Key Points

A hardware wallet can protect cryptocurrency from malware, phishing and remote key theft, but it cannot stop an owner from being forced to approve a transaction.

For technically capable holders with life-changing long-term savings, a properly separated 2-of-3 multisignature setup is a practical starting point, not a universal rule.

Documentation from Safe and Coinbase illustrates why critical controls need to be configured before an emergency, rather than changed during one.

Provider-assisted recovery can reduce some loss risks, but it also creates operational, legal and jurisdictional dependencies.

No wallet architecture can guarantee personal safety during a violent confrontation.

A hardware wallet removes many online attack paths, but it does not remove the authority of the person who knows how to unlock and use it. That distinction is central to physical coercion risk. If one identifiable person can immediately move an entire portfolio, threatening that person may be easier than attacking the cryptography itself.

The purpose of coercion-resistant custody is not to make legitimate access impossible. It is to ensure that one person, one device and one location do not provide everything required for an immediate transfer.

Coindoo said it reviewed current documentation from Safe, Coinbase, Casa, Unchained and Trezor, along with Jameson Lopp's public database of physical crypto attacks. Each custody design was considered through a four-part documentation stress test: what cannot be changed after setup, what fails when a signer or account is unavailable, what happens when the normal recovery path breaks, and what cost or friction remains when no emergency occurs. The documentation review was conducted on July 25, 2026. Coindoo said it did not create or test the products described and did not conduct a live withdrawal or recovery exercise.

A Practical Default for Life-Changing Holdings

For most technically capable people holding life-changing amounts of bitcoin, single-signature cold storage should not be the default arrangement.

A reasonable starting point is a 2-of-3 multisignature structure with three separately controlled keys:

• One signing key available at the holder's primary location
• One independently controlled key stored off-site in another city
• One recovery key held by a custody provider or carefully selected co-signer

In that model, the two self-controlled keys should allow the holder to move funds without relying on the provider. At the same time, one personal key plus the recovery key should be enough to recover if a device is lost.

This structure is only a starting point. It may be unsuitable for a holder who needs frequent access, cannot maintain several devices, cannot reliably reach the off-site location, or does not accept the legal and operational dependency created by a provider-held key.

Funds used for regular spending or active trading should remain in a separate wallet containing only the amount needed for ordinary activity. The multisignature structure is better suited to long-term holdings where extra friction is a feature rather than a daily obstacle.

For long-term EVM holdings, a similar principle can be implemented through a Safe account using separate owners and a 2-of-3 threshold. Safe, formerly known as Gnosis Safe, is one of the most widely adopted smart-account platforms in the Ethereum and EVM-compatible ecosystem, used by DAOs, treasury managers and individual holders to enforce multi-owner approval policies on-chain. Those owners must represent genuinely independent devices, accounts and locations, not three credentials stored in the same home. Safe's documentation on smart account concepts is available at

Multisignature Is a Policy, Not Just More Devices

A multisignature wallet requires a defined number of keys to approve a transaction. In a 2-of-3 arrangement, three authorized keys exist and any two are required to move funds.

The threshold improves physical security only when the keys are independently controlled. Three signing devices and their backups kept in the same home preserve the same point of failure during a home invasion.

Jameson Lopp, who co-founded custody provider Casa and is a well-known Bitcoin infrastructure developer and educator, recommends geographic key separation because forcing access to several controlled locations increases the time and difficulty required to complete an attack. His connection to Casa is relevant because geographically distributed multisignature custody is part of the company's product model. The operational point remains valid, but the recommendation should be read as practitioner guidance from someone commercially connected to that model, not as an independent product endorsement. Casa has published related material at

Geographic separation also creates ordinary failure modes that product descriptions may understate. A key in a bank deposit box may be inaccessible outside branch hours. A signer may move to another country, become ill or become difficult to contact. Death, incapacity or divorce may change who can access a location. A hardware device may fail while its remote backup has not been checked for years. Relatives may know where a key is stored without understanding how recovery works.

For that reason, a custody design needs a recovery and inheritance process, not merely several hiding places.

Safe and Coinbase Show the Same Structural Rule

Safe and Coinbase use different architectures, but their documentation points to the same custody principle: important controls should be configured before they are needed.

