The Keys

In 2022, thousands of people who were right about Bitcoin lost their Bitcoin.

They had read correctly. They had sized responsibly, some of them. They held through an 84% drawdown without selling — the exact discipline this arc spent three letters building. And they lost the coins anyway, because the coins weren't theirs. They sat on the balance sheets of lenders and exchanges that promised yield or convenience, and when those companies failed, the holders discovered what their account balance had always legally been: an IOU. A line in someone else's database, standing in a bankruptcy queue behind the lawyers.

Here is the sentence that should organize everything you think about custody: no bear market in this asset's history has cost holders as much as other people holding it for them. The 93% drawdown returned everything to the patient. The 84% returned everything to the patient. The bankruptcy queues returned fractions — years later, paid in dollars valued at the bottom, while the coins themselves went on without their owners. The asset has never failed its holders. The arrangements fail constantly.

So this letter finishes what Letter #005 started. Back then I told you why this money is different — it's the first asset in history that is purely a bearer instrument made of information, no one's liability, ownable by anyone who holds a secret. Letter #015's third unforced error told you what that implies: lending the slice out re-attaches the counterparty you specifically bought your way out of. Tonight is the how — and the how is genuinely simpler than the industry makes it look. The complexity you've seen is mostly priesthood: people who learned the hard version early and mistake the difficulty for the point.

Strip the jargon and there is exactly one fact to understand. A Bitcoin balance is controlled by whoever knows a secret — in practice, a list of twelve or twenty-four ordinary English words. That's not a password to your money. The words are the money. Everything else — the device, the app, the account, the screen with the number on it — is furniture arranged around the words.

From that one fact, everything follows:

If an exchange knows the words (it does — for coins in your exchange account, it holds them on your behalf), then what you own is the exchange's promise. Usually honored. Honored right up until 2022's roster of names honored nothing. Holding the fixed-supply money as someone's IOU quietly deletes the very property you bought it for — you've converted the no-counterparty asset back into a counterparty product, and you're paying volatility prices for it.

If you know the words and no one else does, you own the coins in the fullest sense property has ever had: unconfiscatable by a database edit, unfrozen by an email, carriable across any border in your head. That's the whole promise of Letter #005, and it activates only at the moment no one else holds the secret.

And if no one knows the words — because they were on a phone that died, a paper that burned, a "clever" hiding place that outsmarted its own owner — the coins still exist, visible on the ledger forever, and no power on earth can move them again. The system has no forgot-my-password. This is the honest price of bearer ownership, and the entire craft of custody is managing it.

Custody is not a purity test; it's a spectrum, and the right point on it depends on the size of your slice and an honest read of yourself. The rule this letter adds to the canon: custody should grow up with the slice. Match the rung to the money.

Rung zero — custodial, deliberately. While the slice is pocket-money sized and still filling on its schedule, keeping it at a large, boring, regulated exchange is not a sin; it's a phase. But rung zero done properly has three settings, tonight: two-factor authentication from an authenticator app — never SMS, which is stolen by hijacking your phone number; a password used nowhere else on earth; and a withdrawal allowlist if the platform offers one. Rung zero is acceptable. Unexamined rung zero — the default account with the reused password — is where the Blind live.

Rung one — self-custody, when the slice becomes meaningful. The test isn't a dollar figure; it's the question: would losing this change your month? When yes, the slice graduates to a hardware signer — a small dedicated device whose entire job is to generate the words offline and keep them off every internet-connected thing you own. Bought new, directly from the manufacturer, never from resellers or marketplaces where tampered devices are a known trade. The device will show you the words at setup — treat that moment as the only time they will ever be displayed, anywhere. Which brings us to the only part of this that deserves ceremony:

The words go on metal, or at worst paper — never, ever into anything digital. No photo. No cloud note. No password manager. No email draft. No "just temporarily." A digital copy converts your bearer asset into something an email hack can steal, which reintroduces every risk you left the exchange to escape. Stamped or etched into steel, the words survive fire and flood; on paper they survive most things; on a phone they are already gone and just haven't told you yet.

Rung two — redundancy and inheritance, when the slice becomes serious. Two copies of the words, in two places that can't burn down together. And the piece almost everyone skips: a plain-language letter for your family — what exists, roughly where, and who understands this — stored separately from the words themselves. Perfect security that dies with you isn't security; it's a donation to the ledger. The unclaimable coins of the meticulous dead are a genuine category of loss, and it's the most preventable one on this page.

There is a rung three — passphrases, multisignature setups, collaborative custody — and if your slice grows to where rung two feels thin, that's a good problem and a later letter. The ladder's point is not to climb it all tonight. It's that each rung exists, the test for moving up is written down, and the review date from the Ledger is when you ask.

And when the slice moves, it moves like this: send a small test amount to the new setup first. Then send a small test amount back out — receiving isn't proof you control it; spending is. Verify the address on the device's own screen, not the computer's, because address-swapping malware is real and the device screen is the one thing it can't touch. Then move the rest, in pieces. Ten unhurried minutes, once, and the single most irreversible operation in your financial life becomes routine.

Bear markets return coins to the patient. These don't. Every one is common, and every one is the owner's own hand.

