The Custody Trilemma
Skip to content
Back
If the company that made your wallet disappeared tonight, servers off, app pulled from the store and the team unreachable, could you still move your money tomorrow morning?<br>Most people can't answer this question about their wallet, which is strange, because it's the only question that matters. Everything else: the swaps, the portfolio chart, the yield graphs, is just decoration on top of a single promise: that the money is truly yours .<br>A word that means nothing (anymore)<br>Nearly every wallet you can download today calls itself “self-custodial”.<br>Almost all wallet extensions and exchange apps have adopted this term. Even products that keep a piece of your key material on their servers have started using it.<br>To better understand what it means, we first must make an important distinction.<br>There is a difference between “self-custodial” and “non-custodial”, even though these terms are used seemingly interchangeably in the industry:<br>Self-custodial is defined as a wallet or account where all private keys are managed by the user, and no single external service provider has the ability to censor or prevent the user's transactions at any point.<br>Non-custodial is defined as a wallet or account where the private keys are distributed between the user and an external service provider, with that provider retaining some form of control over the account.<br>The first describes ownership. The second describes a partnership.<br>Since the label isn't really trustworthy, we need a test that completely ignores it. A test that doesn't ask what a wallet calls itself, but what's left of your money once its maker is gone. Building that test means first knowing what a wallet is supposed to do. So we'll start there, with the three things you actually want from it.<br>What you actually want<br>You essentially want three things from wallet software.<br>First, nobody can take your money . Not a thief, not a service freeze, or even the company whose logo is on the app. Celsius users thought they were earning yield on their own coins, right up until June 2022, when withdrawals stopped. The bankruptcy court later made it official: under the terms of use everyone had clicked through, the coins in those interest accounts had belonged to Celsius all along. Users weren't owners, they were “unsecured creditors”. The company's slogan was “Unbank yourself”.[1]<br>Second, you can't lose it by being human . Humans lose their phones all the time. They forget passwords. They write twelve words on paper and then move apartments, cities and countries. A meaningful part of all bitcoin, by some estimates a fifth, sits in addresses nobody can access anymore.[2] A system that punishes ordinary life circumstances with total, permanent loss, is not a system for ordinary people.<br>Third, you don't need to become an expert . There's a document called the “Glacier Protocol”, which describes a meticulous procedure for storing Bitcoin with maximum security.[3] It is excellent work, and almost nobody on Earth has completed it. Security that depends on homework protects only the people who do homework.<br>Let's call these three properties sovereignty, resilience, and usability.
Sovereignty<br>Nobody can take<br>your money
Resilience<br>You can’t lose it<br>by being human
Usability<br>You don’t need to<br>become an expert
What you<br>actually want
Pick two<br>For most of crypto's history, you could have only two of the three.<br>A hardware wallet with a proper backup scheme gives you sovereignty and resilience. However, onboarding is a project: devices, seed phrases, maybe a multisig spread across locations. Every day after is a ritual, where you need to find the device, plug it in, verify the address on a screen the size of a stamp, sign, repeat per key. Nobody can take the money and no single mistake destroys it, but you will not pay for coffee this way. You won't even check your balance without opening a drawer.<br>A hot wallet with a seed phrase gives you sovereignty and most of the usability. You're up and running in a few minutes and sending with a tap. Very quickly, you start to see where this “smoothness” leaks. Onboarding opens with a ceremony: copy twelve words onto paper like a medieval scribe, then pass a quiz proving you did it. Recovery is where the interface disappears entirely. There's no "forgot password" in self-custody; there's the seed phrase, or there's zero. You're one screenshot, one phishing site, one bad approval away from that zero, forever.<br>An exchange account gives you resilience and usability in full. Email signup, password resets, a support inbox, no gas to worry about, no forty-character addresses. It feels like every other app on your phone because it is like every other app on your phone: an account you access, not property you control. Recovery is smooth because the exchange can reset your access. The catch is that the same power lets it freeze you out.<br>Why you can't have all three<br>This isn't a coincidence of bad design, but actually...