The complete cold-storage setup
Phase 1 — Hardware
- Buy hardware wallet directly from manufacturer. Ledger.com, Trezor.io, Coinkite.com (Coldcard), Foundation Devices, BitBox. Never Lazada / Shopee / Daraz third-party resellers — supply-chain risk is documented.
- Verify packaging on receipt. Holographic seal intact, no signs of tampering, batch number matches manufacturer record.
- Verify firmware before key generation. Connect device to Ledger Live / Trezor Suite / Sparrow / Specter. Confirm firmware signature matches the official release.
- Generate seed on device. The 24-word phrase appears only on the device screen. Never accept a "pre-configured" wallet. Never input the seed via computer keyboard.
Phase 2 — Seed Backup
- Write seed on paper first to verify the device displays the correct sequence. Use the manufacturer's recovery sheet.
- Transfer to metal backup within 7 days. Recommended: Cryptosteel Capsule (durable but pricier), Coinplate Alpha (cheaper, good), Bitkey metal plate (newer option). Stamp letters individually; verify against original.
- Destroy paper copy once metal verified — burn + shred or commercial document destruction service.
- Test verify the metal backup — read it; reconstruct seed; verify device matches. Don't skip this step.
Phase 3 — Geographic Distribution
- Store hardware wallet and seed metal at different addresses. Hardware at home; metal at bank deposit box (or trusted family member's house, or office safe).
- Consider Asian climate. Humidity in SG/MY/PH/ID/TH can corrode lower-quality metal plates. Stainless steel + protective wrap for tropical climates.
- Consider political risk. Some Asian jurisdictions (CN, VN restricted areas) impose customs / search at points of entry. Plan accordingly if traveling with hardware wallet.
- Document the location map. Sealed envelope with executor saying "hardware = home safe, seed = bank box, additional key = lawyer." Never list seeds themselves.
2-of-3 multisig deployment (the gold standard)
Setup procedure
- Buy 3 separate hardware wallets — mix brands (Ledger + Trezor + Coldcard) to reduce single-brand supply-chain risk.
- On each device, generate independent seed phrase. Each device's seed is separate; no shared randomness.
- Extract xpub (extended public key) from each device. Save xpubs + 2-of-3 descriptor in Sparrow Wallet or Specter Desktop on a non-internet computer.
- Verify the resulting Bitcoin address on each device individually before depositing.
- Distribute keys: Key 1 home safe, Key 2 bank deposit box, Key 3 trusted family member or lawyer or collaborative-custody provider.
- Store seed backups separately from corresponding devices — never co-located.
- Test recovery annually: assemble 2 of 3 keys, sign a small transaction, broadcast. Document who-was-in-the-room.
Geographic key distribution for Asian users
- Singapore + Hong Kong residents: One key at home, one in bank box (DBS / HSBC), one with a trusted family member or lawyer's escrow
- India residents: Home + bank box + family member in a different city; consider Singapore custodian as third key for cross-border resilience
- UAE residents: Home + ADGM/DIFC bank box + offshore (Hong Kong or Singapore) for additional jurisdictional diversification
- Japan + Korea residents: Home + bank box + trusted family/lawyer; Singapore custodial third key for international diversification
- Philippines + Indonesia + Vietnam: Climate consideration critical — robust metal backups; consider Singapore family-office or Hex Trust as third key
- Crisis-zone residents (Myanmar, Afghanistan): One key with diaspora family abroad; one key local; one key with international custodian
Threats your setup must withstand
Online attacker tries to drain wallets. Cold storage by definition keeps keys offline. Solved by air-gapped signing.
Burglar takes hardware wallet from house. Multisig prevents loss — burglar lacks remaining keys. Solved by 2-of-3.
Single location loss. Multisig with geographic distribution preserves access. Solved by separating keys.
Physical compulsion to transfer funds. Plausible-deniability passphrase (BIP-39 passphrase) hides bulk of holdings; small "duress wallet" can be revealed under coercion.
Court order seizes accessible holdings. Distributed-key multisig where some keys are outside jurisdiction provides resilience. Be aware of disclosure obligations.
You die; heirs lack access. Sealed-envelope SOPs + collaborative-custody provider as one signer enables recovery. See Inheritance Asia.
FAQ
Is a Ledger Nano S Plus enough for cold storage?
For balances under 0.5 BTC: yes, with proper seed backup discipline. For larger balances: combine with multisig setup to eliminate single-point-of-failure. Ledger Nano S Plus is a good first device; pair with Trezor + Coldcard for diversified multisig.
Should I use a BIP-39 passphrase?
Yes for advanced users; carefully for beginners. A 25th-word passphrase creates a hidden wallet — a duress wallet at the base seed (with small balance) and a passphrase-protected wallet (with main balance). Lose the passphrase = lose the wallet permanently. Memorize + backup passphrase separately.
How often should I check my cold storage?
Verify balance via watch-only wallet (xpub) monthly. Test recovery procedure annually with small transaction. Replace hardware wallets every 5-7 years as they age. Most users underestimate hardware longevity for cold storage; replacement is rarely emergency.
What's the difference between cold storage and hardware wallet?
Hardware wallet is the device (signs transactions offline). Cold storage is the practice (keys never touch internet-connected device). A hardware wallet kept connected via USB while signing many transactions isn't quite "cold." Most disciplined users keep their hardware wallet in a safe and only retrieve for occasional transactions.
Should I use Shamir's Secret Sharing (SLIP-39)?
Trezor supports SLIP-39 natively. Good for splitting seed across multiple geographies without multisig complexity. Trade-off vs multisig: SLIP-39 reconstructs the original seed when recovering — multisig keeps each key independent permanently. Both are valid; multisig is more common for >$100K holdings.