Bitcoin Custody Architecture for Family Offices: The Complete Framework

Home › Research › Bitcoin Custody Architecture

Bitcoin custody architecture is the decision most high-net-worth families get wrong — not because the right answers are hidden, but because the full landscape of options is never presented in one place. The retail world says "buy a Ledger." The institutional sales cycle says "wire to us." Neither framing helps a family sitting on $10M, $50M, or $200M in Bitcoin figure out what they should actually do.

This guide covers the complete spectrum: from exchange accounts and hardware wallets through collaborative multisig and institutional custodians, all the way to Wyoming Private Family Trust Companies holding Bitcoin as a trustee. It covers the 2-of-3 vs 3-of-5 multisig decision in depth, geographic key distribution, the leading institutional custodian comparison, how the CLARITY Act reshapes qualified custodian requirements, how custody choice directly affects your estate plan, seed phrase operational security, inheritance-safe structures, and a wealth-tier decision framework. It is designed to be read once and referenced repeatedly.

Threat Modeling: What Are We Actually Protecting Against?

Every custody decision is a risk management decision. The error most families make is designing their custody architecture around a single threat — usually remote hackers — while leaving other threat vectors entirely unaddressed. A robust architecture explicitly names the threats, ranks them by probability and severity, and makes tradeoffs consciously.

For a high-net-worth family with significant Bitcoin holdings, the realistic threat surface is:

• Remote digital theft: Sophisticated attackers who compromise devices, networks, exchange accounts, or custody software to steal private keys. This is the dominant threat for exchange and hot wallet custody. Air-gapped hardware wallets dramatically reduce but do not eliminate this surface.
• Physical theft or targeted coercion: Attackers with knowledge of the holdings who attempt direct physical access — home burglary, or in extreme threat profiles, coercive extraction (the "wrench attack"). Public association between identity and Bitcoin holdings is a material operational security failure that escalates this risk.
• Insider misappropriation: Family members, estate attorneys, financial advisors, or household employees who gain legitimate access to custody components and misuse that access. Single-key arrangements with no multi-party requirement are maximally vulnerable to this.
• Custodial failure: For institutionally custodied Bitcoin — exchange insolvency, custodian fraud, operational failure, or regulatory seizure affecting client asset access. FTX, Celsius, BlockFi, and Voyager are case studies at scale.
• Accidental permanent loss: Hardware failure without adequate backup, forgotten passphrases, lost seed phrases, corrupted backups, or catastrophic failure of custody infrastructure during critical recovery scenarios. This risk compounds over generational timescales.
• Succession failure: The inability of designated heirs, trustees, or executors to locate, access, and successfully transfer the Bitcoin after a triggering event — death, incapacity, or family fragmentation. This is the most underweighted threat and the one that causes the most generational wealth destruction.
• Regulatory seizure: Governmental action compelling transfer or freezing of Bitcoin held at regulated institutions. Self-custody in a properly structured architecture significantly reduces this surface.

The critical insight: architectures optimized for one threat often worsen others. A setup designed purely against remote theft — completely air-gapped, maximum complexity, highly restricted access documentation — may be catastrophically vulnerable to succession failure. A setup optimized for operational simplicity — everything with a single institutional custodian — is maximally exposed to custodial failure and regulatory risk. The design task is conscious, documented tradeoff selection, not the pursuit of an impossible perfect.

The Full Custody Spectrum: Exchange to Wyoming PFTC

Level 1: Exchange Custody

Exchange custody — Bitcoin held at Coinbase, Kraken, Gemini, or any other exchange — is the starting point for most holders. It is not Bitcoin custody in the full sense: you hold a claim against the exchange's balance sheet, not a cryptographic key to Bitcoin on the network. "Not your keys, not your coins" is not a slogan; it is a legal and technical description of what exchange custody actually is.

For family offices, exchange holdings should be limited to: active trading positions, 30-to-90-day liquidity reserves, and Bitcoin awaiting transfer to self-custody or institutional custody. As a percentage of total holdings, exchange balances should be in the low single digits. The primary risk is custodial failure — as demonstrated repeatedly throughout Bitcoin's history — but regulatory risk, operational errors, and account freezes are also material.

