S15 E61: Polto & Darko on Self-Custody Pro Tips, Multisig Trade-Offs & the 3-2-1 Backup Rule

If you listened to Season 15 of this podcast, you heard a lot of ads for Hodling.ch. What you did not hear is that the two Swiss co-founders behind those ads set one condition before agreeing to sit down with me: no boring promotional episode. They did not want to spend an hour explaining why their company is great (even though, as I told the audience in the intro, "they're great and they're better than Casa, by the way"). They wanted to talk shop. Hardware wallets, secure elements, passphrases, multisig, inheritance, airport scanners and Swiss regulators. The nerdy stuff that decides whether your bitcoin is still yours ten years from now.

So I sat between them, Polto on my left and Darko on my right, on the sidelines of a conference where they had just run a multisig workshop, and asked them to rank hardware wallets. That was the first mistake. Rankings, as I quickly learned, are not how these guys think. Everything is a trade-off, and the best setup is the one you understand.

What follows is the most practical episode of the season. If you only remember one thing from it, make it the 3-2-1 rule near the end. As I admitted on air, "I wish we started with this because most people will not get into the episode."

There Is No Best Hardware Wallet

I asked for a top five. I got a lecture on trade-offs, and it was a good one. "It's not easy to make a top five because it's always about trade-offs," Darko said right away. The moment you want a Bitcoin multisig, Polto added, your list gets shorter. For a two-of-three, his first names were the BitBox02, Blockstream's Jade and the Coldcard. Then come the do-it-yourself signers: SeedSigner, Specter DIY, Krux, and Jade flashed in DIY mode onto cheap ESP32 boards.

The bigger distinction for them is whether the device has a secure element. Without one, Darko said, "you should consider it as a signing device. Meaning that you should not trust it to keep your seed safe." Jade sits in an odd middle spot with what Blockstream calls a virtual secure element. Polto called the name partly marketing, but liked the idea: the device is cheap and has no secure element, yet the key stored on it is encrypted with a PIN that lives partially on a server running open source code that you can host yourself.

That is the whole point of combining devices in a multisig. Different hardware comes with different weaknesses, and the idea, as Polto put it, is to "combine different trade-offs" and get the best of several worlds.

At a workshop they gave on Specter DIY, they had one slide on exactly this, and Polto's conclusion was simple: "there is no like best hardware wallet. There are different trade-offs, and the best is the one that you understand the trade off of and that you are comfortable living with." For some people, closed source code is "an absolute no-go." Those people should accept that fully open devices usually make little or no use of a secure element. Others would rather not check a firmware hash and a PGP signature before every update, and for them a proprietary chip that verifies the firmware automatically is the better deal.

The Passphrase Is Not a 25th Word

Of course I pushed back. Can't a passphrase make up for a device without a secure element? Only partly, Polto said. "If you want a passphrase to mitigate this risk, you need it to be like really large. Otherwise, it doesn't add enough entropy and it's easy to brute force."

Then there is the human problem. "Humans, we are in general bad at generating entropy," Darko said. We think our clever phrase is strong when it is "something easy to guess when you know the person."

I brought up a metal seed plate company that told customers to engrave "the 13th or the 25th word" taken from the BIP 39 word list. Bad idea, Darko agreed, and confusing too, because a passphrase "does not have to be from the official dictionary of the 2,048 words" and can run much longer than any single word. Where you keep it matters just as much. Store the passphrase next to your 24 words, he said, and "it defeats the purpose. The passphrase should be and must be stored securely away from the main seed."

Memorizing it is not the clever escape it sounds like either. "If you can remember, it's probably easy to guess, but it's also easy to have like a small accident or something to forget or just to drink too much and to forget," Polto said.

I mentioned the quirk that scares newcomers: type the wrong passphrase and your wallet opens anyway, empty, and you think your coins are gone. That is not a bug. Any passphrase generates a valid wallet, which is what makes plausible deniability possible. "It's impossible to prove that you have one additional or you don't have one additional passphrase," Polto said. Under the hood, Darko added, the seed plus the passphrase produces "a new complete tree of keys" in a hierarchical deterministic wallet, and because it is deterministic, your setup "must work in any other compatible wallet."

Boring Verification Saves Fortunes

That compatibility is also your best test. Once your setup is ready, before you send real money, Darko said you should recover it on a different wallet and check that it shows you the same receiving address. "It may sound so super boring," Polto admitted, so they suggest a version that is a little more fun: send a small amount, wipe everything, restore from your backups and see if the funds are still there.

