Self-custody without going to cold storage — the middle path most users need

There's a common misreading of self-custody that goes: "to really do it right, you need an air-gapped hardware wallet in a safe, ideally with a passphrase you only enter on a Faraday-shielded laptop you bought with cash". That's a model. It's not the model, and for most users it's the wrong model — too much friction for the actual threat level, which means they never quite finish setting it up, and the funds stay on the exchange instead.

This is the fifth article in the Self-Custody Fundamentals series. The previous post laid out what self-custody actually requires of you across five categories of work. This one is about the spectrum of self-custody itself — and why the right answer for most people sits in the middle, not at the cold-storage end.

TL;DR

• Self-custody isn't a single setup. It's a spectrum: from a hot mobile wallet you sign with all day, to a fully air-gapped multisig vault that takes 30 minutes to open.
• The right point on the spectrum depends on threat model, how often you transact, and how much you hold.
• "Cold storage" usually means an air-gapped hardware wallet that never touches an internet-connected device. Real cold storage is operationally heavy and reserved for treasury-sized holdings.
• For most users, the right point is warm storage — a non-custodial wallet on devices you use daily, with the keys split across two devices so neither alone signs. SSP's 2-of-2 is built for this point on the curve.
• "Daily-driver" hot wallets (single-device, single-key, mobile) are fine for spending money. They are not where significant balances should live.

The actual spectrum

Self-custody isn't binary. It exists on a continuum that roughly goes:

1. Custodial. Not self-custody. The exchange holds the keys. See the seven failure modes post.

2. Single-key hot wallet. Self-custody, but with the entire keyset on one device that's online most of the time. MetaMask on a desktop, Phantom on a phone, a basic Trust Wallet. Convenient, low friction, but the entire wallet is one bug or one malicious extension away from drained.

3. Single-key cold wallet. A hardware wallet (Ledger, Trezor, Coldcard) that signs offline and connects briefly to push transactions. The key never touches a hot machine. Stronger than hot, but still single-point-of-failure on the seed phrase, and friction enough that users stop using it for everyday spending.

4. Multisig hot wallet. Two or more keys, but all on online-ish devices. SSP's 2-of-2 sits here — one key on the browser extension, one on the phone. Both signatures required; neither device alone can move funds. The two devices are different attack surfaces, so a compromise of one doesn't drain the wallet.

5. Multisig with one cold key. Same as 4 but at least one signer is an offline hardware device. More resistance to remote attack, more friction for routine sends.

6. Fully cold multisig vault. All signers are offline, often physically distributed. The setup BitGo, Casa, or Unchained Capital sells for institutional-scale storage. Recovery and signing both involve in-person ceremonies. Days to weeks of operational latency per transaction.

The cliché advice "use cold storage" implicitly means option 6. That's correct for a treasury. It's overkill for an individual with five figures of crypto who wants to participate in DeFi occasionally.

What "cold storage" actually means (and why most people don't need it)

Cold storage is a strict commitment: the signing key never touches an internet-connected device. Not a laptop with WiFi turned off — a laptop that has never had WiFi enabled. The implications:

• Air-gapped signing. You build a transaction on a hot machine, transfer it (via QR code or microSD) to the cold device, sign there, transfer the signed transaction back. Every send is a workflow.
• Separate device. The cold device should not be your phone or laptop. A dedicated hardware wallet or an old-but-wiped laptop that lives in a drawer.
• Physical security. Cold storage that lives in a desk drawer in an unlocked apartment isn't really cold. The whole point is to make remote attack impossible, which means physical access is now the threat — so it lives in a safe, a deposit box, or a geographically separated location.

This is the right model for a few specific situations:

• A long-term holder who genuinely does not plan to touch the funds for years.
• A treasury (personal or corporate) holding amounts where any operational latency is acceptable to reduce attack surface to near-zero.
• Inheritance or generational holdings where the optimization is decade-scale, not day-scale.

For everyone else, cold storage's friction undoes its security. The pattern that's killed countless users: they buy a hardware wallet, set it up, then either (a) leave it in a drawer and never use it because the workflow is annoying, while the funds sit on the exchange waiting for them to "finally move them", or (b) lose the device and the seed isn't backed up properly because the cold-storage discipline was never internalized.

A multisig hot wallet that you actually use beats a cold wallet that you don't.

Warm storage: where most users should live

"Warm storage" isn't a standard term, but it captures the right idea: keys on devices you actually use, with the security model strong enough to survive realistic attacks.

The defining properties:

• Multiple keys, multiple devices. A compromise of one device — a malicious browser extension, a phone with a stolen unlock — should not drain the wallet. The 2-of-2 model handles this directly.
• Different attack surfaces per key. A browser extension and a mobile app are different code, different OSes, different threat profiles. An attacker that compromises both at once is doing something very specific to you.
• Low transaction friction. Sending a routine transaction should not take 20 minutes and a microSD card. It should take a tap on each device — five seconds of marginal effort, not five minutes.
• Honest recovery story. Lose one device, you can still recover via the other plus the wallet-recovery flow. Lose the seed entirely, you're in trouble — but seed-phrase best practices addresses that layer.

For an individual user holding $1k–$100k who interacts with DeFi or signs transactions weekly, warm storage is the right answer. You get the security improvement that matters — no single device compromise drains you — without paying the air-gap tax for every transaction.

When you should add cold storage on top

There's no rule that says "warm storage instead of cold storage". For amounts that justify the operational cost, the right answer is both: a warm wallet for routine activity and a cold setup for the savings layer.

A reasonable allocation for a user with serious holdings:

• Hot wallet (a small mobile-only setup): spending money, daily DeFi interactions. Treat the balance here like cash in a wallet — enough for the next two weeks, not your life savings.
• Warm wallet (SSP 2-of-2 or equivalent multisig on your daily devices): the operating account. Hundreds to low five figures. Where most transactions originate.
• Cold wallet (air-gapped hardware multisig, or a single cold signer): the savings layer. Five-figures-and-up that you don't plan to touch for months or years. Recovery procedures documented, in inheritance plans, with a key in a deposit box or with family.

The split isn't arbitrary — it's the same logic banks apply to checking vs. savings vs. CDs. Funds in active use stay warm. Funds in long-term storage go cold. Each tier accepts the friction appropriate to its holding period.

For most users the cold tier doesn't exist yet, because the warm tier is sufficient. As balances grow, the cold tier gets added.

What this means for you

Three takeaways:

1. Don't let "cold storage" be the reason you stay on an exchange. A warm multisig you actually use today is dramatically safer than a cold setup you'll get around to next month. Move the funds first, refine the model later.
2. Match the setup to the threat model, not the marketing. If your realistic threat is a malicious browser extension and a clipboard-replacer — and for almost all retail users it is — a 2-of-2 split between browser and mobile defeats both. A Faraday cage in a basement does not buy you more security against the actual threats you face.
3. Plan to graduate the savings layer over time. As your holdings grow, the right answer probably shifts from "all warm" to "warm + cold". Don't try to do both on day one; do the warm setup correctly first, and add the cold layer when the amount justifies the operational cost.

The next and final article in this series, self-custody checklist for your first $1,000, walks through the concrete steps a new self-custody user should take, in order — designed for the first meaningful amount of crypto you hold, not the tenth.