Timechain Wiki

Loss vs exposure failure modes

17 min read

Every Bitcoin custody decision is a trade-off between two opposing failure modes: loss (you can no longer access your own Bitcoin) and exposure (someone else now can), and almost every defence against one makes the other worse — passphrases protect against exposure but introduce loss risk; geographically distributed multisig keys protect against single-location exposure but add loss risk if travel becomes impossible; Shamir-splitting protects shares individually but reconstructs the seed singularly at recovery. Loss has been the dominant failure mode in Bitcoin's history, with estimates putting permanently lost coins at 11-18% of supply (roughly 2.3-3.7 million BTC) and most of it self-inflicted rather than stolen, while exposure is more newsworthy but newer. Good design is not the absence of trade-offs but making trade-offs that can be articulated for a threat model that can be named. This note codifies the loss-vs-exposure lens that every other note in the Practical self-custody and sovereignty section refers back to.

Why this note matters

This is the foundational framing note for the Practical self-custody and sovereignty section. The loss-vs-exposure trade-off is the lens through which every other operational decision should be read — backup strategy, passphrase use, multisig adoption, key storage, inheritance planning — because every defence answers one failure mode and almost every defence makes the other worse.

Two specific reasons it matters: it establishes the trade-off vocabulary the operational notes use, turning decisions from puzzles into tractable trade-offs; and it corrects the availability heuristic that drives many self-custody decisions, since exposure attacks are newsworthy (Mt. Gox, Bybit, the wrench attacks Lopp catalogs) while loss is silent, and holders who optimize against the visible threat often over-engineer until complexity becomes the dominant loss risk.

The defensible position: every meaningful security decision should be articulable in terms of which failure mode it defends against, what the opposing failure mode looks like at the new setup, and why the trade is worth it.

The two failure modes

Loss

You can no longer access your own Bitcoin. The things you need in order to spend the coins have become unavailable to you. Concrete instances:

  • Your only seed phrase burns in a house fire.
  • You die with the passphrase memorised only in your head.
  • Your single hardware wallet fails and the “safe place” you wrote the seed phrase has been renovated and thrown out.
  • You set up a 2-of-3 multisig with three keys, two of which end up in the same flooded basement.
  • You forget a non-trivial passphrase you chose under stress years earlier.
  • You forget which derivation path you used for an old wallet and cannot find the descriptor.
  • Your heir cannot reconstruct what to do, even though all the materials still exist.

Loss has been the dominant failure mode in Bitcoin’s history. Chainalysis estimates the permanently lost share at roughly 2.3-3.7 million BTC — about 11-18% of the 21-million supply — with some analyses running as high as ~4 million; estimates vary with method and denominator (figures measured against circulating rather than maximum supply run higher, toward 20%). Almost none of that was stolen. It was forgotten, misplaced, mishandled, or never properly documented before the holder became unavailable.

Loss is structurally invisible. There is no event, no incident report, no news story when a seed phrase ends up in a landfill. The loss accumulates silently across the entire holder population.

Exposure

Someone else now has what they need to spend your Bitcoin. Concrete instances:

  • A hacker extracts your seed from a phone backup synced to a cloud account.
  • A phishing site tricks you into signing a malicious transaction.
  • A family member finds your seed phrase while tidying and photographs it “in case it’s important.”
  • A burglar finds your hardware wallet and your passphrase on the same shelf.
  • A coercive attacker — the “$5 wrench” — convinces you to cooperate.
  • A previously-trusted custodian goes bankrupt or is compelled by court order to freeze your funds.

Exposure is more visible than loss because it is more newsworthy and because the incidents are recent. The Mt. Gox 2014 hack, the Ledger 2020 customer-data leak, the Coinbase 2024 breach, the wrench attacks Lopp tracks (a 169% year-over-year jump in 2025 per the synthesis) — exposure dominates the public narrative about Bitcoin security.

Both failure modes are real. Both matter. Optimizing exclusively for either produces a setup that fails to the other.

The opposing-risks rule of thumb

The opposing-risks rule of thumb

Almost every defence against one failure mode makes the other failure mode worse.

Adding a passphrase on top of your seed protects against exposure (the seed alone is not enough) but introduces new loss risk (forget the passphrase, lose everything). Distributing multisig keys across three cities protects against exposure of any single location but introduces loss risk if you become unable to travel. Shamir-splitting a seed into shares protects against one share being stolen, but means the seed still has to be fully reconstructed in one place at recovery time — and at that moment it is singularly exposable again.

