The weakest link in Bitcoin security isn’t code, it’s coercion. Jonathan Pollock argued on What Bitcoin Did that vault designs using biometrics and time delays make kidnapping a Bitcoin holder pointless - the attacker can wait days or weeks, but the coins still require a second biometric scan to finalize. The goal is to outlast the attacker’s patience, as 99% of documented assaults end within a week.
Pollock contends the industry’s reliance on exportable seed phrases is an ‘instant compromise’ vector. By moving to seedless architectures where keys stay on hardware behind a fingerprint - like BitKey’s 2-of-3 setup with Block’s servers - the system protects users from self-sabotage. Matt Odell noted on Citadel Dispatch that many opt for ETFs or proxies like MSTR out of fear of losing access, but new tools are closing that technical gap.
"The industry must design for a scenario where the attacker has full knowledge of your setup and the victim is compliant, yet the coins remain unreachable."
- Jonathan Pollock, What Bitcoin Did
Inheritance, the persistent problem, is now automated. Bitcoin Keeper co-developer Ben Kaufman uses Miniscript to create absolute time locks on-chain. He explained on Citadel Dispatch that an heir’s key activates automatically after a preset period - two years, for example - if the owner doesn’t refresh the lock with a transaction. This turns the protocol into a self-executing trust, removing attorneys or central vaults.
Kaufman guides users from mobile hot wallets for small amounts to geographically distributed multisig for life savings, treating multi-sig as the gold standard. The progression makes self-custody feel like a natural extension of an app, not a leap into complexity. The choice, Pollock concludes, is no longer about complexity, but about which catastrophic failure you prefer: trusting politicians with an ETF, or trusting yourself with tools that are finally good enough.