Level 2: Hardware Wallet (Single-Sig)

Purpose-built hardware security devices — Coldcard, Ledger, Trezor, Foundation Passport, Bitkey — represent the baseline standard for self-custody. The core security property: private keys are generated and stored in a tamper-resistant secure element. When signing a transaction, the key never leaves the device. The connected computer sees unsigned transaction data and signed transaction data; it never touches the key itself.

Single-signature hardware wallet custody is appropriate for initial self-custody, holdings under $500K, and operating wallets for ongoing transactions. Its failure mode is simple: one key, one point of failure. The seed phrase backup is the entire security of the arrangement. For a family office with multi-generational ambitions, single-sig is a starting point, not an endpoint.

Level 3: Collaborative Multisig

Collaborative multisig — where you hold the majority of keys and a professional co-signer (Unchained Capital, Casa, Nunchuk) holds one key — is the most important structural upgrade most families can make. You retain full sovereign control: the co-signer's key alone cannot move your Bitcoin. But the co-signer can assist with transaction signing, recovery scenarios, and succession planning. This is where self-custody meets institutional structure without surrendering sovereignty.

The standard collaborative arrangement is 2-of-3: you hold two keys, the co-signer holds one. You can transact independently without the co-signer. If you lose one of your keys, the co-signer's key and your remaining key provide recovery. If the co-signer fails, you hold both your keys and can recover independently. This architecture eliminates single points of failure at modest operational cost.

Level 4: Full Institutional Custody

Full institutional custody — Bitcoin held by a regulated custodian (Coinbase Custody, BitGo, Anchorage, Fidelity Digital Assets) — is appropriate for: investment advisers with regulatory custody requirements, family offices requiring institutional reporting and insurance, and Bitcoin held in commingled fund structures. The custodian holds your keys under a custodial agreement, providing documented security practices, insurance, and regulatory compliance.

The tradeoff is explicit: you reintroduce custodial risk and counterparty dependency in exchange for operational simplicity, regulatory compliance, and institutional infrastructure. For a family office that also maintains self-custody for the majority of holdings, institutional custody for a portion of the portfolio is a rational structure.

Level 5: Trust Company Custody

A number of state-chartered trust companies — Anchorage Digital (OCC-chartered), Wyoming-based Avanti/Custodia (state-chartered), and similar entities — offer Bitcoin custody with full trustee capabilities. The critical distinction from exchange custody or custodian custody: these entities can serve as the legal trustee for Bitcoin held in trust structures. This means the Bitcoin can be titled to a trust, administered by an institutional trustee, and distributed according to a trust document — with no individual holding keys or creating a single point of succession failure.

Level 6: Wyoming Private Family Trust Company

At the apex of the custody spectrum for ultra-high-net-worth families is the Wyoming Private Family Trust Company (PFTC). Wyoming's DASA (Digital Asset-Enabling Statutes) framework explicitly recognizes digital assets as property and enables PFTCs to serve as qualified custodians and trustees for Bitcoin. A Wyoming PFTC is a state-chartered trust company organized exclusively to serve a single family — not regulated as a public trust company, exempt from certain licensing requirements, and purpose-built to hold family assets across generations.

For Bitcoin custody, a Wyoming PFTC can: serve as trustee for a Bitcoin trust with full legal title, act as the institutional co-signer in a multisig arrangement (providing the permanent "institutional key" that survives any individual), create a governance structure that outlasts any individual family member, and interface with regulated financial institutions as a legitimate institutional counterparty. For families with holdings above $25M seeking truly generational custody architecture, the Wyoming PFTC deserves serious analysis.

Multisig Models: 2-of-3 vs 3-of-5 In Depth

Multi-signature Bitcoin requires M of N private keys to sign any transaction — specified at wallet creation and enforced by the Bitcoin network's consensus rules, not by any trusted third party. Multisig is the single most important structural upgrade available in Bitcoin custody architecture, because it simultaneously addresses multiple threat categories that single-key arrangements cannot.

