Chapter 10. Keeping your bitcoin safe
Every number in the book has a source. To keep the book short, the notes live here instead of in print. Each source is listed with the section of the book it supports and the words it backs up, in the order they appear in the chapter. Web addresses are links; a page may have moved since the date shown.
The chapter page · Chapter 9 sources · All chapters · Chapter 11 sources
(opening): “Your keys, your bitcoin. Not your keys, not your bitcoin”, “Andreas M. Antonopoulos, a line he has repeated since at least 2016”
Andreas M. Antonopoulos, on Twitter after the August 2016 Bitfinex hack, “Your keys, your bitcoin. Not your keys, not your bitcoin,” as reported by Cointelegraph, “Antonopoulos: Your Keys, Your Bitcoin. Not Your Keys, Not Your Bitcoin,” August 10, 2016, cointelegraph.com, retrieved September 2026.
Mt. Gox, 2014: “It was named in 2007 for a plan to trade cards for…”
Robert McMillan, “The Inside Story of Mt. Gox, Bitcoin’s $460 Million Disaster,” Wired, March 3, 2014 (the name came from a 2007 plan to trade Magic: The Gathering cards; the site became a bitcoin exchange in July 2010).
Mt. Gox, 2014: “it filed for bankruptcy protection in Tokyo and said that about”, “Three weeks later, 200,000 coins turned up in an old wallet” and 1 more
Mt. Gox Co., Ltd., petition for civil rehabilitation, Tokyo District Court, February 28, 2014, reporting a loss of about 750,000 customer bitcoin and 100,000 of its own; withdrawals halted February 7, 2014 (Duane Morris LLP, client alert, March 2014, duanemorris.com, retrieved September 2026; CoinDesk, “Mt. Gox Files for Bankruptcy,” February 28, 2014, coindesk.com, retrieved September 2026). Recovery of about 200,000 coins in an old-format wallet, confirmed March 7, 2014 and announced March 20, 2014 (CNBC, “Mt.Gox says it found 200,000 bitcoins in ‘forgotten’ wallet,” March 20, 2014, cnbc.com, retrieved September 2026). Share of trading: about 70% of bitcoin transactions in 2013 (Stanford Review, “What happened at MtGox?,” April 22, 2014, stanfordreview.org; CoinDesk, “The Legacy of Mt. Gox,” May 4, 2023, coindesk.com; both retrieved September 2026). Repayments: Mt. Gox rehabilitation trustee Nobuaki Kobayashi, “Notice regarding Commencement of Repayments in Bitcoin and Bitcoin Cash,” June 24, 2024, and repayment progress notices July and August 2024, mtgox.com, retrieved September 2026; CoinDesk, “Mt. Gox to Begin Repayments in July,” June 24, 2024, coindesk.com, retrieved September 2026.
Mt. Gox, 2014: “The price of a bitcoin, which had touched about $1,150 late in”
CNBC, “Bitcoin falls below $200, making some investors worry about downward spiral,” January 14, 2015, cnbc.com, retrieved September 2026 (2013 top of about $1,150; January 14, 2015 low of about $170); Federal Reserve Bank of St. Louis, FRED series CBBTCUSD (Coinbase bitcoin price), daily closes of $204 on January 15, 2015 and $199 on January 16, 2015, fred.stlouisfed.org, retrieved September 2026.
FTX, 2022: “FTX was an exchange based in the Bahamas, run by a”, “FTX filed for bankruptcy on November 11, 2022, with about $8 billion”
FTX Trading Ltd. and affiliates, voluntary Chapter 11 petitions, U.S. Bankruptcy Court for the District of Delaware, November 11, 2022; John J. Ray III, written testimony before the House Financial Services Committee, December 13, 2022 (commingling of FTX.com customer assets with Alameda Research); U.S. Attorney’s Office, Southern District of New York, press release on the sentencing of Samuel Bankman-Fried, March 28, 2024, justice.gov, retrieved September 2026 (“stealing over $8 billion of his customers’ money”). Bahamas headquarters: CoinDesk, September 27, 2022, coindesk.com, retrieved September 2026. FTX Arena naming rights (Miami, 2021, 19 years, $135 million) and Bahamas base: NPR, November 24, 2022, npr.org, retrieved September 2026. Super Bowl LVI commercial with Larry David, February 2022, and Tom Brady endorsement: CBS News, cbsnews.com, retrieved September 2026.
FTX, 2022: “The founder, Sam Bankman-Fried, was convicted of fraud in November 2023”
United States v. Bankman-Fried, U.S. District Court, Southern District of New York; U.S. Attorney’s Office, Southern District of New York, statement on the conviction of Samuel Bankman-Fried on seven counts, November 2, 2023, and press release on his sentencing to 25 years in prison, March 28, 2024, justice.gov, retrieved September 2026.
