Keep control of your Bitcoin without carrying the risk alone.
The Bitcoin Adviser helps families and long-term holders build client-controlled multisig structures with professional key agency, clear documentation, and continuity support, so their Bitcoin is not dependent on one person, one device, or one point of failure.
Client-controlled multisig · Professional key agency · No unilateral TBA control · Since 2016
Educational and operational support only. We are not custodians and do not provide financial, tax, legal, or investment advice. Scope, risks & important information →
The problem with Bitcoin custody is not just theft. It is fragility.
Exchange custody
Convenient, but introduces platform, withdrawal, insolvency, and counterparty risk.
Solo self-custody
Powerful, but fragile when meaningful Bitcoin depends on one person, one device, one backup, or one memory.
Full third-party custody
Simple, but gives up the control that makes Bitcoin different.
Collaborative security
A middle path: client-controlled Bitcoin with professional key agency, documented procedures, and continuity support.
Client-controlled multisig, with professional support around the key structure.
Your vault has three keys. You control one. The Bitcoin Adviser controls one. The vault company, Theya or Unchained, controls the third. Two of the three keys must approve a transaction before the Bitcoin can move. Only you can initiate a transaction.
No single party can move Bitcoin alone. You remain in a client-controlled structure. The client controls initiation. Two parties control approval. No party controls the Bitcoin alone.
This layer sits underneath how Bitcoin is used over time, including spending and income paths. For educational framing on capital allocation trade-offs (not advice), see Bitcoin income and capital allocation. How day to day and fallback signing work: How signing works.
Only you can start a transaction. Two of the three keys must approve it before Bitcoin can move. No single party can move funds alone. Orange paths show one example pair of approvals.
Control map
| Role | Holds a key? | Can initiate spends? | Can move funds alone? |
|---|---|---|---|
| You | Yes | Yes | No (needs a second approval) |
| Vault company (Theya or Unchained) | Yes | No | No (needs a second approval) |
| The Bitcoin Adviser | Yes | No | No (needs a second approval) |
Only you can initiate a spend. Day to day, the second approval usually comes from TBA. The vault company can also provide a second approval as a fallback, subject to its own security checks. See How signing works. For hardware and device guidance, see Security Centre.
Only you can start a transaction. Two keys must approve it before Bitcoin can move.
Your vault has three keys. You control one. The Bitcoin Adviser controls one. The vault company, Theya or Unchained, controls the third.
Only you can initiate a transaction. TBA and the vault company can approve a transaction you have started, but neither can initiate one themselves.
After you initiate a transaction, two of the three keys must approve it before the Bitcoin can move. Normally, those approvals come from you and TBA.
Before TBA approves the transaction, your adviser completes a Confirmation Call with you. The call provides security checks and guidance. It is not a freeze or permission system. TBA will only approve a transaction after completing its security checks. If TBA cannot assist, that does not make TBA permanently necessary to access the Bitcoin.
TBA cannot initiate a transaction, move your Bitcoin alone, or lock you out. If TBA were unavailable, you could still initiate a transaction and seek the vault company’s second approval, subject to its security checks.
Theya and Unchained use their company key differently
- Theya: Theya can help approve a move to a newly created vault. The previous vault is then retired, and the replacement setup is completed with your adviser.
- Unchained: Unchained can approve a transaction directly from the existing vault. Depending on what has happened, the Bitcoin may still be moved to a new vault afterward.
If anything appears wrong or urgent, contact your adviser. Do not attempt an unfamiliar recovery process by yourself. New clients: the step by step send path is on Onboarding.
Three independent keys, protected in different ways
Your Bitcoin is protected by three separate keys: your key, The Bitcoin Adviser key, and a third key held by your vault provider (Theya or Unchained).
Neither The Bitcoin Adviser key nor the Theya or Unchained provider key was generated on, or is stored on, a Coldcard. The Coldcard seed-generation incident therefore does not affect those two keys.
These keys are created independently, held by different parties, and protected through different technologies and security systems. A vulnerability affecting one device type does not automatically affect the other keys in your vault. No single key can move your Bitcoin.
The Bitcoin Adviser key
The Bitcoin Adviser key was created by combining independent randomness from the signing device and a separate computer.
That means it did not depend on a single source of randomness. Even if one source had been flawed, the other still provided the unpredictability required to create a secure key.
The Bitcoin Adviser key was not generated on, and is not stored on, a Coldcard.
The provider key
The provider key is separate from both your key and The Bitcoin Adviser key. It was not generated on, and is not stored on, a Coldcard.
