Large Bitcoin and crypto holdings: how to protect and manage them

Advertisement – promotional communication

Custody, security, verifiability, liquidity and succession: the criteria for choosing infrastructure that matches the size of a significant estate

When the value of a Bitcoin and crypto-asset portfolio becomes significant, safekeeping it is no longer just a matter of choosing a wallet and protecting a seed phrase. It becomes a wealth management problem. You need to reduce technical and personal risks, verify the soundness of whoever holds the funds, plan for liquidity and taxation, document the origin of the assets, and ensure continuity in case of succession or incapacity.

Many holders start from an apparently simple choice: keep the keys themselves, or entrust the assets to an intermediary. In reality, neither is safe by definition. Self-custody eliminates counterparty risk but concentrates responsibility and vulnerability on the owner. Professional custody spreads that responsibility, but it can be trusted only when it rests on verifiable controls, asset segregation and an architecture designed to avoid single points of failure.

This guide sets out criteria you can apply to any operator and shows how CheckSig puts each into practice. The goal is to understand how to build protection proportionate to the value, complexity and time horizon of the estate.

The two risks of self-custody

The first is technical risk. Managing your own private keys means depending on a device, its firmware and the source of entropy used to generate the keys. If any of these components has a flaw, the funds may be exposed without the owner noticing until it is too late.

On 30 July 2026, an entropy flaw in the firmware of Coldcard devices allowed, according to reconstructions published by the manufacturer and independent analysts, the theft of about $70 million from single-signature addresses. It was not an external attack in the traditional sense, but a firmware defect that made the keys generated by the affected devices reconstructable.

The second is the physical risk of personal exposure.

What is a wrench attack? It is a physical assault, often accompanied by threats or direct violence, aimed at forcing a crypto holder to hand over their keys or access to their funds. The name comes from a cartoon that has become proverbial in the industry: no cryptography, however strong, protects against a wrench pointed at its owner.

The larger the estate, the higher the chance that someone knows or suspects a person holds significant crypto-assets and tries to extort them. The trend is well documented: more than 260 known incidents since 2014 (source: Jameson Lopp), with a recent acceleration (52 cases in the first half of 2026 versus 39 in the same period of 2025, source: CertiK), and Europe’s share rising from 22% to over 40% of the global total. The geography of risk is shifting towards Europe just as the number of high-net-worth holders there is growing.

These two risks share one feature: they cannot be solved by greater individual caution alone. They require an architecture that reduces exposure to single points of failure, technical or human.

How to evaluate a custodian’s architecture

The question to ask is not “is this custodian secure?”, which any operator will answer yes. The useful question is: which structural components ensure that a single failure is not enough to compromise the assets?

Three criteria allow an objective evaluation of any custodian’s architecture.

1. Multi-signature quorum.

   No operation should depend on a single key or a single person. A robust architecture distributes authorization across multiple parties and stages, so that a single compromise (theft, error or coercion) is not enough to move the funds.

2. Cold and frozen segregation.

   Non-operational funds should be isolated across several layers disconnected from the internet, not concentrated in a single generic cold wallet. Separate layers reduce the attack surface and allow different policies to be applied to funds according to how urgently they need to be accessed.

   
   

   What is a time lock? It is a mechanism that introduces a mandatory delay between the start of a transfer from a wallet’s most protected layers and its execution. It does not prevent the operation: it slows it down enough to allow an unauthorized attempt to be intercepted before it completes.

3. Device-independent entropy.

   This is the critical point that emerged in the Coldcard case: if key generation depends on a single piece of hardware, a flaw in that hardware can compromise the entire system. Generating entropy through independent external sources, and combining hardware from different manufacturers with proprietary firmware, reduces this systemic risk.

CheckSig’s custody protocol includes three multi-signature authorization stages, eleven keys distributed across different parties and locations, two cold storage layers disconnected from the internet (Frozen and Cold wallets), a time lock that prevents immediate transfers from the cold layer, and entropy generated from external sources independent of the device, using hardware from different manufacturers and proprietary firmware.