"Small" is relative. Polto recalled one customer who used what was, for him, a little amount: "$100,000 value of Bitcoin." During the recovery, one of his words came up as invalid because it was not in the dictionary. He started sweating. It turned out he had written a T instead of an F, and since the BIP 39 words are chosen so you cannot easily confuse one with another, the fix was obvious. It became a lesson in why "the verification procedure, as boring as it may sound," matters.

The last word helps too. While Polto was walking through those words, Darko added that the last one carries a checksum, so if you import your seed into another device and made a mistake somewhere, "the checksum will not be the correct one" and you know to go hunting for the wrong word before any coins move.

The OGs Who Never Bought a Hardware Wallet

I played devil's advocate for the old school: early bitcoiners who keep everything in Bitcoin Core, some of whom walk around with hundreds of BTC in a phone wallet and have never lost a coin. The reply was quick: "we know although some people who lost." We both thought of Luke Dash Jr., who lost around 200 BTC and has said he does not use hardware wallets because he only trusts code he can read. "Position I respect and understand," Polto said, "but like not everyone read code." Hardware wallets are built to produce good entropy, keep keys safe and stay isolated from the rest of your computer, so "for average people, I believe it's more secure." Even "quite technical people" mess up from time to time.

I reminded them that when the Trezor and the BTChip were announced on Bitcointalk back in 2013, plenty of people asked why anyone would need one. The BTChip had no screen; it would sign "blindly whatever you give it to sign." Today, for the multisigs Hodling helps set up, a screen is mandatory. "We want a screen to be able to verify what you're being signing every time you sign with each of the devices," Polto said. (If you want more of that history, read about the DIY signing device revolution, and hear Trezor's Matej Zak in S14 E3.)

Black Boxes and the Open Source Secure Element

Secure elements are convenient, but they are black boxes. As far as Polto knows, "every secure element manufacturer forces you to sign an NDA," which rules out open source firmware running inside the chip. You can publish the code that talks to it, but not the code inside it.

That creates a split. Ledger signs inside the secure element and, on its newer devices, drives the screen from it too, which is better for security but means the most important parts, "key generation and signing," stay proprietary. Most other wallets only use the secure element to hold the key while the device is off, then load it into the main chip's memory to sign. "It's less secure during the signing procedure," Polto explained. If someone attacks the device at that moment and freezes it, they can extract the keys.

They had a few kind words for Ledger's engineers, who let you use cutting-edge features like miniscript on a seven-year-old device, and a few unkind ones for the company's priorities: instead of promoting that, "they are doing some weird NFT stuff displaying on the screen of the wallet." I pointed out the obvious business answer. There are more NFT people than multisig people. "Oh, definitely. Definitely more."

One fun detail Polto had only just learned at the event: you can pair a SeedSigner with a Satochip smart card, generating the key on the SeedSigner and storing it on the card. "So, you can finally travel with a seed signer and with some key materials on your smart card."

Then we got to Tropic Square, the Prague company building what it calls the first open source secure element. I visited their HQ and interviewed their CEO, and Kevin Loaec had warned me that their first chip will not sign Bitcoin transactions itself; it will hand that job to a general-purpose microcontroller. Polto and Darko were not surprised. "Hardware wallet space is quite, how to say, boring, conservative, and moving really slowly," Polto said. The first generation will store and unlock keys, and the fancy stuff comes later.

Multisig Is Still the Wild West of Standards

The slowness shows up in multisig too. "There is not one BIP that describes what a multi-sig is," I said, and they agreed. SegWit multisig is now "relatively standardized," but Taproot multisig comes in several flavors, and Taproot miniscript, in their words, "it's not standardized at all yet." Even though it already runs on mainnet, "you should use it carefully."

This is not an academic worry. "If you create your multi-sig wallet today, you are expecting it to be usable in 5, 6, 7 years," Darko said. Set it up in a non-standard way, with an exotic derivation path for example, and you or whoever helps you recover will have problems later. Take Liana: it is open source, but if it ever broke for good, Polto said, "for now, Bitcoin Core is the only option" to recover. You also cannot export a configuration from Liana and import it into MyCitadel, another miniscript wallet.

For single sig, the checklist is BIP 39, BIP 32 and BIP 44, plus the BIP that matches your address type. Multisig adds a few more for sorted multisig and for SegWit or Taproot. Between the hardware and the coins sits a coordinator such as Sparrow or Electrum, which builds the transaction because the offline device "doesn't know the UTXO state," then passes it around for signatures as a PSBT, a partially signed Bitcoin transaction. Some paranoid users even turn air-gapped phones into signers, which works, "but again, you have to be quite technical to use this in a secure way."

Is Bitcoin-Only Really Safer?

