Bitcoin Security Audits Versus Custody Survivability
Security Audit Versus Custody Survivability Review
This memo is published by CustodyStress, an independent Bitcoin custody stress test that produces reference documents for individuals, families, and professionals.
What a Bitcoin Security Audit Examines
A bitcoin wallet or custody system is described as "audited." The word appears in marketing. It appears in product reviews. It appears in conversations about which wallet to use. A bitcoin security audit has been completed. The system passed.
Questions remain. What happens when the holder is no longer available? What happens when required credentials are unavailable? What happens when an authorized third party needs access under stress? The audit report does not answer these questions. The audit was not looking at them.
This memo describes why a bitcoin security audit and custody resilience analysis examine different things. A system can pass one and fail the other. The two are not the same question.
What a Bitcoin Security Audit Examines
A bitcoin security audit looks at how a system resists attack. The auditor asks: Can someone steal these funds? Can a hacker break in? Can malware drain the wallet? Can a thief with physical access take the coins?
The audit examines code. It examines hardware. It examines how the wallet handles private keys. It checks for known weaknesses. It tests whether an outsider can force their way in.
A bitcoin wallet audit follows similar logic. The auditor studies the wallet's design. They look for bugs. They look for flaws that let attackers in. They test what happens when someone tries to break the system from outside.
The threat model is adversarial. Someone is trying to take what is not theirs. The audit measures how well the system stops them.
What a Bitcoin Security Audit Does Not Examine
The audit does not ask what happens when you are gone. It does not ask whether your family can recover the funds. It does not ask whether your backup works after five years in a drawer. It does not ask whether your executor understands what to do.
These questions fall outside the scope. The auditor is testing resistance to attack. The auditor is not testing whether authorized people can access the funds under stress.
A system that resists attackers does not automatically help your heirs. The same walls that keep thieves out also keep your family out. The audit measures the walls. It does not measure the doors your family would need to walk through.
Two Different Questions About the Same System
A vault with a ten-inch steel door illustrates the distinction. A security audit would examine the door. How hard is it to drill through? Can someone pick the lock? Can someone guess the combination? The audit would report on the door's resistance to forced entry.
In a scenario where the holder is deceased, Your spouse needs into the vault. She has legal authority. She has your death certificate. She has the will naming her as heir. She does not have the combination.
The vault resists her too. It cannot tell the difference between your grieving spouse and a thief. The steel is the same steel. The lock is the same lock. The vault passed its security audit. Authorized parties remain unable to gain access.
Bitcoin custody works the same way. The math that protects your coins from hackers also protects them from your heirs. A private key does not know who is typing. It only knows whether the right numbers appear.
The Hardware Wallet Scenario
Consider a hardware wallet. The device stores private keys. The keys never leave the device. A bitcoin wallet audit examines this design. The auditor confirms that keys stay protected. They confirm the device resists tampering. They confirm malware on your computer cannot steal the keys.
The audit passes. The wallet is resistant to remote attack. The wallet is resistant to physical tampering. The report says the device protects your bitcoin.
You die. A device is located after the holder's death. He does not know the PIN. He does not know where you wrote the seed phrase—the backup words that can restore access. He searches your house. He searches your safe deposit box. He finds nothing.
The hardware wallet is still resistant to attack. It resists your son the same way it would resist a thief. The device does not know your son is the rightful heir. It only knows the PIN is wrong. After several wrong guesses, the device wipes itself.
The bitcoin security audit said nothing about this scenario. The audit was checking for attackers, not grieving children.
The Multisig Scenario
Multisig means multiple signatures. A bitcoin wallet can require two keys, or three keys, or five keys to move funds. This design is commonly described as security-focused. A bitcoin wallet audit of a multisig setup would examine how the keys are generated. It would examine whether the signing process resists attack. It would examine what happens if one device is compromised.
The audit might conclude that the setup is resistant to theft. No single stolen device can drain the funds. An attacker would need multiple devices from multiple locations.
Now consider inheritance. You set up a two-of-three multisig. You kept one key. Your brother kept one key. A third key sits in a safe deposit box. You told no one about the safe deposit box.
You and your brother both die in a car accident. Your heirs find your key. They find your brother's key. They cannot find the third key. They do not know it exists. Two keys are not enough. The bitcoin cannot move.
