Security & Self-Custody

Protect your crypto: seeds, phishing, hardware, threat models.

Self-custody is hard because attacks are creative. This collection walks through the threats that actually catch users: phishing pages, fake support DMs, malicious dApps, lost seeds, and how SSP's 2-of-2 model neutralises most of them.

Square SSP Academy cover: address poisoning and lookalike crypto addresses

Address poisoning: the attack that only needs you to copy the wrong thing

No malware, no phishing site, no signature stolen. The attacker just puts a lookalike address in your transaction history and waits for you to copy it. Why 'always double-check the address' fails, and what actually defends against it.

7 min
SSP Academy square cover: the Coldcard entropy bug and two-device architecture

When the Randomness Fails: The Coldcard Entropy Bug and What Two Devices Change

A single 2021 commit made thousands of seeds guessable, and $116M left wallets that had done nothing wrong. Why weak entropy is silent, total loss — and the honest limits of what 2-of-2 protects against.

6 min
SSP Academy square cover: MPC wallets vs multisig

MPC Wallets vs Multisig

Threshold signatures split a key; multisig requires several. What the chain enforces, what each one costs, and which failures each model actually survives.

8 min
SSP Academy square cover: transaction simulation in SSP Enterprise

Transaction Simulation: What a Transaction Will Do Before You Sign It

A preview of a transaction's effects, fourteen warning checks, address-poisoning detection — and why none of it is allowed to block your signature.

8 min
SSP Academy square cover: critical actions and re-signing in SSP Enterprise

Critical Actions: Why Some Operations Ask for Both Devices Again

Thirteen operations need re-signing, not a session cookie. Why the server writes the challenge, what it is bound to, and why failed attempts are logged too.

6 min
SSP Academy square cover: what actually stops a transaction

What Actually Stops a Transaction

Whitelists, time locks and approval rules shape what gets proposed. Only the signature threshold is enforced by the chain. A three-layer threat model, stated honestly.

6 min
SSP Academy cover for a guide to mobile two-factor authentication, with wallet, key, and shield icons on a dark background.

Mobile 2FA: The Right Way and the Wrong Way

SMS 2FA is weak. Learn why, when TOTP authenticator apps and passkeys beat it, and how SSP Key co-signs every transaction as a second key.

8 min
SSP security cover with wallet, key, shield, and chip icons for a crypto OpSec checklist

Your Crypto OpSec Checklist

Run this 15-minute quarterly OpSec checklist to audit your self-custody: keys, devices, approvals, accounts, phishing, and recovery.

6 min
Cover illustration with wallet, key, shield, and chip icons beside the title Supply-Chain Attacks and Deterministic Builds

Supply-Chain Attacks and Deterministic Builds

What a software supply-chain attack is, why crypto wallets are prime targets, and how deterministic builds and audits let you verify what you run.

7 min
Square cover for a guide on BIP-39 passphrases, with wallet, key, shield, and chip icons over an SSP security badge.

Passphrase vs No Passphrase: The Trade-off

A BIP-39 passphrase — the optional 25th word — can protect a stolen seed or lock you out for good. What it buys, what it costs, and how it compares to SSP.

7 min
SSP security cover with wallet, key, shield, and chip icons on a navy square card

Browser-Extension Hygiene for Crypto Users

Browser extension security for self-custody: vet what you install, apply least privilege, lean on LavaMoat, and let SSP's 2-of-2 backstop a bad extension.

6 min
SSP security cover with wallet, key, shield, and chip icons, illustrating a guide to crypto phishing attacks.

Phishing Attacks Targeting Crypto Users (and How to Spot Them)

Crypto phishing targets you, not the cryptography. Learn the patterns — wallet drainers, approval phishing, address poisoning — and how SSP helps.

7 min
Key, lock, shield, and database icons illustrating crypto inheritance and emergency access planning

Crypto Inheritance Planning: Emergency Access

Crypto inheritance planning means giving heirs a path to your funds without exposing the keys. Practical approaches, honest trade-offs.