I asked whether Bitcoin-only firmware is a real security gain or just marketing. Polto's answer: it is real. "I think it's not only more secure, it's usually more feature rich." Multi-coin devices tend to support fewer Bitcoin BIPs, and most of them skip multisig entirely. On the security side, the logic is simple: less code means less attack surface. BitBox02, Trezor and Keystone all ship Bitcoin-only firmware for this reason.

Polto took the attack surface argument further than I expected. SeedSigner runs a minimal Linux on a Raspberry Pi Zero, and its camera needs image libraries such as JPEG code to read QR codes. Specter DIY and the latest Coldcard use a dedicated QR scanner that skips all that image processing, so there is "less code, less attack surface inside the wallet."

Why They Love Specter DIY

That brought us to their favorite DIY device. Next to SeedSigner, Krux and Ben Arc's Bowser, the one that doubles as a Tetris machine on an ESP32 (Ben told me about his projects in S16 E17), Specter DIY wins for Polto on features. It has a secure bootloader, better firmware security, reproducible builds, anti-phishing words, a screen big enough to be practical, and a way to add your own entropy that a human can check. As far as he knows it is "the only hardware wallet that allows you to add entropy in a humanly verifiable way," because you can compare the words you changed against the official dictionary.

There was a caveat from Darko: "if you modify too many words, you might actually degrade the level of entropy of the device," since people may think they are "capable of generating randomness, which we are not." And if you still distrust the device, Polto said, import the same first 23 words elsewhere and check that you get the same checksum word. "That's the danger with all these proprietary devices," he said. "How do you know that it's good entropy if you cannot verify the code?"

Coldcard also takes dice rolls, and so does Foundation's Passport, which Polto liked for its interface and open license, until a client needed more than ten accounts in one multisig. Passport could not do it, purely because the screen cannot show more than ten little dots for the page indicator. Specter DIY, by contrast, accepts any account number or derivation path, which Darko noted can even help privacy through blinded xpubs, "signers who don't know where they're participating until the last moment."

As for cost, Polto said the STM discovery board at the heart of a Specter DIY is about 62 euros, works as a minimal signer over USB or microSD, and you can add a QR scanner and a case. A friend of theirs sells assembled units for 150 CHF.

The Client With 1,000 BTC

So I gave them a scenario. A client walks in and says he has 1,000 BTC. What do you tell him?

"First of all, we do not want to know about the amount," Polto answered. "In the end we are not a bank. We will just help the client to control and understand his own infrastructure." For an individual, that usually means diversifying hardware wallets and the places where keys live: a simple two-of-three or three-of-five, and sometimes even single sig. "We are doing only like quite conservative stuff." For clients who trust neither their government nor their local bank's safe deposit box, they set up multisigs with keys generated in different jurisdictions. Spending then means traveling to at least two of those places, a cost that is "fine" to bear at that size.

Then I made it harder: a 60-year-old man with two children who should inherit his coins. The easiest path today is Liana, with a main spending path for him and extra, time-locked recovery paths for the kids or for outside helpers. They would not yet trust it with 1,000 BTC, though, because it is new and recovery still depends on Bitcoin Core. The timelock is also limited: about 14 months in Liana today, "something like that," so you renew it periodically. Liana's hosted option, which they referred to as a safety net with external co-signers, trades a bit of privacy for convenience.

The more conservative route uses plain multisigs plus a pre-signed transaction that moves the coins to a multi-institutional multisig where professionals help the heirs recover. The risk is obvious once said out loud. "Whoever has this transaction simply can broadcast it," Darko said, and the network will accept it.

So I played the grumpy father: "Fuck you guys. That sounds complicated. I'm going to buy into the ETF." Fine by them. "ETF is probably the solution for some," Polto said, but "if you want some real Bitcoin," Hodling can abstract most of the complexity through its network of trusted co-signers: notaries, lawyers and financial intermediaries who can hold a key in your multisig if you want your setup to outlive you.

Drivechains, Nodes and Who Really Votes

Toward the end I asked what excites them about Bitcoin's future. Covenants? Drivechains? Ark? They laughed, then admitted they are not bullish on most of it. On drivechains, Polto liked the idea of doing testnets and sandboxes "on Bitcoin with Bitcoin instead of creating other currencies," but disliked that it makes the system controllable by miners rather than enforced by full nodes. (Paul Sztorc has since taken his own route, as he explained in S17 E21.)