For EVM-compatible assets, Safe accounts maintain a list of owners and a minimum signature threshold. Safe's technical documentation states that changing the threshold is itself a Safe transaction. That means the current approval policy must authorize the stronger policy. A holder cannot rely on raising a weak 1-of-3 threshold to 2-of-3 after a threat has already started. Safe's threshold documentation is available at

Coinbase, one of the largest regulated cryptocurrency exchanges in the United States, reaches the same principle through its Vault design. Coinbase states that a Vault's 48-hour withdrawal delay, owner, notification settings and security settings cannot be changed after creation. A user who wants different controls must create another Vault. Coinbase's Vault FAQ is available at

Neither limitation is necessarily a flaw. Preventing quick policy changes can stop an attacker or compromised account from quietly weakening the security arrangement. The operational consequence is that a poorly chosen setting may remain inconvenient until the holder deliberately migrates to a new configuration. Controls that resist emergency modification also resist legitimate emergency modification.

The Documentation Stress Test

Safe and Coinbase demonstrate why feature lists are not enough when assessing a custody product. The more useful questions focus on failure and reversibility.

The first question is what cannot be undone. Fixed withdrawal delays, immutable owners, locked security settings and threshold changes that require the existing quorum all affect whether a weak setup can be repaired quickly.

The second question is what breaks when one participant is unreachable. A signer may lose a device, a provider may be unavailable, an email account may be inaccessible or a key may be stored inside a bank branch that is closed for the weekend.

The third question is what happens when the normal path fails. A guide or product page may clearly explain ordinary signing while giving less attention to lost phones, failed identity checks, missing emails, damaged devices and support escalation.

The fourth question is what the control costs when nothing goes wrong. Delays, subscriptions, travel, maintenance, device replacement and recovery testing remain real burdens even when no theft or emergency occurs.

This documentation stress test cannot reveal every problem that hands-on use would expose. It can identify designed limitations before a substantial balance depends on them.

Provider-Assisted Multisig Trades One Risk for Others

Collaborative custody gives the holder some keys while a service provider controls another recovery or co-signing key.

Unchained describes a 2-of-3 arrangement in which the client holds two keys and Unchained holds one. The company cannot move the bitcoin by itself, while the client can normally transact without the provider. Unchained's Vault information is available at

Casa similarly states that it controls one recovery key but never enough keys to move funds unilaterally. Casa's app documentation is available at

These models reduce the risk that one lost device permanently destroys access. They also create a relationship that does not exist in fully independent multisignature custody.

Use of a provider-held key may depend on account status, identity checks, support availability, contractual terms, the company's continued operation and the law of the jurisdiction in which it operates. The provider cannot take the funds alone, but the holder may still depend on the provider's cooperation during recovery.

Casa's documentation makes some of that friction explicit. Its Recovery Key has a mandatory delay and is not suitable for urgent transactions. Standard customers authenticate through security questions, while some higher-tier customers use a video-verification process. Casa's Recovery Key documentation is available at

That is not necessarily a reason to reject collaborative custody. It is a reason to treat the provider as an operational and jurisdictional dependency rather than describing its key as free additional security.

Before choosing a provider-assisted arrangement, a holder should know who controls every key, which key combinations can move funds, what the provider requires before signing, whether recovery is possible without the provider, what happens if the account is closed or the service is discontinued, and which laws and jurisdictions apply to the provider-held key.

Withdrawal Delays Add Friction, Not Personal Protection

A withdrawal delay prevents an immediate transaction from completing. It does not guarantee that an attacker will abandon the attempt or understand the limitation.

For a standard Coinbase Vault, required email approvals must be completed before the 48-hour period begins. Only one withdrawal request can be active at a time, and changing fixed Vault settings requires creating a new Vault.

Those restrictions may be useful during an unauthorized withdrawal. They can also become obstacles when a linked email account is inaccessible, an approval message does not arrive or the holder legitimately needs the funds quickly.

A withdrawal delay is public product behavior, not a secret defense. An attacker who understands the system may know that a transaction cannot complete immediately. The delay reduces immediate access to assets, but it should not be described as a control that guarantees the person will be released or prevents the incident from continuing.

Hidden Wallets Do Not Remove Unilateral Control

Passphrase-protected wallets can create separate balances from the same hardware device. They may add privacy when an unauthorized person examines the wallet.

Trezor, one of the longest-established hardware wallet manufacturers in the cryptocurrency industry, explains that each passphrase opens a separate wallet and that a forgotten passphrase cannot be recovered. Trezor's guide is available at

The feature introduces permanent-loss risk while still leaving one person capable of reaching the main balance. A hidden or decoy balance may also fail if attackers believe additional assets exist. It should not replace separated authority, tested recovery procedures or a broader privacy plan.

