single point of failure is unacceptable, or where you have a co-signer you need to involve. The risk shifts from 'lose one secret' to 'lose the wallet descriptor that ties all the keys together.' The trade-off is operational complexity: signing is a coordinated round-trip across devices, and recovery is harder if you don't keep good records.

The mistake is treating the custody decision as a one-time ideological choice. The right answer for most users is a portfolio of custody arrangements: a small custodial balance for active use, a hot wallet for interaction, a hardware wallet for medium-term holdings, and (eventually) multisig for the long-term bulk. Each layer's failure is contained.