Scams, Taxes, and What's Next·Lesson 20 of 20·30 min

Bitcoin Self-Custody Plan and Security Audit

Overview

In this capstone project, you'll design a personal Bitcoin custody and security plan, document your wallet setup decisions, and identify real-world security risks. This project synthesizes everything you've learned and prepares you to safely manage your own Bitcoin.

Learning Outcomes

After completing this capstone, you will be able to:

Design a custody strategy appropriate for your use case
Document a secure wallet setup with proper backups
Identify and mitigate common security threats
Create an actionable security plan you can implement

Project Brief

You are Sarah, a professional who has completed this Bitcoin course and is ready to take custody of your first Bitcoin. Your task is to create a comprehensive personal Bitcoin custody and security plan.

Part 1: Your Custody Strategy (15 minutes)

Scenario: You've decided to allocate $5,000 to Bitcoin as a long-term investment. You want to maximize security while maintaining reasonable access to your funds.

Your deliverable:

Choose a custody model: Will you use a custodial exchange (Coinbase, Kraken), a non-custodial software wallet (MetaMask, Blue Wallet), a hardware wallet (Ledger, Trezor), or a combination?
Justify your choice based on:

Your risk tolerance
How often you plan to access your Bitcoin
Your technical comfort level
The amount you're storing

Explain how you'll handle backups (seed phrase storage, redundancy, physical security)

Example answer:

I'll use a hardware wallet (Ledger Nano S) for 80% of my Bitcoin ($4,000) and keep 20% ($1,000) in a mobile software wallet (Blue Wallet) for occasional spending. The hardware wallet provides maximum security for long-term storage, while the mobile wallet gives me convenient access without exposing my main seed phrase. I'll write my hardware wallet's seed phrase on paper, store it in a fireproof safe at home, and keep a second copy in a safe deposit box at my bank.

Part 2: Wallet Setup Documentation (15 minutes)

Your deliverable:

Document the following steps as if you were setting up your wallet:

Wallet Selection & Download

Which wallet(s) will you use? (Name and type: hardware, mobile, desktop, web)
Where will you download/purchase it? (Official website only)

Initial Setup

How will you generate your seed phrase? (Hardware wallet, software wallet, or other)
Will you use a passphrase in addition to your seed phrase? (Recommended for advanced users)

Backup Strategy

How many copies of your seed phrase will you create?
Where will you store each copy? (Home safe, bank safe deposit box, etc.)
Will you use a metal seed backup tool (e.g., SeedSigner)?

Security Measures

Will you enable two-factor authentication (2FA) on any accounts?
Will you use a PIN or passphrase to unlock your wallet?
How will you protect your device from malware?

Receiving Your First Bitcoin

How will you obtain your first Bitcoin? (Exchange, peer-to-peer, Bitcoin ATM)
How will you verify your receiving address before sending funds?

Example answer:

I'll use a Ledger Nano S hardware wallet purchased directly from ledger.com. I'll generate my seed phrase using the Ledger device itself (not on a computer). I'll create two copies of my 24-word seed phrase written on paper: one stored in a fireproof safe at home, and one in a safe deposit box at my bank. I'll also set a 4-digit PIN on my Ledger device. To receive Bitcoin, I'll buy $5,000 from Coinbase, verify the receiving address on my Ledger's screen (not just on my computer), and send the funds to my hardware wallet.

Part 3: Security Risk Identification (15 minutes)

Scenario: Read the following three real-world Bitcoin security incidents. For each, identify:

What went wrong
What security principle was violated
How you would mitigate this risk in your own setup

Incident 1: The Phishing Email

Alice received an email that appeared to be from her hardware wallet manufacturer (Ledger). The email said her account had suspicious activity and asked her to click a link and enter her seed phrase to verify her identity. She did, and her Bitcoin was stolen within hours.

What went wrong: Alice fell for a phishing attack. The email was fake, and legitimate companies never ask for your seed phrase via email.

Security principle violated: Never share your seed phrase with anyone, ever. Always verify URLs and official communication channels.