Good design is not the absence of trade-offs. Good design is making trade-offs you can articulate, for a threat model you can name.

This callout pattern is reusable. Every operational note in the section that discusses a security decision can deploy a variant of it to surface the specific trade-off being made.

The rule is not absolute. A small number of decisions improve both failure modes simultaneously — testing your backup, for example, reduces both the loss risk (you discover broken backups before you need them) and the exposure risk (you don’t end up improvising a recovery under pressure). But these decisions are rarer than they appear in security marketing, and most defences cited as “improving both” actually trade loss for exposure or vice versa in ways the marketer did not articulate.

How the trade-off plays out across the configuration ladder

Each rung of the Self-custody configuration ladder takes a position on the loss-exposure trade-off. The pattern is consistent: each rung addresses an exposure failure mode at the cost of new loss failure modes.

Single-sig on hardware wallet — the baseline. The seed is the single thing that must not be lost and must not be seen. Any single event that exposes the seed compromises everything. Any single event that destroys the seed without a redundant backup loses everything.

Single-sig + passphrase — adds defence against seed exposure. An attacker who finds the seed but not the passphrase finds an empty wallet. But the passphrase is now a single point of failure on the loss side: forget it, lose everything, even with the seed intact.

SLIP-39 / Shamir Secret Sharing — distributes the seed across N shares so that no single share is sufficient to expose the wallet. But at recovery time, the threshold of shares must be combined on one device, and at that moment the full seed exists singularly again, exposable to whatever compromises the reconstruction device.

DIY 2-of-3 multisig — distributes signing authority across three keys, no two of which can be compromised simultaneously. The exposure-side defence is strong. But the holder now manages six sensitive items (three hardware wallets and three seed backups), plus the wallet descriptor, plus the coordinator software. Complexity becomes the dominant new loss risk.

Collaborative 2-of-3 — outsources complexity to a partner who holds one key. The exposure-side defence is preserved (the partner cannot move funds alone). The loss-side is improved (the partner provides recovery support, complexity is reduced for the holder). But a new exposure pathway opens up: the partner knows you hold Bitcoin, and the partner can fail.

3-of-5 multisig — adds redundancy and tolerates two simultaneous losses. But now eight items are managed (five keys, three seed backups required for quorum recovery, the descriptor). The complexity is greater. For most holders, the additional fault tolerance does not exceed the additional self-inflicted loss risk.

The pattern is general: each step up the ladder addresses an exposure failure mode and introduces new loss failure modes. The right step depends on which failure mode dominates your threat model — and on whether you can sustain the operational discipline that the new rung requires.

Tradeoffs and considerations

The complexity-as-loss-risk axis

The dominant message across every practitioner the synthesis reviews — Lopp, Unchained, Nunchuk, Blockchain Commons, Casa — is that complexity itself is a loss risk. Unchained’s framing: “The most common way that people lose bitcoin when self-custodying is by introducing too much complexity.” Multi-vendor 3-of-5 multisig with geographic distribution and a custom passphrase rotation is structurally more secure than single-sig in cryptographic terms; in operational terms it dramatically increases the self-inflicted loss surface.

This is the rule of thumb’s most important implication: a less complex setup that you can actually operate is often safer than a more complex setup that you cannot. The threshold is not where the cryptography is strongest; it is where the operational discipline you can sustain matches the security the setup demands.

The “what is your worst day” stress test

A useful exercise when evaluating any setup: imagine your worst day. You are in cognitive decline. You are grieving a death. You are dealing with a medical emergency. You have just been the target of a phishing or wrench attack and are now under acute stress.

In that state, can you still execute the recovery? Can your designated heir or partner execute it? If the answer is no for any realistic worst-day scenario, the setup is too brittle on the loss axis — regardless of how well it scores on exposure. Lopp’s “cognitive state rule” — that wallet operations require peak cognitive condition — is the corollary.

The asymmetry that matters

Exposure attacks frequently fail. The attacker has to be successful to extract funds. The defender has to make one bad decision to lose everything to loss.

