Start with assets and consequences
Record what the wallet controls, how quickly funds may be needed and what a loss would mean. A daily spending wallet and long-term savings wallet need different controls.
Include more than bitcoin: seed backups, passphrases, device access, descriptors, labels and inheritance instructions may all affect recovery or privacy.
Separate theft from loss
Theft threats include malware, phishing, physical theft, malicious support, coercion and someone finding an exposed backup. Loss threats include device failure, forgotten passphrases, fire, accidental destruction and heirs lacking instructions.
A control can reduce one risk while increasing another. A hidden passphrase may resist backup theft but can permanently lock out the owner if it is forgotten.
Map trust and exposure
List every person, device, service and location that can affect the wallet. Ask what each party can learn, approve, block or recover.
A hardware wallet isolates signing, but the connected computer still supplies transaction details. Verify the destination and amount on the signing device rather than trusting the computer display alone.
Design layers with independent checks
Useful layers can include a maintained signing device, verified backups, a PIN, physical separation, spending limits and a separate watch-only wallet. More layers are not automatically better if they depend on one undocumented secret.
Protect privacy as well as spending authority. Extended public keys, address labels and transaction histories can expose sensitive information even when they cannot sign.
Test and revisit the model
Run a recovery exercise without risking the main wallet. Confirm that the backup, passphrase, derivation details and instructions reproduce the expected addresses.
Review the model after moving, changing devices, increasing the balance or involving another person. A threat model is a living decision record, not a product checklist.
Visual recap
From threat to tested control
Each control should answer a named risk and include a safe recovery path.
List assets
Name threats
Rank impact
Choose controls
Test recovery
Review changes
Key takeaways
- Different wallets justify different security designs.
- Theft prevention and loss prevention can pull in opposite directions.
- Every trusted person, device, service and location belongs in the model.
- Verify transaction details on the signing device.
- Recovery tests reveal gaps that a written checklist can miss.
Lesson recap
Check what you learned
Reveal each model answer, then honestly mark whether you understood it or need another review.
1 of 3
Recall
Why can adding a passphrase increase wallet risk?
References
