a thief needs minutes... so give yourself days

tuesday morning i talked to a co-founder of a swiss bitcoin security company. he'd booked the call with a fair question. where do i stand on what they're building?

i've been in bitcoin since 2011. i've watched a lot of people lose coins. so here's where i stand.

the network is not the weak spot. it never was. the weak spot is the person holding the keys. a hack. a mistake. a fire. and more and more, someone at the door.

he said it plainly. the people holding bitcoin are exposed, and in some places physical attacks on holders have become a real problem. as an industry, he said, it's been devastating.

his whole company comes from one observation about how theft actually happens.

an attacker needs minutes.

a hacker who gets into your machine wants the coins out before you notice. someone who shows up in person wants it done before they leave. the attack is fast because it has to be.

so they made time the defense.

every payment from their vault waits. you choose the delay ahead of time, from a couple of hours up to two weeks. the payment sits on hold and you get an alert right away. if it wasn't you, you cancel. if someone forced you, you cancel after they're gone. and nobody can shorten the countdown, not even you, because it's enforced on chain.

the attacker needs minutes. you get days.

pair that with multisig, three keys, so losing one doesn't lock you out and stealing one doesn't get the thief anything until the clock runs out. the company holds one of the three keys and can never move your coins alone. the code is open source, so you don't have to take their word for it. you can check.

i asked about the shoebox. how many people keep a seed phrase in a drawer and call it security? more than he'd like, he said. and he gets why, it feels safe. but a single seed phrase is all or nothing. if the box burns, it's gone. if a burglar finds it, it's theirs.

here's what i like about this, beyond the product.

for years self custody got sold as a test of how hardcore you are. hold your own keys or you're not a real bitcoiner. that message worked on people like me. it doesn't work on a family, a small business, someone who just wants to save. they want to hold their own bitcoin and sleep at night. those two things shouldn't be in conflict.

time delays get you closer. so does what he told me they're building next. setups where a professional, an advisor or a notary, holds one key for a client without ever being able to move the coins alone. the kind of trusted help a bank gives you, without handing the bank your money.

his practical advice was to split it up. most of what you don't need to touch goes in a vault with a long delay. smaller amounts sit behind shorter delays. spending money can live in a hot wallet. security is a spectrum. you pick the spot for each pile.

and he was honest about the catch. if you miss the alert and the delay runs out, the payment goes through. the delay buys you time. you still have to be the person paying attention.

long term, this is how bitcoin reaches billions of people. not by asking every one of them to become a security expert. by building tools where the default protects you, and the attacker's need for speed becomes the thing that beats him.

i've written about self custody and why it matters in the bitcoin book.

so where are your keys right now... and how many minutes would a thief need?