FTX, 2022: “They were repaid in dollars at the price of bitcoin on the”
FTX debtors, proposed valuation of customer claims at petition-date prices, filed December 27, 2023, U.S. Bankruptcy Court for the District of Delaware, setting bitcoin at $16,871 as of November 11, 2022 (Bitcoin.com News, December 28, 2023, news.bitcoin.com, retrieved September 2026; Cointelegraph, “FTX debtors propose $16,871 Bitcoin price for creditor claims,” December 2023, cointelegraph.com, retrieved September 2026). Plan of reorganization confirmed October 7, 2024 (The National, October 12, 2024, thenationalnews.com, retrieved September 2026).
FTX, 2022: “Celsius, Voyager and BlockFi, companies that held customers’ bitcoin and paid” · The custody ladder: “In May 2025, Coinbase disclosed that criminals had bribed overseas support staff”
Voyager Digital, Chapter 11 petition, July 5, 2022; Celsius Network, Chapter 11 petition, July 13, 2022; BlockFi, Chapter 11 petition, November 28, 2022 (American Bar Association, Business Law Today, “The Crypto Bankruptcy Wave,” March 2023, americanbar.org, retrieved September 2026). Coinbase data breach: Coinbase Global, Form 8-K, May 14, 2025, sec.gov, and Help Net Security, “Coinbase suffers data breach, gets extorted (but won’t pay),” May 15, 2025, helpnetsecurity.com, retrieved October 2026 (support contractors bribed for customer names, addresses and account data; Coinbase refused a $20 million ransom).
FTX, 2022: “Regulators later found that most of the missing money was the founder’s”
Ontario Securities Commission, QuadrigaCX: A Review by Staff of the Ontario Securities Commission, June 2020, and OSC news release, “OSC publishes investigative report of QuadrigaCX,” June 2020, osc.ca, retrieved September 2026 (Gerald Cotten died in India in December 2018; the exchange collapsed in early 2019; the OSC found about $115 million of the $169 million shortfall came from Cotten’s fraudulent trading rather than lost passwords).
When to climb: “a hardware wallet costs roughly $60 to $250 as of 2026”
Blockstream Store, Jade $67 to $79, Jade Core $99, Jade Plus $149 to $169, store.blockstream.com, retrieved September 2026; Trezor Safe 3 $79, Safe 5 $169, Safe 7 $249 (BitDegree comparison, updated September 29, 2026, bitdegree.org; bitcoins.tools, March 2026); Ledger Nano S Plus $79, Nano X $149, Nano Gen5 $179, Flex $249, Stax $399 (Coin Bureau, Ledger review, June 24, 2026, coinbureau.com, retrieved September 2026). Trezor and Ledger store pages load prices dynamically and could not be captured directly.
12 or 24 words: “drawn from a fixed public list of 2,048 English words”
Palatinus, Rusnak, Voisine and Bowe, “Mnemonic code for generating deterministic keys,” BIP-39, 2013.
12 or 24 words: “Once you count the built-in checksum, a part of the last word…”
BIP 39, “Mnemonic code for generating deterministic keys,” github.com/bitcoin/bips: a 12-word phrase carries 128 bits of randomness plus a 4-bit checksum; a 24-word phrase carries 256 bits plus 8.
What 2026 taught: “One maker disclosed that a firmware update it shipped in 2021 had”, “People who had generated their seed with at least 50 of their own”
Coinkite’s own Coldcard security disclosure and technical write-up, July 30, 2026, on its website and blog, retrieved September 2026 (flaw introduced March 2021 with a firmware update; seed generation fell back to a software random-number routine instead of the hardware generator; effective search space about 40 bits on older models and about 72 bits on newer ones, against 128 intended; seeds made with at least 50 private dice rolls not exposed by this issue alone; updating firmware does not repair an existing seed). Follow-up analysis: TRM Labs, “The Largest Hardware Wallet Exploit of 2026: Inside the USD 116 Million Coldcard Hack,” August 5, 2026, trmlabs.com, retrieved September 2026.