2-of-3 Multisig

Three keys exist. Two signatures are required to transact. This configuration offers:

• Key loss tolerance: One key can be completely lost (device destroyed, seed phrase unrecoverable) and the Bitcoin remains accessible via the remaining two keys.
• Compromise tolerance: One key can be completely compromised by an attacker, who still cannot transact — they need a second signature.
• Operational flexibility: A single person can hold all three keys across different devices and locations, or keys can be distributed across two or three parties.
• Recovery simplicity: If one key is lost and needs to be replaced, two remaining keys sign a transaction moving funds to a new multisig wallet with a freshly generated replacement key.

2-of-3 is appropriate for: individual holders graduating from single-sig, holdings in the $500K–$5M range, collaborative custody with a single co-signer, and families where operational simplicity is a priority. The weakness: it does not tolerate the simultaneous loss of two keys or the simultaneous compromise of two keys — events that 3-of-5 is designed to survive.

3-of-5 Multisig

Five keys exist. Three signatures are required. This configuration offers:

• Key loss tolerance: Two keys can be completely lost and the Bitcoin remains accessible. This is critical for multi-decade custody where hardware failures and lost backups compound over time.
• Compromise tolerance: Two keys can be simultaneously compromised, and the Bitcoin cannot be moved without a third signature — dramatically raising the bar for successful attack.
• Geographic distribution: Five keys can be stored in five genuinely separate geographic locations, meaning no single jurisdictional action, natural disaster, or physical raid can obtain a signing quorum.
• Institutional participation: One or two keys can be held by institutional co-signers (custodian, trust company, attorney) without giving any single institution unilateral control. You retain the majority of keys.
• Succession architecture: Keys can be pre-distributed to successors, with the threshold requiring coordination — preventing unilateral action by any single heir while enabling legitimate collective access.

3-of-5 is appropriate for: holdings above $5M, family offices, multi-generational custody, and any situation where succession planning is a primary concern. The tradeoff is operational complexity: five keys must be managed, documented, and tested; five seed phrase backups must be maintained; signing requires coordination of at least three parties if keys are distributed across people.

Other Configurations Worth Knowing

1-of-2: Either key can transact. Used for: operational wallets where two parties need independent spending authority, treasury management with two authorized signatories either of whom can act. Not recommended for primary custody — compromise of one key is immediately fatal.

2-of-3 with time-lock (dead man's switch): Standard 2-of-3 with an additional script branch that allows a single specific key to transact after N blocks (approximately N×10 minutes). Enables inheritance: heirs hold a key that cannot transact normally, but can after a specified delay if the primary holder has not refreshed the time-lock. The primary holder "proves alive" by refreshing before the lock expires. Discussed in detail in the Inheritance-Safe Structures section below.

3-of-5 with role separation: Advanced configurations where each key is assigned to a role (Primary Holder, Successor, Custodian, Attorney, Spouse/Trustee), with documented procedures for which roles must coordinate for different transaction types. This creates a governance layer on top of the cryptographic layer.

Geographic Key Distribution

Geographic distribution of keys transforms a technical security property — multisig — into a physical security property. Keys distributed across multiple locations mean that no single event can obtain the signing quorum necessary to move the Bitcoin.

For a 3-of-5 architecture, a practical distribution framework might be:

• Key 1: Primary residence, in a high-security safe. Hardware wallet plus metal seed plate backup in separate location within the same city.
• Key 2: Secondary residence or safety deposit box in a different metropolitan area. Metal seed plate backup at a separate secure location in that city.
• Key 3: Trusted family member (adult child, sibling) at their primary residence in a third location. They do not need to know the wallet configuration details — they hold a hardware device and know to contact the estate attorney if they receive a specific instruction.
• Key 4: Estate attorney or licensed custodian acting as key agent. They hold the device in escrow with instructions only to participate in signing upon confirmation of specific triggering events (primary holder's death, incapacity certification, etc.).
• Key 5: Geographically and jurisdictionally separate institutional custodian or Wyoming PFTC, with documented signing procedures and a trustee agreement specifying the conditions under which they will co-sign.

This distribution means: no single physical location holds more than one key. A fire, flood, or break-in at any one location cannot obtain a signing quorum. A legal action targeting any one jurisdiction cannot freeze the Bitcoin (no single entity or location has signing ability). Physical coercion of any one key holder cannot move funds.