- Theya: The provider key is generated using dedicated hardware and stored within specialised, tamper-resistant security infrastructure. The key remains inside that protected environment and is only accessible through authorised Theya systems.
- Unchained: The provider key is held under Unchained’s own enterprise security controls. Unchained states that its keys are protected through an in-house, geographically distributed security model and an independently audited control environment. Unchained does not publicly disclose the detailed technical design of that infrastructure.
How Theya and Unchained use their company key in a fallback differs. See How signing works.
Your key
Your key provides the third independent layer of protection and control. Some clients use a Coldcard for this key. Others use a different signing device.
Where a client key may have been affected by the Coldcard incident, it can be assessed and, where appropriate, replaced. The other two keys in the vault are separate from the Coldcard ecosystem and remain independently protected.
Why the structure matters
Your vault requires two of the three keys to approve a transaction. The Bitcoin Adviser key cannot move your Bitcoin by itself. The provider key cannot move your Bitcoin by itself. Your key cannot move your Bitcoin by itself.
That is the core resilience of collaborative security. A flaw, failure or compromise involving one key does not provide enough control to spend the funds. It becomes a managed key-replacement event rather than an immediate loss event.
The recent Coldcard seed-generation incident is a useful reminder that no device, manufacturer or security system should ever be treated as infallible. The strength of your vault does not come from trusting one key to be perfect. It comes from combining three independent keys, protected in different ways, and requiring two of them before any Bitcoin can move.
In a properly constructed TBA collaborative vault, that is why the recent Coldcard incident was a managed key-replacement event rather than a vault-fund loss event. See the Coldcard hack guide for current incident detail.
Professional key agency, without custody.
In a collaborative security structure, The Bitcoin Adviser may act as one key agent. That is the normal second approval for day to day sends, not the only possible second approval, and not a right to start transactions.
We can support authorised signing workflows, continuity events, and recovery scenarios, but we cannot initiate a client transaction, move client Bitcoin alone, pool assets, trade assets, or act without a transaction you have started.
Canonical explainer: what key agency means as a signing role, and why it is not custody, is on Key Agent. How initiation and approvals work: How signing works. How each key is protected: How keys are protected.
What this means in practice
- You remain in a client-controlled multisig structure.
- Only you can initiate a transaction.
- TBA may hold or operate one key under documented policy, where agreed.
- No single party can move funds alone.
- TBA approves after documented checks; TBA may decline its own key if those checks are not satisfied.
- Key agency supports continuity without becoming custody or making TBA permanently necessary.
- Full boundaries: Scope, risks & important information.
What The Bitcoin Adviser helps put in place
Custody architecture
Client-controlled 2-of-3 multisig, signer roles, vault partner coordination, and implementation guidance.
Key agency
A documented TBA co-signing role where agreed, with authorisation and verification controls.
Governance documentation
Authorisation maps, role clarity, transaction procedures, review notes, and continuity runbooks.
Continuity planning
Processes for device loss, signer changes, incapacity, death, role turnover, and family handover.
Education for stakeholders
Clear explanations for clients, beneficiaries, trustees, advisers, and family members. Deeper workshops and pathways: Education & Advisory.
Ongoing review
Periodic checks so keys, devices, documents, advisers, and family roles do not drift over time.
Built for the moments when ordinary self-custody breaks down
- A device is lost or damaged.
- A key holder becomes unavailable.
- A signer changes phone, location, or role.
- A spouse or beneficiary needs guidance.
- A transaction request looks unusual.
- A family office, trustee, or adviser needs a clear process.
- A platform needs to be migrated.
- A plan has not been reviewed in years.
- A device manufacturer discloses a flaw affecting how one key was generated.
- A firmware fix is released, but an existing seed still needs to be replaced.
- A signing device or wallet provider must be changed without exposing the Bitcoin.
Security failures become managed replacement events
In single-signature custody, one compromised seed can expose the whole wallet. In a properly constructed collaborative vault, one compromised key cannot move the Bitcoin alone. The affected key still needs to be replaced, but the remaining independent signing structure provides a controlled path to rotate the key or move to a replacement vault. See the Coldcard hack guide and Hardware Wallet Security pages for current examples.
Collaborative security does not remove every risk. It reduces avoidable single points of failure and gives clients a documented process when life changes.
Insurance may compensate for a covered loss after a custody failure. Collaborative security is designed so that one provider’s failure cannot cause the loss in the first place. Why security architecture comes before insurance →
For emergency events, use the Bitcoin Emergency Kit. For legal authority, beneficiary readiness, and Estate Plan Protocol detail, see Estate Planning & Inheritance. For claim scoping and risk boundaries, see Scope & Risks.
