Keeping Bitcoin Safe: Private Keys, Seed Phrases and Cold Storage

In 2013, an IT engineer in Wales was clearing out his home and put an old hard drive into a trash bag. He later realized that the drive held the private keys to about 8,000 bitcoin he had mined in the early days. For more than a decade he asked the local council to let him dig through the landfill, put forward plan after plan, and eventually took the council to court, all without success. In 2025 he said he would stop trying to dig up the landfill.

In 2017, an American technology writer kept his bitcoin on a hardware wallet and wrote its PIN on a slip of paper. While he was away on a trip, the paper was thrown away. Back home, he could not remember the PIN, and every wrong guess made the device wait twice as long before the next try. For months he watched roughly $30,000 worth of bitcoin sit behind a lock he could not open. In the end he recovered the PIN only through a publicly disclosed flaw in the device, with a teenage programmer guiding him remotely. He was lucky. Most people do not get that chance.

Stories like these are not rare. In 2020, the blockchain analytics firm Chainalysis estimated that about 3.7 million bitcoin, roughly a fifth of all bitcoin in existence at the time, had probably been lost for good.

Bitcoin has no "forgot password" button and no support team to reset anything. That is exactly why, before you buy and while you hold, it is worth spending twenty minutes thinking through how you will store it.

Four words to understand first

The most important point is this: your bitcoin is not inside your wallet. It is always recorded on the blockchain. What the wallet keeps is the key that proves you have the right to move it.

Once that clicks, a lot else falls into place. If your phone is lost or broken, your bitcoin is not gone. As long as you still have the seed phrase, you can restore the wallet on a new device. But if the device is lost and the seed phrase was never backed up, the bitcoin can never be recovered, because no institution anywhere keeps a copy for you.

On a platform, or in your own hands

There are two broad ways to hold bitcoin.

One is custody: you leave your bitcoin with a trading platform or custodian, which keeps the private keys for you. What you see on the platform is a balance in your account, and the rights you have over it depend on the platform's terms of service and local law.

The other is self-custody: you hold the private keys yourself, and what you own is the actual on-chain asset.

We do not recommend one over the other. It is worth being clear, though, that self-custody is not automatically safer. It moves the risk an institution would otherwise carry onto you. Both stories at the top of this article are self-custody stories. Which approach suits you depends on how much you hold, your experience and your habits.

The seed phrase: the piece of paper that matters most

If you remember only one part of this article, make it this one.

For a wallet meant for long-term storage, generate the seed phrase on an offline device such as a hardware wallet, and write it down on the spot. Do not use web-based generators from unknown sources.

When it comes to storing it, hold to these rules:

1. Never type it into a website, chat window or support conversation. There is no legitimate reason anyone would need you to.
2. No screenshots, no photos, no cloud storage, no messages to yourself. Phone photo libraries often sync to the cloud automatically, and if that account is ever compromised, your seed phrase might as well be public.
3. Write it on paper or stamp it into a metal plate and keep it offline. Paper can burn, get soaked or fade over time, so store it somewhere protected from fire and moisture.
4. Keep at least two backups in separate places. A single copy can vanish in one fire or one move. Several copies in the same drawer are not much better than one.
5. If you have set an extra passphrase (often called the "25th word"), make sure it is reliably backed up too. The same goes for your hardware wallet PIN: do not leave it on a slip of paper that could be thrown away. The story at the top shows what that can cost.

Finally, one rule with no exceptions: anyone who asks for your seed phrase is a scammer. Trading platforms will not ask for it. Wallet support will not ask for it. Official bodies will not ask for it. Neither will we.

Hot wallets and cold wallets

A hot wallet stays connected to the internet. It is convenient and suits small amounts you use day to day. A cold wallet stays offline, so its private keys never touch the network, which makes it suited to long-term storage.

Many people use both: a little for everyday spending in a hot wallet, and most of their long-term holdings in a cold one. It is the same reason you do not carry all your savings in your pocket.

A cold wallet has its limits, though. It cannot protect a poorly stored seed phrase or stop you from being talked into signing a transfer yourself, and if the device goes missing, getting your bitcoin back depends entirely on your seed phrase backup. No approach is completely safe.

What a scam looks like

Apart from losing access, the other common way people lose bitcoin is through scams.

From late 2018, users of a long-established Bitcoin wallet began to run into something strange. When they opened the wallet to send funds, a message popped up saying they had to update their security settings before they could continue. It looked exactly like an official notice. Many clicked through and installed the so-called new version, and their bitcoin was moved out soon after. The messages, it turned out, came from servers set up by attackers, and according to published reports, more than a thousand bitcoin were stolen this way over the following years.

Scams like this take many forms, but the thinking behind them is much the same:

• Fake support: someone contacts you in a community channel, a comment thread or a private message, offers to fix your problem, then asks for your seed phrase or sends you to a website. Real support staff do not message you first, and they never ask for your seed phrase.
• Fake airdrops and promotions: you are offered a reward if you connect your wallet and sign an approval you do not fully understand. Once it is signed, your funds can be moved out.
• Fake update notices: a message dressed up as an update from a wallet or trading platform takes you to a copycat page that asks for your seed phrase, or gets you to install software containing malware.
• Clipboard hijacking: malware on your computer quietly swaps the address you copied for the attacker's address when you paste it.
• Copycat websites and address poisoning: a web address that differs from the real one by a character or two, with a page that looks almost identical; or a fake address, deliberately generated to share its first and last characters with one you use often, slipped into your transaction history.

Every one of them is trying to get you to do something that looks harmless in the moment and in fact hands control to someone else.

Twenty minutes to check yourself

Now is a good time to go through the checklist below and see where you stand.

If you do not own bitcoin yet, or are about to buy:

• Decide whether you will keep it on a platform or hold it yourself, and understand the risks that come with each.
• If you plan to hold it yourself, rehearse the whole process with a very small amount first: create a seed phrase, write it down, delete the wallet, then restore it from the seed phrase. Only once you know you can restore it should you store more.
• Download wallet software only from official sources, and check the web address.

If you already hold bitcoin:

• Where is your seed phrase right now? Who besides you could get to it?
• Does it exist anywhere as a screenshot, a photo or a text file on your phone, computer or cloud storage?
• Do you have at least two backups, kept in separate places? Would they survive a fire or a move?
• If you have set an extra passphrase or PIN, is it reliably backed up?
• If something happened to you tomorrow, would a family member you trust know these assets exist, and how to find them when needed?

Every time you send bitcoin:

• Check the full receiving address section by section, not just the first and last few characters.
• For larger amounts, send a small test first and send the rest once it arrives. One extra fee buys you certainty that the address is right.
• After receiving a payment, look up the transaction and its confirmations on a block explorer yourself, instead of taking the sender's word that it has been sent.

Bitcoin was designed so that anyone can check things for themselves without relying on anyone else's word. Keeping it safe works the same way.

If you find anything inaccurate in this article, please write to editorialoffice@btc.com.