Security Centre
Protect Your Bitcoin & Digital Perimeter
Bitcoin security is not just about private keys. Your email, cloud accounts, phones, password manager, recovery documents and family processes can all become part of the attack surface.
All resources are free. No sign-ups required.
Four layers
The layers show how security fits together. Open any layer. You do not need to complete them in order, and finishing all four is not a claim of safety.
Perimeter
Email, password manager, security keys, cloud accounts, devices.
Holding
Where the bitcoin sits, the signing device, the seed, backups.
Control
Who can authorise a transaction, how the keys are held, recovery arrangements.
Continuity
Incapacity, death, device loss, family emergencies.
Warnings deskChecking current warningsShow the listHide the list
The kinds of threat that hardware-wallet, seed, firmware and custody incidents fall under, what a 2-of-3 vault limits, and what it does not. Each published incident sits under its type with who it applies to and when we last reviewed it.
Supply-chain tampering
A device is altered or swapped before it reaches you, so it is compromised from the day you set it up.
- What multisig limits
- In a 2-of-3 vault, a tampered device holds one key. One key cannot move the Bitcoin.
- What it does not stop
- A tampered device can still show you false details. Multisig does not stop you approving a transaction the device misrepresents, and a single-signature wallet on a tampered device has no second check at all.
- What to do
- Buy from the manufacturer only, check the device and packaging on arrival, and generate a new seed on the device yourself. If a warning names the seller you bought from, follow it.
Weak seed generation
The randomness used to create a seed is predictable or flawed, so someone else can work out the same seed.
- What multisig limits
- If a weak seed protects one key in a 2-of-3 vault, whoever recovers it holds one key, not the Bitcoin.
- What it does not stop
- Updating the device does not repair a seed it already generated. A weak seed on a single-signature wallet is the whole wallet, and the fix is to move the funds to a new seed.
- What to do
- Know which device and firmware generated each seed. When a flaw is published, check whether your seed was generated under the affected versions, and replace that key if it was.
Firmware flaws
A flaw in the software on a signing device lets an attacker read secrets or change what the device signs.
- What multisig limits
- A flaw in one device compromises one key. The other two keys are held separately, so that device cannot move the Bitcoin alone.
- What it does not stop
- It does not protect the key on the flawed device, and a fix only helps once it is installed. Some flaws mean the key must be replaced, not just the firmware updated.
- What to do
- Update firmware only through the manufacturer's own app or website, after reading the release notes. Never install firmware from a link someone sent you.
Impersonation and scams
Someone pretends to be support, a manufacturer, an exchange or The Bitcoin Adviser to get your seed, your codes, or your approval for a transaction.
- What multisig limits
- A stolen seed for one key in a 2-of-3 vault cannot move the Bitcoin alone.
- What it does not stop
- Multisig does not stop you being talked into starting and approving a transaction yourself. If you send to a scammer's address, the vault has worked as designed. Spends greater than 1% also require DocuSign, cooling-off and a Confirmation Call, which give you time to stop, but they are a check, not a guarantee.
- What to do
- The Bitcoin Adviser will never ask for your seed phrase, private key, signing-device PIN or 2FA code. End the conversation, then contact us using the details on this website.
Not a current incident, and always worth reading: Hardware Wallet Security. Understand device vulnerabilities, weak seeds, firmware fixes and safe migration for any hardware-wallet incident.
Which layer needs attention first
A short check on the same four layers. It names one layer and one next room. A strong password and a hardware wallet can sit beside a single point of failure in inheritance, and the result will say so.
Perimeter
Perimeter
Holding
Control
Continuity
Continuity
No names, balances, addresses, or seed words. Never type those into any website. Your answers are saved only in this browser. Check sends them to our server to work out the result, and it doesn't keep them. Explain also sends them to our AI model provider, with a request not to store them.
Answer the questions. A rule names one layer and one next room. There is no score, and no result here says an arrangement is safe.
Want a full review?
Bitcoin Risk Assessment
Audit your custody setup, inheritance readiness, and operational controls with prioritised next steps.
Bitcoin Security Quiz
Scenario-based questions on custody failures, attack vectors, and best practices with immediate feedback.
Layer 1 of 4, from the outside in
Perimeter
Email, password manager, security keys, cloud accounts, devices.