How to verify a custodian’s claims

Knowing that a custodian claims to use a certain architecture is not enough. You need to be able to verify it without relying solely on the operator’s word.

Two tools address this need:

• Proof of Reserves. A demonstration, repeated at regular intervals, that the funds a custodian declares actually exist and are held to the extent promised. It carries weight when it is public and periodic: an isolated snapshot, produced once to reassure the market in a moment of stress, does not have the same evidentiary value.
• Independent audits. They verify that the declared operational and security controls are actually in operation, and not merely described in a commercial document.

Verifiability matters more than promises because it shifts the burden of proof from the operator to checkable evidence and third parties. It is the difference between trusting what a custodian says and being able to verify what it does.

CheckSig has published its Proof of Reserves monthly since 2020, the first company in the world to introduce this process, and receives SOC 1 and SOC 2 Type II attestations from a Big Four firm (Type I since 2021, Type II based on continuous audit since 2022). It is the only crypto company in Italy to have them.

What happens if the custodian fails or is attacked

No architecture, however solid, brings risk down to zero. The right question is not whether an adverse event can happen, but which protections come into play when it does.

Three elements answer it.

• Asset segregation keeps client funds separate from the custodian’s own assets, so that the operator’s insolvency does not automatically sweep away what it holds on behalf of third parties.
• Insurance can cover certain attacks or operational failures that compromise the funds in custody, within conditions and limits that must be verified.
• The regulatory framework (in Europe, MiCAR) imposes capital, governance and control requirements that an unregulated operator is not subject to.

It is also worth considering a recent case involving a hardware supplier, not a custodian: a data breach at the logistics provider ShipMonk (the Trezor-ShipMonk case), disclosed by Trezor on 13 August 2026, exposed the identities and addresses of about 14,000 customers, without compromising any private keys.

It is an important reminder: even when the technology holds, the exposure of personal data linked to crypto-asset ownership is a risk in its own right and can increase vulnerability to the wrench attacks described at the outset.

CheckSig is the first Italian crypto operator licensed under MiCAR by CONSOB and the only crypto company in Italy with insurance coverage on funds in custody, provided by a company rated AA by S&P.

Managing a portfolio, not just safekeeping it

A significant crypto estate raises needs that go beyond key security: taxation, liquidity and documentation of the origin of funds.

Taxation. The choice between delegated automatic management and self-managed reporting with an annual report depends on tax residence and the complexity of the position. Neither option is better in absolute terms, but the second requires more careful documentation in case of an audit.

Liquidity. A frequent need is to obtain euro liquidity without selling one’s Bitcoin and crypto, and therefore without leaving market exposure or, in itself, realizing the capital gain that a sale would trigger, unless the collateral is liquidated.

A crypto-backed loan can meet this need as a liquidity tool, but it carries costs and the risk that the collateral is liquidated if its value falls. It is also essential to distinguish who grants the loan from who holds the collateral: they are often different parties with different responsibilities, and the distinction must be verified before signing the agreement.

Provenance of funds. Those who have built up positions across multiple platforms over time may need to document their origin to a bank, a notary or a tax authority. Reconstructing the documentation of a past, multi-platform portfolio is a service distinct from custody, but increasingly relevant for those who hold high-value assets.

CheckSig’s custody service for loans provides collateralization of 200% of the capital, equivalent to an LTV of 50%, a rate that decreases as collateral increases, and a minimum amount of €10,000 with no predefined cap, in return for an additional fee defined in the contract for threshold monitoring, margin calls and liquidation.

