A hardware wallet alone is not secure enough for self-custody

For years, crypto security advice has been the same: buy a hardware wallet, put your 12 words on a steel plate, and tell nobody. That is a serious security problem waiting to be exploited. Not because hardware wallets or seed phrases are bad, but because you just created two single points of failure. And those will eventually fail.

Failure 1: Steel plates are easy to find

Steel seed plates are marketed as fireproof, waterproof, and tamper-resistant. All true. What they're not resistant to is being found. Steel sets off metal detectors, which means anyone doing a cursory sweep of a house, whether a contractor, a burglar with a cheap detector, or someone who lives with you, can locate it in minutes. There was a case of a man who embedded his steel backup plate inside a wall for safekeeping. His wife found it while he was in hospital, quietly recovered the funds, and left. No hacking involved. No firmware exploit. Just one physical object, one point of failure, one person with motive and access.

Failure 2: Firmware cannot be trusted

Your hardware wallet's entire value proposition is that you can verify what you're signing on a trusted screen. That promise is only as good as the firmware running on it. Firmware is software, and software has supply chains, update mechanisms, and bugs. A compromised update, a malicious library slipped into a build, or a vulnerability in the secure element's implementation can make the device show you one transaction while signing another. You're one bad update away from approving something you never meant to.

Solving the Storage Problem Is Not Enough

If you want to store your seed phrase securely, SLIP39 (Shamir's Secret Sharing) is by far the best approach. It splits your seed into multiple shares, and you need a threshold of them (say 3 of 5) to reconstruct the original secret. No single share is useful on its own.

This solves real problems:

• No single steel plate, no single piece of paper, no single point of physical discovery.
• You can geographically distribute shares (safe deposit box, family member, home safe).
• Losing one share doesn't lose your funds; finding one share doesn't steal your funds.

This is a genuine improvement over "one seed phrase, one hiding spot." But notice what SLIP39 does not change: once the shares are combined and the key lives on a hardware wallet, you're back to trusting that device. If the vendor ships malicious firmware, there is no need to reconstruct the secret at all. The key is already on the device, and a compromised screen can show you one transaction while signing another. SLIP39 makes the secret harder to find. It does nothing about a bad device signing away your funds.

What Actually Protects the Funds

Multisig wallets require multiple independent keys to authorize a transaction, for example 2 of 3, or 3 of 5. When done right, keys live on different devices or hardware wallets, with different people, or across different institutions.

This changes the threat model completely:

• Compromised firmware on one device doesn't drain your funds. It can propose a malicious transaction, but the other signers are likely to catch it.
• A stolen seed phrase gives an attacker one signature, not a withdrawal. Even if someone recovers a seed backup, they still need the other keys before anything moves.

Multisig assumes any single point (device, person, location) can be compromised, and makes sure that compromise alone is never enough to move funds.

Summary

If you only fix seed storage, you've solved half the problem. Multisig is what closes both: a stolen or discovered key isn't enough to move funds, and a compromised device can't drain the wallet on its own.

Stick with "one seed phrase, well hidden" and you're still one lucky attacker, one bad firmware update, or one nosy family member away from losing everything. That's not a hypothetical. It's happened, repeatedly, to people who did everything the old advice told them to do.