Why Perimeter Security Matters
Protecting Your Entire Digital Life
Without Perimeter Security
- Email compromise leading to account takeovers.
- SIM swap attacks bypassing 2FA.
- Cloud storage breaches exposing sensitive data.
- Device theft or loss without proper protection.
With Proper Perimeter Security
- Hardware security keys protecting critical accounts.
- Strong, unique passwords for every service.
- Encrypted backups and secure device management.
- Layered defense reducing attack surfaces.
Email, Accounts and Identity
Two-Factor Authentication Guide
Enable 2FA on email and critical accounts with official setup links for major providers.
YubiKey Security Guide
Hardware authentication for email and cloud accounts; strongest protection against SIM swap and phishing.
Password Manager Guide
Password managers dramatically reduce common account-takeover risk with unique, strong passwords for every account.
Protect Yourself from Bitcoin Scams
Bitcoin Scam Protection Guide
Identify common Bitcoin scams, spot red flags, and know what to do if you are targeted.
Layer 2 of 4, from the outside in
Holding
Where the bitcoin sits, the signing device, the seed, backups.
Self-Custody and Key Management
Bitcoin Self-Custody Guide
Foundational guide from wallets and keys to multisig and self-custody best practices.
Hardware Wallet Guide
Set up and maintain hardware signing devices for collaborative security vaults.
Hardware Wallet Security
Understand device vulnerabilities, weak seeds, firmware fixes and safe migration for any hardware-wallet incident.
UTXO Management
Understand and manage UTXOs for lower fees, stronger privacy, and long-term usability.
Reference
Bitcoin Travel Rule (Australia)
Plain-English guide to AUSTRAC’s crypto Travel Rule from 1 July 2026: exchanges, self-custody withdrawals, and what changes at the regulated boundary.
Bitcoin Forks & Chain Splits
Understand soft forks, hard forks and what a wallet provider’s node choice can mean for a collaborative multisig vault.
Layer 3 of 4, from the outside in
Control
Who can authorise a transaction, how the keys are held, recovery arrangements.
Two of the three keys must approve it.
Only you can initiate a transaction through your secure vault account. Neither The Bitcoin Adviser nor the platform provider can initiate transactions through the normal platform workflow.
- You hold key 1, and only you can initiate a transaction.
- The vault moves when any two of the three keys sign.
- The Bitcoin Adviser holds key 2 as key agent, not as custodian.
- The wallet provider, Theya or Unchained, holds key 3.
The Bitcoin Adviser is the key agent, not a custodian. Losing one device or key usually does not freeze funds.
Choose two keys to see which can move the Bitcoin.
Who can move the bitcoin
Collaborative-security playbook
A working checklist for collaborative 2-of-3 security with a Trezor, and a check on whether your family is ready.
Canary monitoring
Watch a small Bitcoin canary associated with one key. If it moves, investigate. If it stays unchanged, treat that as a useful signal, not proof.
Physical Attack Preparedness
Reduce exposure and control who can reach you, then learn how collaborative security limits what coercion can achieve against a vault — without overpromising physical safety. Decoy wallets remain optional and narrow.
Layer 4 of 4, from the outside in
Continuity
Incapacity, death, device loss, family emergencies.
Family and heirs
Inherited Bitcoin? Start Here
Crisis guide for executors and heirs: identify storage, gather documents, avoid common mistakes.
Estate Plan Protocol
A private continuity asset issued to clients after onboarding, so spouses, executors and heirs can begin the right recovery process without exposing private keys.
Collaborative-security playbook
A working checklist for collaborative 2-of-3 security with a Trezor, and a check on whether your family is ready.
Securing Your Mobile Devices
iPhone Mobile Key
How an iPhone mobile key works in TBA 2-of-3 collaborative vaults: device protection, iCloud Keychain restore, and emergency fallback.
Lost iPhone Guide
Immediate steps if you lose a phone that holds Bitcoin keys or mobile signing access.
Collaborative security with a Trezor
Four parts: the signing device, how the three keys are held, how recovery works, and whether your family is ready. Progress stays in this browser.
Playbook version 2026-11-01, reviewed 1 November 2026. Progress never leaves this device.
Security Is A Journey, Not A Destination
Need Help Implementing Security?
These guides are free. Our advisers can help you implement hardware wallets, YubiKeys, password management, and emergency procedures.