The operational requirement this creates: each key holder must be reachable, must understand their role, and must have documented, tested procedures for the scenarios in which they'll be asked to participate. Key holders who don't know what they hold, or who can't be reached during a critical event, create functional failure modes.

Institutional Custodians Compared: Coinbase, BitGo, Anchorage, Unchained

For family offices that incorporate institutional custody — as a component of a larger architecture or as primary custody for a portion of holdings — choosing the right custodian matters. The landscape has consolidated significantly since 2020, with four providers covering most of the family office market.

A Note on Fidelity Digital Assets

Fidelity Digital Assets, operated by Fidelity Investments, offers institutional Bitcoin custody for large family offices and institutional investors. Its regulatory positioning (as a subsidiary of Fidelity Investments) and insurance coverage make it attractive for family offices with existing Fidelity relationships and holdings above $10M. It is not a co-signing or collaborative custody arrangement — Fidelity holds your keys — but the institutional depth and regulatory legitimacy are among the strongest available.

The Collaborative Custody Thesis

The most sophisticated family office custody architectures are typically hybrid: the family holds the majority of keys in a multisig arrangement, with one key held by a provider like Unchained Capital for co-signing support and recovery, and perhaps one key held by a regulated institution (BitGo Trust, Fidelity, Coinbase Custody) for regulatory purposes. This structure keeps full control with the family while accessing institutional infrastructure for specific functions.

The CLARITY Act and Qualified Custodian Requirements

The Digital Asset Market Structure and Investor Protection Act — commonly called the CLARITY Act — establishes the first comprehensive federal framework for digital asset market structure, including custody requirements. For family offices, two provisions are most directly relevant.

Qualified Custodian Definition

The CLARITY Act adopts and extends the Investment Advisers Act's qualified custodian framework to digital assets. A qualified custodian for Bitcoin must be: a bank, savings association, trust company, or federally chartered institution; subject to examination by a bank regulatory authority; maintaining client assets in segregated accounts; and capable of providing proof-of-reserve attestations. This effectively narrows the universe of compliant institutional Bitcoin custodians to regulated trust companies and banks — Coinbase Custody (NY DFS), BitGo Trust (SD), Anchorage Digital (OCC), Fidelity Digital Assets, and a small number of state-chartered trust companies.

Investment Adviser Implications

For registered investment advisers (RIAs) managing client Bitcoin, the CLARITY Act's qualified custodian requirement means Bitcoin held on behalf of clients must be with a compliant custodian — not at an exchange, not in a collaborative self-custody arrangement, and not in the adviser's own cold storage. This directly affects family offices that are SEC-registered and manage Bitcoin for multiple family branches or entities.

Single-Family Office Exemptions

Single-family offices (SFOs) that manage only their own family's assets and are exempt from investment adviser registration under the Family Office Rule (SEC Rule 202(a)(11)(G)-1) are not subject to the qualified custodian requirement. For these entities — which represent the majority of true family offices — self-custody and collaborative custody remain fully viable. The implication: the legal structure of your family office determines your custodial obligations, and this distinction is consequential enough to warrant legal advice specific to your structure.

Wyoming's Digital Asset Framework

Wyoming has enacted the most comprehensive state-level digital asset statutory framework in the United States. Relevant provisions for family office custody include: recognition of digital assets as property with defined legal classification (digital consumer assets, digital securities, digital currencies); authorization of special purpose depository institutions (SPDIs) that can custody digital assets with reserve requirements; and an explicit statutory basis for Wyoming trust companies and PFTCs to custody digital assets. This makes Wyoming the most legally clear jurisdiction for Bitcoin trust structures and institutional custody arrangements.

How Custody Architecture Affects Estate Planning

Custody architecture and estate planning are not separate disciplines. Every custody decision has estate planning consequences, and every estate planning decision has custody implications. Families that optimize one without considering the other create structures that look correct in isolation and fail at the worst possible moment.

A thorough treatment of Bitcoin estate planning strategies is in our Bitcoin estate planning guide. Here we address specifically how custody choice affects the mechanics of trustee access, beneficiary distributions, and succession.

Trustee Access

If Bitcoin is held in a trust — revocable living trust, irrevocable trust, Bitcoin IRA trust, or charitable trust — the trustee must be able to access and transact the Bitcoin in their capacity as trustee. The custody architecture must accommodate trustee access while preventing unauthorized access by non-trustees.

