Self-custody in practice.

Self-custody is often framed as a technical choice. In practice it is mostly an organisational one. Most losses we documented did not arise from hacking, but because a backup was untraceable, kept in a single place, or never tested.

We analysed one hundred documented cases of lost or nearly lost crypto among European retail holders. A clear pattern emerges: the mistake almost always happens in the first hour, and is only discovered years later, at the moment the keys are needed.

The recommendation in this note is deliberately boring: write your recovery phrase on paper or metal, keep it in two physically separate places, test one recovery before moving a large amount, and document for your heirs how it works.

A wallet stores no coins. It stores a key that lets you sign a transaction. The coins live on the blockchain; the key decides who may move them. Understanding that immediately explains why backing up the key matters more than the device itself.

The twelve or twenty-four word recovery phrase is that key in readable form. It works on any compatible device. That is its strength and simultaneously its risk: whoever holds the words holds the money, wherever they are.

In our dataset the causes are strikingly monotonous. No exotic attack is needed to lose access; a house move, water damage or an envelope hidden too well suffices.