CheckSig acts exclusively as custodian of the crypto pledged as collateral: it does not grant the loan, does not carry out credit brokerage, does not assess creditworthiness and does not guarantee the solvency of any party. The loan agreement is concluded directly between borrower and lender, who bear its risks, without prejudice to CheckSig’s responsibilities as custodian under applicable law and the custody agreement. The value of crypto-assets may fall to the point of triggering liquidation of the collateral, with total or partial loss, and the borrower remains liable for any residual debt. The percentages and thresholds indicated are illustrative and do not constitute a public offer of financial or credit products, advice, a recommendation, a promise of returns or a contractual proposal.

The Digital Gold Institute, a CheckSig subsidiary, produces the Crypto Portfolio Report to document past holdings spread across multiple platforms. On taxation, CheckSig offers both the administered regime (where CheckSig acts as withholding agent) and the declarative regime (where the client reports directly), and since 2024 it has been Italy’s first crypto withholding tax agent.

Planning for the long term

A significant estate requires planning that goes beyond the horizon of the individual investor. What happens in the case of joint ownership with a partner, sudden incapacity or transfer to heirs? These questions are rarely asked until they become urgent, which is exactly why they should be addressed in advance.

Among the criteria to consider in a crypto custody service are the ability to open jointly held accounts, the formal appointment of an executor, a structured path for generational transfer, and a stable point of contact who knows the client’s history, rather than anonymous support.

CheckSig offers a dedicated contact, joint accounts, the appointment of an executor and a structured path for generational transfer.

Checklist: the questions to ask any custodian

Before entrusting a significant crypto estate to an operator, ask precise questions and demand verifiable answers, not mere promises:

• Does transfer authorization depend on a single key or on a quorum distributed among several parties?
• Are non-operational funds separated across several layers disconnected from the internet?
• Is there a time lock that slows transfers from the most protected layers?
• Does the entropy used to generate the keys depend on a single device or on several independent sources?
• Is the Proof of Reserves public and periodic, or an isolated snapshot?
• Are there independent audit attestations, such as SOC 1 and SOC 2? Who issues them and how often?
• Are client funds legally segregated from the company’s assets?
• Is there insurance coverage on funds in custody? Which risks does it cover and within what limits?
• Is the operator regulated, in Europe under MiCAR, or does it operate outside any supervisory regime?
• If it offers liquidity solutions, is it clear who grants the loan and who holds the collateral?
• Is there a stable point of contact, and are there defined procedures for joint ownership, incapacity and generational transfer?

Frequently asked questions

What distinguishes an institutional custodian from an exchange or a personal wallet?

An exchange is designed mainly for trading and operations, not for the long-term safekeeping of large estates. A personal wallet concentrates on the owner the technical and operational risks of self-custody described at the outset. An institutional custodian such as CheckSig, by contrast, separates the security architecture (quorum, time lock and distributed entropy) from the management of the relationship and from regulatory obligations, adding forms of external verification such as audits and Proof of Reserves.

Can a crypto estate be insured?

Yes, but not all operators offer this coverage. You need to check who provides the policy, the insurer’s rating, the limits, the exclusions and what is actually covered. Insurance on funds in custody, for example, does not protect against losses caused by market movements.

What does MiCAR change for holders of a large crypto estate?

MiCAR imposes on regulated operators capital, governance and control requirements that an unsupervised operator is not required to meet. For the holder, checking the operator’s authorization is therefore a first step in verification. It is not a guarantee of security or of the absence of risk, and should be combined with an assessment of the technical architecture and the other protections.

Is it possible to obtain liquidity without selling your crypto-assets?

Yes, through a loan secured by the crypto-assets themselves, which remain in custody as collateral. Before proceeding, you need to check whether the party holding the collateral is the same one granting the loan or a different one. Moreover, any liquidation may result in the realization of the capital gain associated with the sale.

What happens to a crypto estate in case of succession?

It depends on the tools put in place in advance. Without a structured path (appointment of an executor, possible joint ownership and planned generational transfer), access to the estate can become complex or even impossible for heirs. It is a topic to address with the custodian before it becomes urgent, not after.