The security audit did not examine this. The audit examined resistance to attack. It did not examine what happens when key holders disappear and information gaps emerge.
Why the Distinction Matters
The term 'audited' is often interpreted as implying safety. They think the hard work is done. They think experts have checked everything. This is a misunderstanding of what audits examine.
A bitcoin security audit examines one threat: attackers trying to steal funds. It does not examine the threat of lost access. It does not examine the threat of forgotten PINs. It does not examine the threat of heirs who cannot figure out your system.
Survivability is a different question. Survivability asks: Can the right people access this bitcoin when they need to? Can your spouse access it if you have a stroke? Can your executor access it if you die? Can your children access it if both parents are gone?
A system can score well on security and poorly on survivability. A system can resist every attacker while remaining unreachable by every heir.
Different Threat Models
A threat model is a way of thinking about danger. It defines who might cause harm and how. Different threat models lead to different conclusions about the same system.
A security threat model assumes an adversary. Someone wants your bitcoin. They will try to trick you, hack you, or steal your devices. The model asks how to stop them.
A survivability threat model assumes you are gone. You are dead, or sick, or unreachable. The model asks how the people you trust can access your bitcoin. It assumes no adversary—just confusion, missing information, and people who do not know what to do.
The same wallet looks different under these two models. Under the security model, complexity is a feature. More keys, more steps, more passwords—all make theft harder. Under the survivability model, complexity is a hazard. More keys, more steps, more passwords—all make recovery harder for people who did not build the system.
What Audit Reports Do Not Say
A bitcoin security audit report does not say: "Your heirs can recover this bitcoin." It does not say: "Your backup will work in ten years." It does not say: "Your spouse will understand these instructions."
The report says what it tested. It tested for code bugs. It tested for hardware flaws. It tested for attack vectors. It did not test your family's ability to execute your recovery plan.
Audit scope determines what gets examined. Topics outside the scope remain unexamined. Survivability is usually outside the scope of a bitcoin wallet audit. The audit is silent on the question, not because the question is unimportant, but because the audit was not designed to answer it.
The Time Gap Problem
Security audits examine a system at a moment in time. The auditor tests the code as it exists today. The auditor tests the hardware as it is configured now.
Custody unfolds over years. You set up a wallet. You write down a seed phrase. You put it somewhere. Years pass. You move houses. You change phones. You forget details. The seed phrase sits in a location you no longer remember clearly.
The security audit did not test what happens after five years of life. It did not test what happens when you forget which drawer. It did not test what happens when your backup degrades or gets thrown away by accident.
Survivability depends on what persists over time. Security depends on what resists attack right now. These are different time horizons looking at different risks.
The Human Element
Bitcoin security audits examine code and hardware. They examine technical systems built by engineers. They do not examine your wife's comfort with technology. They do not examine whether your executor knows what a seed phrase is. They do not examine whether your children will cooperate or fight over the inheritance.
Custody survivability depends heavily on humans. The humans need to find things. The humans need to understand things. The humans need to work together. The humans may be grieving, stressed, or overwhelmed.
A bitcoin wallet audit cannot measure human factors. The audit examines the wallet. It does not examine the people who will need to use the wallet after you are gone.
Conclusion
A bitcoin security audit evaluates resistance to attack. The audit asks whether hackers, thieves, or malware can steal funds. The audit examines code, hardware, and system design. A bitcoin wallet audit follows the same logic—testing whether the wallet resists unauthorized access.
Custody survivability asks a different question. It asks whether authorized people can access funds when the original holder is gone. It asks whether heirs can navigate the system. It asks whether backups work after years of sitting unused.
A system can pass a security audit while remaining unrecoverable by heirs. The same protective barriers restrict both unauthorized and authorized access. The audit measures the walls. It does not measure whether your family can find the door.
System Context
Examining Bitcoin Custody Under Stress
Monitoring Cadence as Responsibility Uncertainty
For anyone who holds Bitcoin — on an exchange, in a wallet, through a service, or in self-custody — and wants to know what happens to it if something happens to them.
Start Bitcoin Custody Stress Test$179 · 12-month access · Unlimited assessments
A structured, scenario-based diagnostic that produces reference documents for your spouse, executor, or attorney — no accounts connected, no keys shared.
Sample what the assessment produces