Inheritance is where custody structure gets tested.
Legal authority alone does not recover Bitcoin. Collaborative security gives families a structure of roles, signers, documentation, and education that can support an Estate Plan Protocol.
This page explains the custody model. For legal authority, beneficiary readiness, and Estate Plan Protocol detail, use our dedicated guides.
Experience with meaningful Bitcoin custody
Loss record (scoped)
No client satoshis lost to key compromise or theft in our collaborative security engagements, based on internal records. Historical information only, not a guarantee.
Since 2016
Bitcoin custody and operational security experience across market cycles. How this methodology evolved →
Global client base
600+ families, individuals, and entities supported to date.
Transparent pricing
Annual fee model and what it covers: Pricing.
Reference facts about how we operate, not guarantees about your outcomes.
No unilateral control, clear procedures, survivable continuity.
"The biggest challenge I needed to overcome in getting comfortable with self-custody of Bitcoin was the security risk. The Bitcoin Adviser sorts that in one fell swoop. Having my own personal contact to boot puts icing on the cake!"
"Self custodying my BTC with TBA's services has allowed me to feel safe for my own retirement and my family's future. Pete and Andy are the most generous of people with their time and care, always accessible."
Reviewed by Peter Dunworth
Explore Liquidity and Custody Tradeoffs
Borrow vs Sell Explorer
Compare selling Bitcoin for liquidity versus borrowing against your stack. Educational scenarios for discussion with your advisers.
Bitcoin Allocation Explorer
Explore illustrative exposure bands before you secure or borrow against holdings.
Common Questions
Is this self-custody?
Yes. Your bitcoin remains in client-controlled self-custody.
We are not custodians; assets do not sit on our balance sheet. Only you can initiate a transaction. Two of the three keys must approve it before Bitcoin can move.
Can The Bitcoin Adviser move my Bitcoin without me?
No. TBA cannot initiate a transaction and cannot move your Bitcoin alone.
Normally, you and TBA approve a send together after a Confirmation Call. Full detail: How signing works.
What is key agency?
Key agency means TBA may serve as the normal second approval within your vault, under a documented signing policy.
It is not custody: TBA cannot initiate a transaction, move funds alone, pool assets, or make itself permanently necessary. Read the doctrine: Key Agent. Full boundaries: Scope, risks & important information.
How are the three keys protected?
Your key, The Bitcoin Adviser key and the vault provider key are created independently, held by different parties and protected through different security systems.
Neither the TBA key nor the Theya or Unchained provider key was generated on, or is stored on, a Coldcard. No single key can move Bitcoin alone. Full detail: How keys are protected.
What happens if I lose a device or a key?
Losing one device or key usually does not freeze funds. Two of the three keys must still approve a move.
If you still control a client key, you can initiate a transaction and seek the second approval needed. Day to day that is TBA. As a fallback, the vault company can provide a second approval, subject to its security checks. Theya and Unchained use that fallback differently. See How signing works. For triage, use the Bitcoin Emergency Kit.
Can TBA stop me accessing my Bitcoin?
TBA cannot permanently lock you out.
TBA cannot initiate a transaction or move your Bitcoin alone. TBA will only approve after its security checks. If TBA were unavailable or unable to assist, you could still initiate a transaction and seek the vault company’s second approval, subject to its security checks. See How signing works.
Am I locked in?
You are not locked in.
You can migrate or restructure if your situation changes, for example a new jurisdiction or a different key layout. We can help you transition safely. The goal is resilient client-controlled custody, not permanent lock-in.
How does this support inheritance?
Collaborative security pairs multisig with documentation and education so fiduciaries have an executable path.
Use an Estate Plan Protocol where you have one. Legal authority, beneficiary readiness, and EPP detail: Estate Planning & Inheritance and EPP Guide.
Do you provide investment advice?
No. We do not provide investment, tax, or legal advice, and we do not run discretionary portfolios.
Our role is custody architecture, signing policy, documentation, and continuity support.
Is multisig visible on-chain?
Yes. Multisig vaults use on-chain scripts, so the structure is visible on the public ledger.
What is not exposed is private key material. Collaborative security is about governance and recovery, not hiding that you use multisig.
Where should I start?
Newer to Bitcoin control: start with the Security Centre and Education & Advisory.
For a quick single-point-of-failure check, use the Risk Assessment. Ready to talk: Book a custody review.
Ready to review your Bitcoin custody structure?
Book a custody review to understand whether collaborative security, key agency, and continuity planning fit your situation.
Not ready? Start with the Risk Assessment.