Test Recovery, Not Only Spending

A custody arrangement should be tested with a small amount before a substantial balance depends on it.

The test should establish whether the holder can complete a transaction with every intended combination of keys, recover after one device is lost or destroyed, reach off-site keys within the expected timeframe, replace a signer without weakening the policy, use the provider recovery path when the normal path fails, and explain the inheritance procedure to the intended recipient.

A lightweight health check is not the same as a full recovery drill. It may confirm that a key can sign without proving that the holder could rebuild the setup after losing a device, changing phones or losing access to a normal account.

For long-term, life-changing holdings, the full recovery process should be tested at least once a year and after any material change involving a device, signer, location, phone number, email address or provider.

Casa's inheritance documentation provides a concrete example of the maintenance burden. Its system uses a designated recipient and requires recurring health checks on shared mobile and hardware keys. The company says those checks should be completed every six months. Casa's inheritance FAQ also says a recipient requesting access can face a six-month verification period. The documentation is available at

Those controls may reduce unauthorized access, but they also require the owner and recipient to keep devices, contact details and shared keys current for years.

Privacy Can Reduce Risk Before Custody Controls Matter

Custody controls begin after an attacker has selected a target. Privacy reduces the information available during that selection process.

Lopp's public database of known physical crypto attacks, which is separate from Casa's product documentation, records home invasions, kidnappings, delivery impersonation, mistaken targeting and incidents in which attackers found that the intended victim held no cryptocurrency. Lopp states that the database is not comprehensive because many incidents are never publicly reported. The database is available at https://github.com/jlopp/physical-bitcoin-attacks.

Its value for this analysis is not an exact global total. It shows that perceived wealth and leaked personal information can create physical risk even when attackers misunderstand the victim's actual holdings.

Blockchain transactions on networks like Bitcoin and Ethereum are pseudonymous: they are publicly visible on a permanent ledger, linked to addresses rather than legal names. That transparency means anyone who connects a real-world identity to an on-chain address can estimate holdings without the holder's consent, making operational privacy a complementary concern alongside custody architecture.

Portfolio screenshots, public wallet addresses, conference schedules, home photographs and live travel posts can connect an identity with perceived wealth and predictable locations. Family members, employees and assistants may also become proxy targets even when they cannot access the assets.

A security review should therefore consider who knows about the holdings, what they disclose and which addresses or routines are publicly accessible. Coindoo's report on the rise in verified crypto home invasions during H1 2026 examined how the public data was collected, why the headline financial total is dominated by outliers and why France may be both a genuine hotspot and a country with stronger official tracking: https://coindoo.com/crypto-crime-moves-offline-home-invasions-rise/.

When a 2-of-3 Setup May Not Fit

A geographically separated 2-of-3 arrangement is a strong starting point for technically capable holders with life-changing long-term savings, but it should not be adopted mechanically.

A simpler arrangement may be more appropriate when the balance is replaceable, the holder is unlikely to maintain several devices correctly, or the complexity would create a greater accidental-loss risk than the threat being addressed.

A more restrictive structure may be justified when the holder is publicly identifiable, manages company assets, regularly attends industry events or controls an amount that would create a serious incentive for organized targeting.

Active traders and DeFi users should not force all activity through deep cold storage. They should separate the capital required for regular transactions from the holdings whose loss would be life-changing.

The goal is not maximum complexity. It is a system in which the likely failure of one device, one person, one account or one location does not defeat the entire custody design.

No Custody Design Guarantees Physical Safety

Multisignature wallets, provider keys, transaction limits and withdrawal delays can reduce immediate unilateral access. They cannot guarantee that an attacker will understand or accept the restriction.

These systems should be configured before an incident to reduce the authority one person carries. They should not be treated as instructions for responding during a violent confrontation.

Personal safety and family safety must take priority over asset preservation. Anyone facing an immediate threat should contact the competent emergency services as soon as circumstances safely allow.

The final test of a high-value custody arrangement is not only whether someone can hack it. It is whether one frightened person can be forced to defeat the entire system alone.

This guide is for informational and security-awareness purposes only. It does not endorse any custody provider and does not guarantee protection from theft or physical crime. Holders should verify current product documentation, test procedures with small amounts, and obtain qualified custody, security and legal advice before changing a high-value arrangement.