Separate daily spending from long term reserves
Design access around what each person actually needs. The following is an illustrative model to review with a custody specialist, not a recommendation to move assets immediately or choose a particular provider.
| Layer | Purpose | Proposed boundary |
|---|---|---|
| Daily spending | Ordinary expenses and a limited trip budget | Loss should be financially tolerable; avoid reserve recovery access on the same phone |
| Operations | Planned trading, payroll or business activity | Documented limits, approved destinations and independent verification for exceptions |
| Reserves | Long term assets | Deliberate access process, independent controls and tested recovery |
Set limits in a currency amount you can afford to lose, with a plan for market movements. A percentage alone can leave an enormous amount accessible. Include exchange balances, derivatives collateral, API permissions, connected banking and wallet approvals in the exposure total.
Examine what can bypass the separation
Can one person reset every account? Can a support desk remove a withdrawal delay? Can a cloud account restore all signers? Can an administrator change a smart account module? Are two approval devices controlled by the same password manager? Does a recovery path silently undo the normal controls?
A multisignature arrangement requires a threshold of owners for its ordinary approval path. Some smart account modules can provide alternative execution paths. Review the deployed configuration, signers, permissions and recovery mechanisms, not just the label “multisig.” [S15]
MPC and institutional custody introduce different dependencies, including provider availability, legal authority, recovery and administrator permissions. Ask what happens during a provider outage, disputed instruction, death, incapacity or compromise. A licence or audit does not make those risks disappear.
Treat coercion as a human safety problem
Independent signers and genuine delays may limit immediate theft, but an attacker can still hurt someone, extend captivity or threaten another signer. Do not advertise your custody structure or assume explaining it will end an attack. A decoy wallet, hidden passphrase or memorised denial script is not a reliable protection plan.
Agree emergency escalation with professionals before travel. Do not improvise automatic ransom transfers, automatic asset destruction or a “panic” action that could worsen danger.
Test with small values: normal transfer, loss of one device, one unavailable signer, replacement of a signer and recovery after the owner cannot participate. Record outcomes without recording secrets.