For self-custody multisig in a trust, the trustee holds one or more keys, with additional keys held by co-trustees, successor trustees, or institutional co-signers. The trust document specifies the signing quorum required for trustee action, which should align with the multisig threshold. A mismatch — where the trust document requires co-trustee approval for transactions but the multisig is a 1-of-2 — creates either a technical or legal failure mode depending on which direction the mismatch goes.

For institutional custody in a trust, the custodian holds keys and takes direction from the trustee pursuant to a custodial agreement. The trustee has legal authority but not direct cryptographic access — they instruct the institution, which executes. This is simpler to administer but reintroduces custodial risk and requires the custodian to remain solvent and accessible for the life of the trust.

Beneficiary Distributions

Distributing Bitcoin to beneficiaries — particularly to beneficiaries who are not Bitcoin-sophisticated — requires careful custody architecture. Options include: distributing Bitcoin directly to a beneficiary-controlled wallet (requiring the beneficiary to manage their own custody), converting to fiat and distributing as dollars (tax event, loss of Bitcoin exposure), or maintaining Bitcoin in trust for the beneficiary's benefit and allowing the trustee to manage custody on their behalf.

For discretionary trusts holding Bitcoin long-term, the custodial arrangement must accommodate decades of beneficiary service. This argues against any custody structure that depends on a single provider's ongoing viability — and argues for self-custody multisig with an institutional co-signer as the "recoverable architecture" if any single component fails.

The OBBBA Estate Tax Context

The One Big Beautiful Budget Act made the estate tax exemption a permanent increase to $15 million per individual ($30 million per couple). This permanently shelters most family office Bitcoin holdings from federal estate tax at current levels, but does not eliminate the transfer mechanics challenge: even an estate well below the exemption threshold can fail to pass Bitcoin successfully to heirs if the custody architecture is not succession-ready. The exemption removes the tax urgency; the custody architecture question remains regardless of tax status.

Seed Phrase Operational Security

The seed phrase — typically 12 or 24 words from the BIP-39 word list — is the master key to an entire hierarchical deterministic wallet. Any hardware wallet of any manufacturer can regenerate all private keys from the seed phrase alone. The hardware device itself is replaceable; the seed phrase is not. This asymmetry is the most important custody fact that retail guidance consistently underemphasizes.

Generation Standards

For significant holdings, the seed phrase should be generated on a purpose-built hardware device with a hardware random number generator — not on a software wallet on a general-purpose computer. The device should be new (supply chain attack risk is real for secondhand devices), purchased from the manufacturer directly or a verifiable reseller. For very large holdings, an offline key ceremony — generating keys on an air-gapped device that has never connected to the internet and never will — provides the highest assurance of entropy quality and key integrity.

The 25th Word: BIP-39 Passphrase

An optional passphrase (often called the 25th word) added to a BIP-39 seed creates a completely separate wallet. Even if the 24-word seed phrase is stolen or discovered, the Bitcoin is inaccessible without the passphrase. This provides a critical additional security layer: it means a seed phrase discovered during a physical search does not immediately compromise all funds. The passphrase must be backed up separately from the seed phrase itself — loss of the passphrase is as fatal as loss of the seed phrase if both are required to access the funds. For large holdings, using a passphrase is standard practice; its backup and inheritance must be explicitly architected.

Physical Backup Media

Paper backups are inadequate for significant long-term holdings. Paper degrades, burns, floods, and fades. Professional custody uses metal backup media — stainless steel or titanium plates, with seed words stamped, engraved, or pressed into the metal surface. Multiple products (Cryptosteel, Bilodl, ColdTi) provide commodity solutions. The critical requirement: the backup media must survive fire (stainless steel melts above 1400°C; standard house fires peak at 600–900°C, but firesafes may not), water immersion, and mechanical stress over decades.

Backup Distribution and Access Control

Multiple backup copies at geographically separate locations create redundancy but also create attack surface: each backup copy is a complete key. The backup storage locations must provide equivalent physical security to the hardware wallet itself. Options: high-security in-home safes (resistant to casual burglary), professional safe deposit boxes in bank vaults, attorneys' law firm safes, and specialized vaulting services.