7 min
SSP Academy cover with lock, eye-off, shield, and key icons titled If a Key Is Compromised

What Happens If a Crypto Wallet Key Is Compromised

A crypto wallet key compromised in a 2-of-2 multisig is an emergency, not stolen funds. How to recognize, contain, and rotate keys fast.

6 min
SSP Academy cover: Lost Both Devices, full recovery from your seed phrase

Restore Your Crypto Wallet From a Seed Phrase

Lost both your SSP devices? Restore the entire wallet from your BIP39 seed phrase with this calm, step-by-step full recovery walkthrough.

7 min
SSP Academy cover for recovering a wallet after a lost phone, with fingerprint, key, shield, and wallet icons

Recover a Crypto Wallet After a Lost Phone

Lost the phone running SSP Key? Restore SSP Key on a new device while the browser key keeps your funds safe in the 2-of-2.

8 min
SSP Academy cover for recovering a wallet after a lost browser, with key, shield, wallet, and lightning icons

Recover a Crypto Wallet After a Lost Browser

Lost the browser extension to a new computer or wiped profile? Recover your SSP wallet with SSP Key, no seed phrase needed.

7 min
Wallet Recovery 101 cover with key, shield, database and wallet icons

How to Recover a Crypto Wallet: Keys vs. Seeds

A clear guide to crypto wallet recovery: what a seed phrase, derived keys, and metadata each do, and what you actually need to restore a wallet.

7 min
Navy SSP cover for Self-custody checklist for your first $1,000, with wallet, key, shield and fingerprint icons over a dark gradient

Self-custody checklist for your first $1,000 — the concrete starter playbook

Eight ordered steps to set up SSP 2-of-2, write down both seeds, test recovery, and move your first $1,000 off the exchange in one afternoon.

8 min
Navy SSP cover for Self-custody without going to cold storage, with wallet, key, shield and lightning icons over a dark gradient

Self-custody without going to cold storage — the middle path most users need

Self-custody isn't a single setup. The right point on the spectrum is warm storage — a multisig you actually use — not air-gapped cold storage.

8 min
Navy SSP cover for What self-custody actually requires of you, with key, shield, fingerprint and CPU icons over a dark gradient

What self-custody actually requires of you — the honest list

Backups, opsec, device management, recovery planning, time and attention — the five-category bill self-custody puts on you, no marketing softening.

8 min
Navy SSP cover for The 7 failure modes exchanges can suffer, with shield, lock, hidden-eye and lightning icons over a dark gradient

The 7 failure modes exchanges can suffer (and what each one looks like)

Insolvency, hacks, freezes, exit scams, sanctions, KYC locks, withdrawal halts — the seven ways your funds can leave a custodial exchange.

9 min
Navy SSP cover for Custodial vs. non-custodial wallets, with wallet, key, shield and CPU icons over a dark gradient

Custodial vs. non-custodial wallets: definitions, trade-offs, and the wallets that quietly are one

What custodial vs. non-custodial actually means, the 12-word test that tells them apart, the wallets that pretend to be one and aren't.

7 min
Navy SSP cover with wallet, key, shield and CPU icons over a dark gradient, opening the Self-Custody Fundamentals series

Not your keys, not your coins: where the phrase came from and why it keeps coming true

Origin and meaning of the most-repeated and most-ignored sentence in crypto, with Mt. Gox, Celsius, and FTX case studies, and when ignoring it is rational.

7 min
A vault icon shielding a user wallet from an exchange logo, indicating self-custody

Why self-custody matters now

Self-custody means you hold the keys. Here's what custodial failure actually looks like, what self-custody is, and the honest trade-offs.

5 min
Twelve-word seed phrase printed on a paper card next to a hardware wallet

Seed phrase best practices

What a seed phrase actually is, how to store it without losing it or leaking it, and how SSP's 2-of-2 multisig changes the threat model.

7 min