Recent hardware-wallet incidents have prompted Bitcoin holders to reconsider how they store funds. The alternatives are not risk-free replacements: each changes who controls access, how recovery works and which failure could threaten the balance. Distributing holdings across addresses, providers and custody methods can reduce dependence on one point of failure, but it also creates more recovery responsibilities.
Bitcoin exchange-traded funds provide market exposure through shares in a fund that holds Bitcoin with a custodian. Investors receive a fractional interest in the fund’s net assets rather than direct control of Bitcoin, so they cannot use the holding onchain in the same way. The structure removes seed-phrase management and simplifies access through securities accounts, but it adds issuer, custodian, fee and pricing risks. Regulatory filings show that the fund’s assets, expenses, liabilities and daily net asset value are managed through trustees, administrators and custodians.
Passkey wallets use cryptographic credentials stored through a phone, computer or cloud-based password manager and commonly protected by biometrics or a device PIN. They can make signing easier, but access can depend on the device or passkey provider. Coinbase’s recovery documentation says a device-linked passkey may become inaccessible after device loss; users can create a recovery phrase in advance, and restoring access requires setting up a new passkey and paying a network fee for each chain used.
In a typical 2-of-3 arrangement, any two of three signers must approve a transaction, reducing the damage from one lost or compromised key. The arrangement still requires available signers, can slow transfers and may contain vulnerabilities in smart-contract code or configuration. If enough signers are compromised, an attacker can authorize a transaction, and relying on one provider can preserve concentration risk.
Centralized exchanges handle private-key management for customers, making them convenient for trading and for people who do not want to maintain backups. That convenience leaves users dependent on the company’s security, solvency and access rules. Proof-of-reserves disclosures can show information about held assets, but they do not establish a company’s complete financial condition or ability to meet every obligation. Reporting requirements can also require identity, residency or tax information, with noncompliance potentially restricting accounts or withdrawals.
Paper wallets print a cryptocurrency address and private key, keeping the key offline without dedicated hardware. Safe generation can be difficult because a compromised computer, malicious generator or weak randomness may expose the key before printing. Paper can also be lost or damaged, and importing the key into an internet-connected wallet to spend funds can undermine the offline protection. The result is a custody choice shaped by priorities: direct onchain control, easier recovery, trading access, estate administration or reduced dependence on one key.