Critically: the seed phrase backup location should be documented (in a letter of instruction held by estate counsel) without being written in any document that is itself unsecured. "Seed phrase backup is in the Mosler safe at [specific location], the combination is maintained separately by [attorney/trustee]" — not "seed phrase: word1 word2 word3..." in a family cloud drive.

Digital Hygiene

The most common seed phrase security failures are digital: photographing seed words on a smartphone (the photo is backed up to cloud storage automatically), typing seed words into a computer to "test" them (keyboard loggers, clipboard monitors), or emailing seed phrase components (email is not encrypted in transit between servers). The rule is absolute: seed phrases exist on physical media only. They are never photographed, typed, stored digitally, emailed, texted, or verbalized in a location where they might be recorded.

Inheritance-Safe Custody Structures

An inheritance-safe custody structure is one that a non-technical executor or trustee can navigate successfully — ideally without the original holder's assistance — after a triggering event. Most existing Bitcoin custody arrangements are not inheritance-safe: they require the original holder's technical knowledge, device unlock credentials, or physical presence to operate.

The Letter of Instruction

The letter of instruction is the non-legal companion document to the will or trust — it provides the practical, operational information that the estate document cannot or should not contain. For Bitcoin custody, the letter of instruction should specify:

• A complete inventory of all Bitcoin wallets: wallet type, hardware device model, approximate balance, and its role in the custody architecture.
• The location of each hardware device — not the seed phrase, but where the device is physically located and how to access it.
• The location of each seed phrase backup — not the seed phrase itself, but where the metal backup is, who holds the safe or deposit box, and how the executor can access it.
• The multisig configuration: which wallet is M-of-N, which devices correspond to which key roles, and how many keys are required to transact.
• The name and contact information of the trusted Bitcoin technician (keymaster) who can assist the executor technically.
• Step-by-step recovery instructions for a non-expert, tested by having a trusted third party attempt to follow them before they are needed.
• The names and roles of all co-signers, institutional custodians, and key agents, with their contact information and the documents governing their participation.

The letter of instruction should be held by estate counsel in a sealed envelope updated whenever the custody architecture changes. It should not be stored digitally, should not be accessible to any single person who might act unilaterally, and should be reviewed and updated annually as part of a formal custody review.

The Keymaster Protocol

A keymaster is a designated technical Bitcoin expert — not a key holder — who is documented in the estate plan as the person the executor should contact for technical assistance. The keymaster's role is to translate technical recovery procedures for a non-technical executor, verify that recovery procedures work as documented, and provide continuity if the original custodian or co-signing service is unavailable.

The keymaster should be: technically competent (able to use multisig coordinator software, hardware wallets, and seed phrase recovery), trustworthy but not a key holder (keeping them separate prevents insider misappropriation), compensated with a retainer or estate fee (creating accountability), and named in the estate documents with a succession keymaster if the primary is unavailable. This role is distinct from any legal or financial adviser role — it is a pure technical function.

Dead Man's Switch Mechanisms

A dead man's switch in Bitcoin custody is a mechanism that grants heir access after a specified period of inactivity by the primary holder — without requiring any individual to hold a perpetual trigger. The simplest Bitcoin-native implementation uses time-locked scripts:

In a 2-of-3 multisig wallet with a time-lock script, the heir holds one key (Key C) that is normally unusable — it can only sign transactions after block height N (approximately the equivalent of 12 or 18 months from wallet creation). The primary holder holds Key A and Key B. Normally, transactions require Key A + Key B — the heir's key is cryptographically irrelevant. If the primary holder is incapacitated or dies without triggering a refresh, the heir's Key C becomes valid after the time-lock expires. Paired with Key A or Key B held by the keymaster per the letter of instruction, the heir can recover the Bitcoin.

The primary holder "proves alive" and resets the clock by periodically sweeping the Bitcoin to a freshly created wallet — which moves the time-lock forward and invalidates the previous heir access path. This annual or bi-annual refresh process also serves as a mandatory custody audit: it forces the primary holder to verify that all keys are accessible and the architecture is intact.

