Custody Blueprint

Safety comes from design, not from the device.

How to choose a cold wallet, how to design around it, how to keep it running, and how to end it properly. These figures are the thinking we actually use when we help someone set one up.

None of this ranks products. The same device can be safe or fragile depending on how custody is designed around it — that gap is what these are about.

Example

A one-person company

One owner who also does the books and signs every transaction. This is one way that company might hold its wallets.

Hardware ×3 Metal backup ×2 Hot wallets ×3

Cold — hardware wallets Most of the assets live here

  • Long-term Desk-type ×1 The company's reserves. Treated like the safe. A few times a year
  • On the move Pocket-type ×1 For signing away from the office. Move in only what the trip needs. When needed
  • NFT display Display-type ×1 Holds NFTs to look at. No approvals are ever signed from it. Never signs

Metal backup ×2 The long-term device's seed, stamped in metal and kept in two separate places. Fire or flood at one does not end it.

Hot — apps on a phone or PC

  • Exchange relay Passes funds between the exchange and cold storage. Nothing is left here.
  • Payments Paying suppliers and being paid. About a month's worth.
  • DeFi approvals Only for signing approvals. Kept close to empty.

A one-person company has one weak point above all: only the owner knows how to recover the funds. Leave a written note of where things are and how recovery works — not the seed itself — and record every wallet address in the company's asset register for the accountant.

Devices that fit this setup

Ask us to put this set together

Scope

Hot, cold or MPC

Each of the three is clearly the right answer under certain conditions. Cryptoparts Akihabara works in the middle one — cold storage, on hardware wallets or HSMs.

Hot wallet

Small amounts that move every day

The key lives on a phone or PC that is online.

Clearly the answer when

  • You send or receive several times a week
  • You approve DeFi or NFT contracts
  • Losing it would not stop the business

Remaining riskMalware and phishing reach the key directly

Our scope

Cold wallet

Most of the balance

The key is generated and kept inside a dedicated device, and never leaves it.

Clearly the answer when

  • It moves a few times a month or less
  • One to a few people look after it
  • You want no monthly fee and no vendor to depend on
  • Someone must be able to take over one day
Hardware wallet Individuals to small companies. The cost is the device and nothing after. See the devices
HSM Companies that sign from their own systems, or must show auditors where the key is. Ask about HSM

Remaining riskLoss, failure and mis-signing. The backup and the rules around it decide the outcome

MPC

Many approvers, signing daily

The key is never in one place. Several parties share the work of signing.

Clearly the answer when

  • Approvals cross several departments
  • Limits and approval paths must be enforced by the system
  • The monthly fee is small next to the volume

Remaining riskYou depend on the vendor. If the service stops, so does signing

Most people and most small companies need two of these, not one: a hot wallet for what moves, and a cold wallet for what stays. MPC earns its cost once approvals involve many people every day.

Custody Blueprint

Four figures for designing custody, from choosing a device to retiring it.

Custody Blueprint 01 Ten steps

Set up

  1. Choose Match the use and the holdings
  2. Buy Through an authorised channel
  3. Initialise Generate the key yourself

Operate This part repeats

  1. Use Verify before every signature
  2. Back up Test that it actually restores
  3. Update Check the official source first

Retire

  1. Replace Have the next device ready
  2. Migrate Move every asset out
  3. Wipe Erase the device itself
  4. Dispose Keep the record of it

Commonly covered Where design makes the difference

Custody Blueprint 02 Five layers
  1. DeFi Weekly

    Where approvals are signed. Contain the damage here

    5%
  2. Everyday Weekly to monthly

    Small transfers and test sends

    10%
  3. Secondary Every few months

    What you expect to move within the year

    25%
  4. Long-term A few times a year

    The bulk of the holdings. Left alone

    60%
  5. Escape Never, until it matters

    Kept empty. You cannot move to a wallet you have not made

    Empty

The bar is roughly how much sits in each layer. Reading down, you touch it less and hold more — that is the whole point. A layer you open every week should never be the one holding the balance.

Custody Blueprint 03 Which setup fits
  1. Single device Small holdings Rarely moved Individual

    One device ＋ one metal backup

    Move on when: the balance grows, or you start approving contracts

  2. Two layers Medium holdings Moved monthly Individual

    Long-term device ＋ everyday device

    Move on when: you use DeFi routinely, or someone else must be able to take over

  3. Three layers Any size DeFi routinely Individual

    Long-term ＋ everyday ＋ a device only for approvals

    Move on when: more than one person needs to sign

  4. Company, small team Medium holdings A few times a month 2–3 people

    2-of-3 multisig, or two devices with a written approval record

    Move on when: signing becomes weekly, or an auditor asks for the trail

  5. Company, treasury scale Large holdings Signs often Company

    MPC, or multisig with internal controls around it

    Before you move on: price the setup fee, the monthly cost and the admin load. They are the real decision

The axes are deliberately only three — size, how often it moves, and whether one person or several. In practice those decide it. Nothing here is a ranking: a larger setup run badly is worse than a small one run well.

Custody Blueprint 04 What each approach costs
Hardware only One device does the whole job
Up frontOne device
MonthlyNone
To signOne person
To recoverThe seed phrase
Admin loadLight
FitsIndividuals to small companies
What stays riskyOne person and one seed. Loss or inheritance stops it
Multisig Several keys, some of them required
Up frontTwo or three devices
MonthlyNone to small
To signn of m
To recoverEach seed ＋ the wallet configuration
Admin loadModerate
FitsSmall to mid-sized companies
What stays riskyLose the configuration and the seeds alone will not restore it. Chain support varies
MPC The signature itself is split
Up frontA setup fee, quoted
MonthlyYes
To signWhatever the policy says
To recoverThe vendor's own procedure
Admin loadModerate to heavy
FitsMid-sized and up, signing often
What stays riskyYou depend on the vendor and their service. If it stops, you cannot sign

MPC is a sound design, and for a treasury that signs daily it earns its cost. It is not automatically the better answer: below a certain size, hardware devices combined well are easier to actually run. Price the monthly cost and the admin load before the technology.

Not sure which of these fits you? Tell us the size, how often it moves and who has to sign. We will suggest a setup — devices, backup and the rules around them.

Ask about your own setup