We disagreed a little here, which I enjoyed. My point was that nodes can't be the voting body, because anyone can spin up a million of them. Polto's point was that nodes don't vote at all: "in Bitcoin full nodes are enforcing the vote for you for yourself. And if you enforce the same rules as the majority, you're on the same network as them." They recalled how the Speedy Trial push for Jeremy Rubin's CheckTemplateVerify almost triggered a user-resisted soft fork, and how power over Bitcoin spread over time from developers who were also miners to merchants, wallet makers and users. "It's not only miners or nodes. It's many different people, components, and things at play."

The Feature They Want and the Shamir Question

If they could add one thing to Bitcoin for self-custody, Darko said it came straight from that day's workshop: key rotation in a multisig without moving the funds. Today, replacing a lost or compromised key in a two-of-three means a new setup and a transaction. Proprietary MPC systems can rotate signers, but they usually mean giving up hardware wallets for general-purpose PCs or expensive HSMs, which makes your storage "not interoperable and not easy to migrate." FROST can rotate signers natively, but comes with "some really weird trade-offs," and Polto said they are not using it.

I asked about SLIP 39, the Shamir secret sharing standard from SatoshiLabs supported by Trezor and Keystone. "Technically, it's a good solution," Polto said, and Trezor's implementation has been well tested, but past Shamir schemes in other wallets were "really badly" done, and recovering on a different device is hard. The deeper problem, he added, is that Shamir rebuilds the full key on one device to sign. "If this device is compromised, you don't have the advantage of using multi-vendor multi-sig." With a real multisig, compromising one device is not enough.

The 3-2-1 Rule, Tamper Bags and Airport Scanners

The Hodling seed card I got from them has a rule on the back that applies to any backup, Bitcoin or not. Darko spelled it out: "three copies," on "at least two media, for example, high-quality paper and some piece of metal," and one copy "stored away from the others." They suggested 80 kilometers or more, since most natural disasters and political trouble are local. Each copy should include both media, and each should sit in a tamper-evident bag that gives you "a way to verify that they were not accessed." In short: "Three copies, two medium, one off-site. That's like not rocket science." Check every backup at least once a year, and if one has been tampered with, move your funds.

Polto added the nuance most people miss: a tamper-evident bag does nothing for a plain single-sig wallet, because if someone opened it, "your money is probably already gone." It becomes useful only when that one backup is not enough to steal the coins, thanks to a passphrase, a multisig or a seed XOR scheme.

Darko also warned against getting creative. Building your own exotic setup does not raise security; it raises confusion. One client stacked BIP 39 passphrases on top of every seed in his multisig, then forgot he had done it, and on all three of his CryptoSteel backups he swapped the first 12 words with the last 12. The checksum gave the swap away quickly. Figuring out the passphrases took "few hours" of detective work. "So, don't overdo."

Then came the airport story. Darko said they had tested metal seed backups under a radiology machine and could "align the plates so that it's like perfectly readable." I told them about my own experiment flying to Argentina with a CryptoSteel capsule on a chain around my neck. Only in Romania did security make me open it, and I told them it was my Bitcoin password. Polto pointed out my mistake: in most countries, crossing a border with undeclared money is a crime, and he said US customs agents can ask you to plug in and unlock your Ledger or Trezor, then read your extended public key to see what you hold. Decoy wallets with $10 on them help, but "people are not stupid" if your social media says you are a Bitcoin OG. Their advice: never travel with seeds unless they are protected by a passphrase or multisig and sealed in tamper-evident bags.

Not Your Node, Not Your Keys

How do you reach them? Through hodling.ch, or at conferences. They were starting multisig workshops on the road with their friends from Nodl, for five to ten people at a time, at events like BTC Prague and Baltic Honey Badger. The goal, Darko said, is that you "leave the workshop with a functioning setup," including your own node, because, as Polto put it, the whitepaper's abstract already names the two things you need: be a peer on the network and hold your own keys. (If you need convincing on the node part, start with 10 reasons to run your own full node.)

For the lightning round, I asked each to pick one hardware wallet: Darko said "BitBox02" and Polto said "Specter DIY." On desktop, Polto picked Specter Desktop and Darko picked Sparrow; on mobile, Darko went with BlueWallet. Blockstream Green got a polite "it's nice," but its default two-of-two, which falls back to a second key controlled by Blockstream and unlocked by email or SMS codes, is not what they would pick now that miniscript can do better. If you want a company inside your multisig, there are Casa, Unchained and now Liana. Hodling itself does not hold keys for its customers.

The last story was the most Swiss of all. When they started the company, Darko said, they asked FINMA what it would take to hold one key out of five in a client's multisig. The answer: even partial signing power makes you a financial intermediary who needs a license, even though you "cannot do anything technically" on your own. What frustrates Polto is the double standard. Some projects present their federations and bridges as something other than multisigs and get away with it, while an honest multisig co-signer that cannot stop the client from signing without it is still treated as an intermediary.