The Multisig Inheritance Architecture: Integrated View

Combining these elements, a complete inheritance-safe multisig structure for a $5M–$25M family might look like:

• 3-of-5 multisig wallet with Taproot for privacy
• Key 1 (Primary): Primary holder, hardware wallet, metal backup in home safe
• Key 2 (Backup): Primary holder, second hardware wallet, metal backup in bank safe deposit box in different city
• Key 3 (Spouse/Trustee): Spouse or designated co-trustee, hardware wallet, metal backup with estate attorney
• Key 4 (Institutional): Unchained Capital or comparable co-signing service, per custodial agreement
• Key 5 (Successor): Adult child or successor trustee, hardware wallet, metal backup held in sealed envelope with estate attorney to be released upon triggering event
• Letter of instruction held by estate attorney, updated annually
• Named keymaster with technical assistance retainer
• Annual custody review protocol: verify all hardware wallets function, all backups are intact, all key holders are reachable, letter of instruction is current

With this structure, the death or incapacity of any single person — including the primary holder — does not prevent Bitcoin access. Three of five parties can coordinate to transact or recover the full holding. No single party can move the Bitcoin unilaterally. The letter of instruction provides the non-technical roadmap.

Decision Framework by Wealth Level

Custody architecture is not one-size-fits-all, and complexity has real costs. The right architecture at $1M is not the right architecture at $100M. Here is a practical decision framework organized by total Bitcoin holding value.

Frequently Asked Questions

What is the safest Bitcoin custody architecture for a family office?

For a family office with significant Bitcoin holdings, the most secure practical architecture is a geographically distributed 3-of-5 multisig: five keys stored in five separate locations with no single location holding more than one key. Professional institutional co-signing for at least one key position. Metal seed phrase backups at geographically separate locations. A documented letter of instruction held by estate counsel, tested recovery procedures, and a named keymaster for technical assistance. Annual review protocol. The specific configuration depends on your exact wealth tier, family structure, and succession requirements — but the architectural principles are consistent.

Can a trust own Bitcoin in self-custody?

Yes. A trust can own Bitcoin held in self-custody multisig, with the trustee holding one or more keys in their trustee capacity. The trust document should specify the signing procedures, and the custody architecture should be reflected in the letter of instruction. Working with a Bitcoin-specialized estate attorney is important to ensure the legal structure and the custody architecture are coherent.

Is Unchained Capital a qualified custodian for investment advisers?

No. Unchained Capital is a collaborative custody service, not a regulated trust company or bank. It is not a qualified custodian under the Investment Advisers Act as extended by the CLARITY Act. Registered investment advisers managing client Bitcoin must use a qualified custodian (Coinbase Custody, BitGo Trust, Anchorage, Fidelity Digital Assets, or comparable). Single-family offices exempt from adviser registration can use Unchained's collaborative custody model freely.

How does the OBBBA estate tax exemption change Bitcoin custody planning?

The One Big Beautiful Budget Act's permanent increase to $15 million per individual ($30 million per couple) removes the federal estate tax urgency from most family office Bitcoin holdings at current values. It does not change the succession challenge: Bitcoin that is inaccessible to heirs due to poor custody architecture is lost regardless of tax status. The OBBBA changes the tax planning calculus; it does not change the custody architecture requirements.

What is a Wyoming PFTC and is it worth the cost?

A Wyoming Private Family Trust Company is a state-chartered trust company organized to serve a single family. It can serve as trustee, qualified custodian, and institutional co-signer for Bitcoin held in trust structures. The setup cost ($250K–$500K in legal and organizational fees) and ongoing compliance cost make it appropriate for holdings above $25–50M where generational continuity and institutional trustee permanence justify the investment. Below that threshold, a Wyoming-chartered trust company engagement is typically more cost-effective than establishing a proprietary PFTC.

What are the biggest mistakes families make in Bitcoin custody?

The most common and costly mistakes: (1) leaving significant holdings on exchanges indefinitely rather than transitioning to self-custody; (2) securing the hardware device but not the seed phrase backup, which is the actual key; (3) building a technically sound multisig that is operationally undocumented — so it cannot be inherited; (4) not testing recovery procedures before they are needed; (5) failing to update the letter of instruction when the custody architecture changes; and (6) optimizing for security against remote theft while leaving succession failure as an unaddressed risk.