Most Bitcoin are not lost through sophisticated hacker attacks, but through avoidable mistakes in storage. Anyone holding significant amounts should know these mistakes, because nearly all of them can be eliminated with a well-considered concept. Here are the five most common ones we keep encountering in practice, and how to avoid them.
Mistake 1: No self custody
The most common and most consequential mistake is to do no self custody at all and to leave Bitcoin permanently on an exchange or with a custodian. If you do not control your private keys yourself, you do not really own your Bitcoin; you only hold a claim against a provider.
History shows how often this claim has been disappointed, from Mt. Gox to Celsius to the collapse of FTX in 2022, in which billions of dollars in customer funds were misappropriated. There are also risks unrelated to fraud: insolvencies, hacks, frozen accounts or regulatory intervention. As long as the keys are with the provider, you carry the provider’s risks with them.
The solution is to move the Bitcoin into your own custody. Importantly, do not swing to the opposite extreme out of fear of technical hurdles, but take the transition in a structured way at an appropriate security level. A small test amount and a little practice at the beginning prevent expensive mistakes later.
Mistake 2: A backup that is too complex
As important as security is, exaggerated complexity is equally dangerous. We regularly see setups so convoluted that even the owner no longer knows for certain after a few months how to access their Bitcoin in an emergency. Distributed partial seeds following self-invented procedures, multiple encrypted passphrases without comprehensible logic or exotic do-it-yourself solutions often lead to precisely the loss they were meant to prevent.
The principle is: complexity is the enemy of security. A backup must be designed so that it reliably works even under stress, after years, or carried out by another person. What has proven its worth is securing the seed not on paper but fire- and water-resistant on stainless steel, and using a clear, standardised procedure instead of an individual home-grown construction. Security is created through clean redundancy and traceability, not through as many layers as possible.
Mistake 3: The single point of failure
A single point of failure is a single weakness whose failure leads to total loss: a single key, a single storage location, a single person who knows everything. This mistake appears in many forms. A single hardware wallet without a backup. A seed kept in only one place. A passphrase that only one person has memorised.
How real the physical risk is was shown in early 2025 by the burglary at Sparkasse Gelsenkirchen, where more than 3,000 safe-deposit boxes were broken open and damages in the triple-digit millions were caused. Anyone who had stored their only seed in such a box would, in the worst case, be left empty-handed.
The solution is redundancy at every level. Multiple keys instead of a single one, ideally via a multisig setup. Multiple geographically separated storage locations, so that no single event such as a fire, burglary or natural disaster hits everything. And clearly defined access paths that survive the failure of a single component. Bitcoin is one of the few assets where the single point of failure can be technically eliminated entirely.
Mistake 4: No clean documentation
A technically perfect setup is worthless if, in an emergency, no one knows how it works. This mistake shows up especially in the inheritance case, but also whenever the owner themselves loses track over time (and usually faster than one thinks). Where are which keys? In what order are the steps to be carried out? What hardware and what software is required? Where is the passphrase?
Without documented answers to these questions, a well-intentioned security concept becomes a danger in its own right. Heirs in particular are often faced with an unsolvable task because the keys are present but the knowledge of how to use them is missing.
Professional documentation describes the setup completely and in a way that is understandable even without deep technical knowledge. It records where each component is located, how they are brought together and whom to contact with questions. Importantly, the documentation must be designed so that it does not open a security gap itself, meaning it must not bundle complete secrets in an unprotected place. And it must be kept up to date, because a setup that changes but is not documented loses its value.
Mistake 5: AI-driven scams and phishing
Even the best custody does not protect you if the owner is induced to reveal their secrets themselves or to sign a malicious transaction. This is precisely where most successful attacks begin, and they are getting better. Fake wallet apps, fraudulent support staff, manipulated receiving addresses, supposed security warnings that prompt for the seed phrase: the pattern is always to trick the victim into an action.
Artificial intelligence sharpens this problem considerably. Phishing messages today are linguistically flawless and individually tailored. Fake websites can be created in minutes. And with voice and video impersonations (deepfakes), attackers can now even convincingly forge calls from supposedly familiar people or employees. The old rule of thumb that you can spot fraud by poor language no longer holds.
Protection is primarily procedural. The most important rule: the seed phrase is never entered, neither online nor over the phone, no matter who is asking. No reputable provider will ever demand the seed. Receiving addresses are always verified on the hardware wallet display, not on the potentially compromised computer. Software is obtained only from official sources. With unusual requests, especially under time pressure, pause — artificial time pressure is the most common hallmark of an attack. A multisig setup provides additional protection here, because a single compromised signature is not enough to move Bitcoin.
Conclusion
The five most common mistakes — missing self custody, an overly complex backup, the single point of failure, gaps in documentation and falling for scams and phishing — have one thing in common: they are all avoidable. Safe Bitcoin storage is a question of organisation and structure. Anyone who practises self custody, keeps their backup simple and redundant, eliminates the single point of failure, documents cleanly and protects themselves against social engineering has the essential risks under control.
If you would like to have your existing setup reviewed or build a new security concept, write to us for a no-obligation introductory call.