In this episode of the Sunny Ray Show, host Sunny Ray reconnects with self-custody expert Brandon Carbellas of Sovereign to unpack the fallout from a brutal two-week stretch in Bitcoin security. Carbellas explains how a flawed entropy generation process left many Coldcard users exposed, while his own clients, who generated their own entropy and often used multisig setups, remained protected. He reflects candidly on underestimating friends and family by assuming they could not handle the responsibility of self-custody, calling it a form of short-sighted, paternalistic thinking. The conversation moves into a broader discussion of sovereignty versus safety, comparing a caged lion to one roaming free, and framing modern convenience, from fiat banking to debt, as a softer version of slavery. Carbellas argues self-custody should be treated not as a single product choice but as an ongoing practice requiring seriousness, patience, and a real plan. He outlines a path forward for individuals and family offices, including starting small, learning gradually, and eventually adopting multi-key, multi-institution setups through services like Casa and Unchained for meaningful long-term security.
After Bitcoin's brutal two-week security crisis, Brandon Carbellas explains why self-custody must become a serious, hands-on practice, not a shortcut.
How have you been since our last conversation?
I've been great, though the last two weeks have been harrowing. I've been running on little sleep with high stress, but I think things are finally starting to settle. The wave is cresting now, so that's good.
What are you seeing on the front lines, and what pushed you to put out that public statement?
Personally and professionally we followed best practices, so everyone I recommended a Coldcard to, including myself, generated their own entropy and stayed protected. But I regret assuming friends and family couldn't handle self-custody. I dumbed them down like a central planner, and that was short-sighted on my part.
Can we talk about this spectrum of safety versus sovereignty?
Think of a lion in a cage, fed and safe but never free, versus a lion hunting on the Serengeti. Most people choose the caged life, outsourcing responsibility to the state, banks, and institutions. We've moved from physical slavery to debt slavery, and people don't realize how much of their soul is sacrificed for comfort and safety.
Is sovereignty talk sometimes too idealistic for regular people? What does an honest on-ramp look like?
I think you start small, put a modest amount into a simple hardware wallet like a BitBox, Trezor, or Jade, and learn how everything works. Meanwhile keep larger holdings in a multi-institution or multisig setup while you build understanding. Spend real time upfront making a plan before moving significant Bitcoin anywhere.
Have we been treating self-custody like a product choice when it's really an operating system or practice?
That's a good point I hadn't framed that way before. Self-custody was sold as an antidote to exchange hacks like Mt. Gox and FTX, but it's really a personal, ongoing decision that demands seriousness. We need to explain the value of sovereignty itself, not just position it as protection against past disasters.
What does a realistic middle ground look like for people who want control but won't become security experts?
At Sovereign we understand clients won't be security experts, so we customize plans and have people generate their own entropy. There's no silver bullet or single easy product. I'm not comfortable recommending serious setups to anyone unwilling to approach this with real gravity and dedicate genuine time to learning.
Can you explain why some multisig users stayed safe despite the flawed entropy issue, and what that means for a path forward?
If you had two Coldcards in a two-of-three multisig, you weren't actually safe, but no MK4 multisig setups have been tapped yet because breaking multiple layers of bad entropy requires far more compute. At Sovereign we recommend at least three key holders for high net worth individuals and family offices, often using services like Casa or Unchained.
Building something daring? Sunny talks to founders like this every day. Fifteen minutes to see if your story belongs on the stage.
Claim your pre-interview