This asymmetry is what makes loss the historically dominant failure mode. The attacker who phishes a thousand holders may succeed once; the holder who forgets a passphrase has lost everything once and the loss is permanent. The defender’s mistake compounds in a way the attacker’s miss does not.

The rule of thumb’s corollary: defences that make loss more likely should be evaluated more conservatively than defences that make exposure more likely. The downside cost is structurally larger on the loss side.

Reversibility

Most loss events are irreversible. A burned seed phrase, a forgotten passphrase, a disposed-of hardware wallet whose seed backup is also missing — these cannot be undone. Many exposure events, by contrast, can be partially mitigated by sweeping funds to a new wallet before the attacker moves them, provided the holder discovers the exposure in time.

This is another structural asymmetry. The cost of loss is generally permanent and total. The cost of exposure is sometimes recoverable, particularly when the holder maintains active monitoring and rapid-response capability.

The implication: defences that buy detection time (multisig with delays, time-locked transactions, active monitoring of addresses) can convert some exposure scenarios into recoverable ones. They do not convert loss scenarios into recoverable ones.

When does each failure mode dominate the threat model?

  • Loss dominates for holders who are: aging, single (no partner who knows the setup), planning to hold for decades, prone to forgetfulness, dealing with cognitive decline, in poor health, working with novel or improvised schemes, or simply at the start of their self-custody learning curve. Loss also dominates for holders whose primary concern is preservation across generations rather than active spending.
  • Exposure dominates for holders who are: publicly identified as Bitcoin holders, geographically vulnerable, active spenders rather than long-term hodlers, holders of very large amounts (>$1M+), holders who interact frequently with exchanges or signing software (more attack surface), or holders in jurisdictions with heightened legal-institutional risk (capital controls, hostile regulation).

Most holders are dominated by loss risk and over-index on exposure risk. The synthesis is direct about this: “The biggest risks in self-custody are not from hackers but from mistakes and environmental failures” (Lopp).

Tiered application

The loss-exposure trade-off applies at all holding sizes, but the weighting shifts. Using the Tier 0–3 framework from _Brief.md §12:

Tier 0 (under $1K, phone wallet, casual use) — Both failure modes are minor. Loss is the dominant practical concern but the consequence is small. Single-sig hot wallet is fine.

Tier 1 (50K, single hardware wallet) — Loss dominates. Most holders at this tier have not been targeted for exposure attacks. The principal failure modes are forgotten seeds, untested backups, novel schemes, and inheritance failure. The standard recommendation is single-sig on a hardware wallet with a tested metal backup and a documented inheritance plan.

Tier 2 (1M+, multi-device or multisig) — Both failure modes are material. Exposure attacks become realistic (the holder may be identifiable, the holdings are worth targeting). Multisig or single-sig+passphrase becomes appropriate, but the complexity introduced must be matched by operational discipline. The synthesis is direct: a holder at this tier should adopt the least complex setup that adequately covers the exposure risk, not the most complex one available.

Tier 3 (>$1M, multisig with geographic distribution, possibly collaborative) — Exposure attacks are more probable; loss attacks remain dominant in incident count but the per-incident cost on either side is large. The collaborative-custody pattern (2-of-3 with partner) becomes particularly attractive because it reduces holder-side complexity (loss-mitigating) while preserving multisig protection (exposure-mitigating).

The tier framework is not rigid. A holder with a 200K stack and complete anonymity may be safer at Tier 1. The threat model determines tier weighting, not the dollar amount alone.

Common pitfalls

Optimizing for the visible failure mode. Exposure incidents are newsworthy; loss incidents are silent. Holders who internalize the public narrative often build for exposure protection at the cost of loss protection, then lose their funds to the failure mode they prepared for least.

Treating a single-failure-mode defence as comprehensive. “I added a passphrase” is exposure protection only. The passphrase backup is now a new loss vector. Many holders adopt the defence without adopting the corresponding backup discipline.

The “I’ll remember it” passphrase. A passphrase that exists only in the holder’s head is a single point of failure with no backup. The seed phrase, which is backed up, gives the illusion that the wallet is recoverable. It isn’t. Memorised-only passphrases are the most-cited inheritance failure pattern in the synthesis.

Co-locating multisig keys. Three hardware wallets in three drawers in the same home is functionally no more secure than one hardware wallet, and is more complex. Geographic distribution is not optional for multisig to be meaningful.