I closed with homework. If you made it this far, write "321" in the comments. It means three copies of your backup, on two kinds of media, with one stored outside your house. It is the bare minimum, and it is more than most people do.

Listen to Polto & Darko on Spotify, Apple Podcasts, YouTube, and More

Time stamps:

1. 00:00:50– Introducing Polto & Darko
2. 00:01:33– Top Hardware Wallets
3. 00:02:06– Trade-offs in Multi-Signature Wallets
4. 00:03:25– Importance of Secure Elements
5. 00:04:37– Passphrase Usage and Security
6. 00:06:06– Confusion Around Passphrases
7. 00:07:14– Backing Up Passphrases
8. 00:08:02– BIP 39 and Passphrase Features
9. 00:09:39– Derivation of Wallet Addresses
10. 00:10:01– Standardization of HD Wallets
11. 00:11:19– Best Practices for Backups
12. 00:12:06– Verifying Recovery Procedures
13. 00:12:57– User Experiences with Backups
14. 00:15:31– Full Node Users
15. 00:17:15– Historical Context of Hardware Wallets
16. 00:18:15– Trade-offs in Hardware Wallet Design
17. 00:20:35– Open Source Developments
18. 00:22:43– Secure Elements and Verification Concerns
19. 00:22:48– Understanding Secure Elements in Wallets
20. 00:24:08– Ledger Wallet Features
21. 00:24:41– Using Seed Signer with Satochip Smart Cards
22. 00:25:53– Open Source Secure Element Development
23. 00:26:38– Challenges in Hardware Wallet Evolution
24. 00:27:30– Miniscript Support in Hardware Wallets
25. 00:28:45– Complexity of Multi-Signature Setups
26. 00:29:46– Standardization in Multi-Sig Wallets
27. 00:30:45– Experimental Nature of Taproot Mini Script
28. 00:32:12– Using Phones as Signing Devices
29. 00:34:38– Security of Bitcoin-Only Wallets
30. 00:35:06– Attack Surfaces in Multi-Coin Wallets
31. 00:39:10– Specter DIY vs Other DIY Wallets
32. 00:40:04– Entropy Modification in Seed Generation
33. 00:42:30– Trust Assumptions in Proprietary Devices
34. 00:43:50– Limitations of the Passport Wallet
35. 00:46:14– Introduction to Specter DIY Wallet
36. 00:46:43– Pricing of Specter DIY
37. 00:47:02– Development of Secure Element Boards
38. 00:48:03– Client Consultation for Bitcoin Security
39. 00:48:30– Multi-Signature Wallet Recommendations
40. 00:50:21– Considerations for Children Inheriting Bitcoin
41. 00:51:00– Using Liana for Bitcoin Management
42. 00:52:43– Risks of Pre-Signed Transactions
43. 00:53:00– Adapting to the Bitcoin Network
44. 00:53:25– ETF vs. Self-Custody
45. 00:53:58– Role of Co-Signers in Multi-Signature Wallets
46. 00:57:59– Future of Bitcoin and Exciting Innovations
47. 00:58:45– Concerns About Drivechains
48. 01:00:33– Consensus Mechanisms in Bitcoin
49. 01:02:42– User Activated Soft Forks
50. 01:06:00– Key Rotation in Multi-Signature Wallets
51. 01:06:41– Emerging Solutions in Multi-Signature Technology
52. 01:08:05– SLIP39 and Shamir Secret Sharing
53. 01:09:16– Shamir Secret Sharing Implementation
54. 01:10:44– Multi-Sig vs. Shamir
55. 01:12:01– Importance of Multi-Sig
56. 01:13:20– 3-2-1 Backup Strategy
57. 01:14:15– Tamper Evident Storage
58. 01:15:24– Annual Backup Verification
59. 01:16:14– Using Passphrases with Multi-Sig
60. 01:17:12– Backup Complexity Risks
61. 01:19:43– Traveling with Backups
62. 01:22:08– Customs and Crypto Assets
63. 01:25:14– Workshops on Multi-Sig
64. 01:25:53– Node Importance in Bitcoin
65. 01:26:51– Hardware Wallet Recommendations
66. 01:29:07– Blockstream Green Discussion
67. 01:31:27– Trusted Co-Signers Network
68. 01:31:37– Legal Restrictions in Switzerland
69. 01:32:08– Contacting FINMA
70. 01:32:50– Frustrations with Regulatory Definitions
71. 01:33:49– Backup Principles
72. 01:34:12– Closing Remarks
73. 01:34:26– Recapping the Best Practices for Bitcoin Storage