What 2026 taught: “another maker found that devices sold through an unauthorized reseller” · Where people are moving, and why: “In 2026, respected voices began to say that advice is not right for everyone” · Who pays you back?: “it has said plainly that crypto assets are not insured”, “A fund held at a brokerage comes closest, through SIPC protection”
Ledger, security disclosure confirming a hardware implant in devices sold by a reseller, October 2026, ledger.com; Crypto Briefing, “Ledger confirms draining cases linked to CryptoBilis-sold devices,” October 11, 2026 (early estimates of $72 to $93 million from more than 300 wallets, most of it in USDT on Tron; the reseller sold in Indonesia, Malaysia, and the Philippines; Ledger’s direct channels unaffected), retrieved October 2026. Updated: CoinDesk, “Ledger says unauthorized implant found in at least one device sold by CryptoBilis,” October 12, 2026 ($86 to $93 million, more than 300 wallets); Bitquery on-chain count through October 16, 2026 (about $102 million across 335 wallets, 78% of it USDT); Help Net Security, “Hidden implant in Ledger hardware wallets linked to $93M theft,” October 12, 2026, helpnetsecurity.com; Bitcoin.com News, “Ledger Confirms Hidden Hardware Implant in Affected User’s Wallet” and “User Exposes Hidden Hardware Implant in European Ledger Wallet,” October 11, 2026, news.bitcoin.com; Protos, October 9, 2026, protos.com; all retrieved October 2026. Ledger customer data leak, December 2020: The Block, “A detailed look at the Ledger data leak,” December 2020, theblock.co, retrieved October 2026. Jack Mallers, “Hardware wallets are riskier than you think,” The Jack Mallers Show, Ask Jack segment, October 2026. Views on ETFs and self-custody (PlanB, Ophelia Snyder, Jameson Lopp, Adam Back): DigitalToday, citing Cointelegraph, October 13, 2026, digitaltoday.co.kr, retrieved October 2026. Who pays you back: FDIC, “Financial Products That Are Not Insured by the FDIC,” fdic.gov, and FDIC, “Advisory to FDIC-Insured Institutions Regarding Deposit Insurance and Dealings with Crypto Companies,” FIL-35-2022, July 29, 2022; SIPC, “What SIPC Protects,” sipc.org; iShares Bitcoin Trust ETF, Form 10-K for 2024, sec.gov (Coinbase Global commercial crime insurance of up to $320 million, shared among Coinbase’s customers and not specific to the Trust); Coinbase, “Insurance and Protections,” coinbase.com/legal/insurance (digital currency not FDIC or SIPC insured; crime policy excludes losses from compromised login credentials; USD pass-through FDIC coverage up to $250,000); Coinbase Global, Form 8-K, May 14, 2025 (voluntary reimbursement of eligible retail customers); Bybit hack of about $1.5 billion, February 21, 2025, with customer assets backed from company funds (Reuters, February 2025); Unchained, “Unchained vs AnchorWatch,” unchained.com (Unchained “does not sell consumer-facing custody insurance”; AnchorWatch minimum $250,000, premium 0.40% to 0.80% of insured value a year); No Bullshit Bitcoin, “AnchorWatch Launches in the U.S.,” January 7, 2025, nobsbitcoin.com; Crypto Briefing on Bitkey’s Emergency Exit Kit, 2025, cryptobriefing.com; Office of the Comptroller of the Currency, Interpretive Letter 1183, March 7, 2025, and FDIC, FIL-7-2025, March 28, 2025; all retrieved October 2026.
What 2026 taught: “One maker disclosed that a firmware update it shipped in 2021 had…”
TRM Labs, “The Largest Hardware Wallet Exploit of 2026,” trmlabs.com ($116 million); Galaxy Research estimate of about 1,367 BTC, about $88.6 million, across about 4,585 addresses; eSecurity Planet on the random-number flaw.
What 2026 taught: “And a multisig wallet, the two-of-three setup from rung four, stayed safe as”
Galaxy Research (Alex Thorn), on-chain tracing of the sweep waves, as reported by TFTC, August 5, 2026, tftc.io (“zero multisig wallets have been identified in any of the high-confidence promoted waves”); Decrypt, August 14, 2026, decrypt.co (more than 5,200 addresses drained, about 1,778 bitcoin confirmed); crypto.news, August 4, 2026; all retrieved September 2026.
Multisig: “It runs about $250 a year at the basic tiers as of September 2026”
Casa, pricing page, Standard plan $250 per year, casa.io, retrieved September 2026; Unchained, pricing page, Personal Vault $250 per year, unchained.com, retrieved September 2026.
Multisig: “Bitkey, made by Block, packages a fixed two-of-three into a device”
Bitkey (Block, Inc.), “How it works,” bitkey.world, retrieved September 2026 (2-of-3 multisig with one key on the phone, one in the hardware device and one on Bitkey’s server; “No seed phrase”).
Worth repeating: “In 2020 the research firm Chainalysis estimated that roughly 3.7 million bitcoins”
Chainalysis, bitcoin market analysis, June 2020, estimating about 3.7 million bitcoin unmoved for five years or more, about 20% of supply at the time, as reported by Decrypt, “Lost Bitcoin: 3.7 million Bitcoin are probably gone forever,” January 3, 2021, decrypt.co, retrieved September 2026; River Intelligence, “How Much Bitcoin Is Gone Forever?,” September 6, 2023, river.com, retrieved September 2026 (3 to 4 million bitcoin irreversibly lost).
Worth repeating: “One man in Wales has spent more than a decade petitioning a city”
Howells v Newport City Council [2025] EWHC 22 (Ch), High Court of Justice, Chancery Division, judgment of HHJ Keyser KC, January 9, 2025, dismissing the claim over a hard drive holding the keys to 8,000 bitcoin discarded in August 2013 (Local Government Lawyer, January 10, 2025, localgovernmentlawyer.co.uk; Hausfeld, “Waste not, want not,” 2025, hausfeld.com; both retrieved September 2026).
Found a broken link or a mistake? Write to [email protected] and I will fix it.