Error one: the digital seed. The photo "just for backup." The cloud note. The password manager entry. This is the most common self-custody failure in existence, and it converts the strongest property arrangement ever invented into a thing that gets phished on a Tuesday. The words touch metal and paper. Nothing else. There is no exception, and no one legitimate will ever give you a reason for one.

Error two: the clever scheme. The seed split in halves between two houses. The homemade cipher. The words reordered by a system only you understand. Homemade security has lost more coins than professional theft — because the adversary you're defending against shows up once a decade, and the adversary you're creating — future you, confused — shows up guaranteed. Boring beats clever, every time, forever.

Error three: the secret so good it's a tomb. Nobody knows the setup exists. Nothing is labeled. The hiding spot is brilliant. Then life does what life does, and your family is selling a house containing a small metal plate they've never seen, or a device that looks like a USB stick, headed for a drawer or a dumpster. If rung two's letter feels awkward to write, write it anyway. It's one page, and it's the difference between an inheritance and a permanent entry in the ledger's unclaimed column.

Error four: the fake everything. Fake wallet apps, fake support agents, fake "security teams" DMing about a problem with your account, fake device resellers. One sentence defeats the entire category, so memorize it: no legitimate person, company, app, or support agent will ever ask for your words. Ever. For any reason. Anyone who asks is a thief mid-sentence, however patient, however helpful, however urgent the problem they've invented. That single reflex is more security than any device.

Error five: the all-at-once migration. No test send, whole slice, one transaction, address pasted from a screen and never verified. Usually it's fine. The times it isn't fund the malware industry. The ritual exists because "usually fine" is not a standard you accept for irreversible operations.

And error six you already know from Letter #015: someone will offer yield on the slice you now properly hold. The answer didn't change because your custody improved. The slice earns nothing, on purpose, forever.

Self-custody moves the risk; it doesn't delete it. It fires the counterparty and hires you — and for a genuinely disorganized person, the counterparty was the better employee. If you know yourself to lose important documents, a large regulated custodian or a spot ETF inside a brokerage account is not heresy; it's an honest match of rung to person, and it's miles better than a seed phrase in a photos app. The ladder ranks arrangements, not people.

The 2022 disaster was mostly lending, not custody. The names that vaporized were paying yield with client coins. Plain custodial accounts at major regulated exchanges have since survived stress that would have killed the class of 2022, and regulation has genuinely tightened. Rung zero is safer than this letter's cold open makes it feel — which is why it's a rung and not a warning.

And the simple-hardware-wallet advice may age. Collaborative custody and multisig are getting easier every year, and at some point the "one device, one seed" model I've described may look like the training wheels. Fine. The ladder was built to be climbed, and the letter that adds rung three will cite this one.

The Blind hold coins on the exchange they first bought them on, reused password, SMS codes, no withdrawal list — not by decision, but because no one ever told them there was a decision. Their custody is whatever the default was.

The Scared split both ways, as always: some refuse self-custody entirely because they've heard the horror stories, paying counterparty risk forever as the price of never learning; others build paranoid custom schemes with the seed split across three countries — perfect protection against thieves, guaranteed loss to entropy, and nothing their family could ever inherit.

The Prepared matched the rung to the slice, bought boring hardware from the manufacturer, put the words on steel in two places, wrote the one-page letter, did the test send both ways — and then stopped thinking about it, except for five minutes at each Ledger review. Custody, done right, is the most boring room in the whole stack. That's what done right looks like.

Six tools now: the floor, the slice, the multiplier, the clock, the ledger, the keys. Sized, scheduled, reviewed, measured, and now properly held. Look at what you're standing on — this arc set out to turn understanding into position, and the stack is very nearly a complete operating system.

Next week, the arc closes the way the first one did: everything on one page. The six tools assembled into a single system you could explain to someone you love in ten minutes — the whole of Position, compressed, plus the door into what comes after it. Working title: The System.

If this one was useful, three things:

One — run the rung test tonight: would losing the slice change your month? If you're on rung zero past that answer, this week is the week. Manufacturer's site, nowhere else.

Two — if you're already self-custodied: when did you last verify you could actually restore from your words, and does anyone who loves you know the one page exists? If either answer is "hm," you have a five-minute job.

Three — reply with your rung: 0, 1, or 2. One character. The distribution will tell me exactly which custody letter this readership needs next.

Understand — the words are the money. Position — match the rung to the slice, boringly. And don't panic — the whole point of doing this calmly, this week, is that you never have to do it urgently, ever.

The patient got everything back. The queues got pennies. Choose which line you're standing in before it forms.

— Bill2Billion

P.S. Not financial advice, and deliberately not a product review — no brands were named because the principles outlast every device, and this publication takes no referral money from anyone. The one sentence worth re-reading until it's reflex: no legitimate person will ever ask for your seed words, ever, for any reason. The 2022 references are to the collapse of the crypto lending industry — Letter #015's P.S. has the pointer. Standing rules hold: no leverage, no timing, no all-in, 1–10% is the band, and better custody is never a reason to hold more than the rehearsal allows. I hold positions in some of the asset categories discussed, in arrangements consistent with this letter.