Your mitigation: I will never click links in emails about my wallet. If I receive a suspicious email, I'll go directly to the official website by typing the URL myself. I'll memorize that legitimate companies never ask for seed phrases.

Incident 2: The Lost Backup

Bob wrote his seed phrase on a piece of paper and stored it in his desk drawer. His house caught fire, and the paper was destroyed. He had no other backup. His Bitcoin is now inaccessible forever.

What went wrong: Bob had only one backup of his seed phrase, and it was destroyed in a single incident.

Security principle violated: Backups must be redundant and geographically distributed. A single point of failure puts all your Bitcoin at risk.

Your mitigation: I will create at least two copies of my seed phrase and store them in different locations (home safe and bank safe deposit box). I'll also consider using a metal backup tool that's more resistant to fire and water damage.

Incident 3: The Malware Wallet

Charlie downloaded what he thought was the official MetaMask wallet from a Google search result. It was actually a fake wallet created by scammers. When he imported his seed phrase to set up the wallet, the malware immediately sent his Bitcoin to the attacker's address.

What went wrong: Charlie downloaded a fake wallet from an untrusted source and imported his seed phrase into it.

Security principle violated: Only download wallets from official sources. Never enter your seed phrase into a wallet you're not 100% sure is legitimate.

Your mitigation: I will only download wallets from official websites (e.g., ledger.com, bluewallet.io). I'll bookmark these sites and always access them by typing the URL directly. I'll never download a wallet from a search result or email link. For a hardware wallet, I'll purchase directly from the manufacturer or an authorized retailer.

Rubric: How Your Capstone Will Be Graded

Your capstone project will be evaluated on three criteria:

1. Completeness (40%)

✓ Custody strategy is clearly defined (which wallet(s) and why)
✓ Backup plan covers seed phrase storage with redundancy
✓ Security measures are documented (PIN, 2FA, malware protection, etc.)
✓ All three risk incidents are addressed with specific mitigations

Passing threshold: Your plan covers all major components of wallet setup and security.

2. Accuracy (35%)

✓ Custody model choice is appropriate for the scenario ($5,000, long-term storage)
✓ Backup strategy follows best practices (multiple copies, geographic distribution)
✓ Security measures are technically sound (e.g., hardware wallet for cold storage, 2FA for exchanges)
✓ Risk mitigations are realistic and grounded in course material

Passing threshold: Your plan demonstrates correct understanding of Bitcoin security principles. Recommendations should align with lessons on seed phrases, private keys, wallet types, and common scams.

3. Risk Identification (25%)

✓ You identify at least 3 realistic security threats relevant to your setup
✓ Each threat is tied to a specific security principle from the course
✓ Mitigations are actionable and specific to your plan

Passing threshold: You demonstrate ability to apply course concepts to real-world scenarios.

Submission Guidelines

Format: Submit your capstone as a single document (PDF, Google Doc, or Markdown file)
Length: 800–1,200 words (approximately 3–5 pages)
Structure: Use the three parts above as your outline
Tone: Write as if you're creating a personal plan you'll actually follow
Deadline: Submit within 7 days of completing Module 5

What Happens After You Submit

Your capstone will be reviewed against the rubric above
You'll receive feedback within 3–5 business days
If your capstone meets the rubric (≥70% across all criteria), you'll earn your certificate
Your certificate will be shareable on LinkedIn and includes your name, completion date, and course title
You'll receive an email with next steps, including information about paid advanced courses (Blockchain Fundamentals, Staking and DeFi) and a 10% discount code

Resources

Summary

Your capstone project is your opportunity to synthesize everything you've learned and create a real, actionable plan for Bitcoin self-custody. This is not a test—it's a planning exercise. The goal is to help you think through the decisions you'll make when you actually acquire Bitcoin.

By completing this project, you'll have:

A clear custody strategy tailored to your needs
A documented wallet setup process
An understanding of real-world security threats and how to mitigate them
Confidence that you can safely manage your own Bitcoin

Good luck, and welcome to the world of Bitcoin self-custody!

← Your Bitcoin Journey: Staking, DeFi, and Beyond Course overview →