Untested backups. A backup that has not been restored from is not a backup; it is a hope. Loss often manifests at recovery time when the backup turns out to be incomplete, wrong, or unreadable.

Treating decoy wallets as primary defence. Plausible deniability is a belief, not a guarantee. Lopp documents cases where decoys failed to convince attackers and victims were coerced for hours. Decoys are useful as one layer among several; they should not be the principal exposure defence.

Stacking custom obfuscation schemes. “I write every fourth seed word backwards and XOR with my birthday.” The cryptography may be fine; the holder’s ability to reliably reconstruct the scheme under stress is not. Novel schemes are the largest self-inflicted-loss category in the synthesis.

Multi-passphrase stacking. Some holders use multiple passphrases or rotate them. Each introduces a new single point of failure on the loss side. If you need more than one passphrase, you need SLIP-39 or multisig — schemes designed for the problem you are trying to solve.

Tooling and resources

The principal references for the loss-exposure framing:

Synthesis document (canonical for the section):

  • Bitcoin Self-Custody & Security: A Synthesis of Contemporary Best Practices, LegacyCipher discussion, April 2026 — the explicit codification of the two-failure-mode framing and the opposing-risks rule of thumb.

Primary practitioner sources:

  • Jameson Lopp’s writing — particularly “21 tips for securing your bitcoin” and the four rounds of Metal Seed Storage Stress Tests (2018, 2020, 2022, 2024). See Jameson Lopp.
  • Blockchain Commons Smart Custody Book (CC-BY-SA) — the 27-adversary framework and the cold-storage scenario that anchor the threat-modelling tradition.
  • Unchained’s “Multisig 2-of-3 vs. 3-of-5” and “DIY multisig vs. collaborative custody multisig” — explicit treatment of the complexity-as-loss-risk axis.
  • Casa’s “Shamir Secret Sharing Shortcomings” — the loss-side critique of SLIP-39 schemes.

Empirical references:

  • Chainalysis published estimates on permanently lost Bitcoin supply (multiple research notes 2017–2024)
  • Lopp’s Physical Bitcoin Attack database — empirical record of exposure-side incidents, particularly the 2025 surge in physical attacks

As of 2026-05-14 (lost-supply figure re-verified 2026-07-17): the synthesis document, Lopp’s blog, and Blockchain Commons’ free book are the most actively updated public references. The Chainalysis loss estimates are updated periodically rather than continuously; the current public range is 2.3–3.7 million BTC, ≈ 11–18% of the 21-million maximum supply (Chainalysis, early-2025 analysis), with some reports as high as ~4 million. Much of the apparent variance across sources is a denominator difference — “~20% lost” figures measure against circulating supply rather than the 21-million cap.

Open questions for further development

  • Is the 11–18% lost-supply estimate stable, or has it shifted as 2010-era holders have been priced into rediscovering their old wallets? The economics of recovery effort scales with price; some “lost” Bitcoin returns to circulation when the price makes recovery worth the effort.
  • How does the trade-off evolve as the hardware-wallet ecosystem matures? Modern devices reduce some loss risks (forgotten seeds — partial mitigation via redundancy) and some exposure risks (firmware updates, secure elements). The framework’s specifics drift as the technical landscape evolves.
  • What is the right framework for assessing institutional custodial vehicles (ETFs, regulated custodians) against the two-failure-mode lens? Custodial custody concentrates exposure risk on the custodian and concentrates loss risk on operational failures of the custodian; the self-custodial holder spreads both across many smaller risks. The trade is real but the framework above does not fully accommodate it.
  • The framework treats loss and exposure as the two principal failure modes. Are there others worth distinguishing — for instance, partial loss (you can recover some funds but not the entire UTXO set) or delayed loss (you discover the loss years later when prices have changed)?
  • How should the framework engage the “wrench attack” specifically? The wrench attack is exposure-by-coercion; the defensive options (time-locked transactions, multi-party-confirmer architectures, plausible-deniability decoys) trade against loss. The framework’s treatment of physical-coercion threats may need its own subsection as the 2025 surge continues.

The other framing lenses:

The configurations themselves:

The operational discipline:

The moral framing:

The principal author:

  • Jameson Lopp — two decades of empirical work that grounds the loss-side claim

The sub-MOC home:

Graph View

Backlinks