The finder’s methodology

How we weigh risk

The setup finder scores six concerns. Four of them you walk through — each starts at a research-based default and moves with facts about your situation. This page is the homework behind it — where every default comes from, what shifts it, which numbers are estimates rather than research, what we refuse to ask, and where we’re honestly uncertain. No other part of the recommendation is hand-waved either, but this is the part worth publishing.

The standard picture — the typical holder’s four researched risks

Each bar is a concern’s share of expected loss for a typical holder — someone with meaningful but not life-changing money at stake, mixed custody, no public profile. Not a probability, a share: “of the ways this is likely to go wrong, how much of the danger lives here.” Beside each bar is the research band we publish with it — the honest range, not just the point.

Where each default comes from

Four anchors, four very different kinds of evidence — a reported-loss flow, a lost-coin stock, a corporate failure history, and an incident registry. That mismatch is exactly why the bands above are wide (more on that below).

The other two concerns — scored, but not from base rates

The four above are the ones with published research behind them, and they are the four you walk through. The engine scores six things in total. The other two come from questions you answer in plain words, and they are scored exactly like the rest rather than applied as a thumb on the scale afterwards:

• What’s at stake

  How much losing this Bitcoin would hurt — never how much it is. This carries roughly double the weight of any other row, which is what “more at stake justifies more protection” looks like when it is stated rather than implied. And it is exactly one row, so it can never count twice.

• How much you mind a third party

  Whether you want a company anywhere near your keys. Collaborative custody scores badly here on purpose — that is its real cost, and the only place it is charged. It behaves like every other answer: it moves a bar, and the bar moves the recommendation. No hidden penalty, no option barred from leading.

Neither has a research band, because neither is a base rate — they are facts about you that only you can supply, and the finder asks for them directly.

The typical holder’s bundle — and this is the estimated part

An untouched bar has to mean something. The obvious choice — start everyone at zero and let the questions add up — would quietly assert that the typical holder has none of these problems, which is false: it would make a section you walked and cleared look identical to one you skipped, and those are opposite signals. So the baseline is a model of what a typical holder actually carries. Score above it and your bar rises; below it and it falls; land on it exactly and you sit on the published default, which is what “typical” is supposed to mean.

Points, not a count of statements — each one carries a small, medium or large weight, so “three of eight” describes different people depending on which three. Locking yourself out is deliberately the largest share, because it is the thing holders are genuinely worst at: most have never test-restored a backup, and nearly nine in ten have told nobody. Targeted physical theft is the smallest, matching its small share above — most holders are known to somebody, but very few are targets.

What moves the bars

Your stakes shift the starting point. The finder asks how much losing this Bitcoin would hurt — never how much it is. If losing it wouldn’t change your life, the company-failure share starts larger (small holders are the ones most likely to still be entirely on an exchange) and targeted physical theft starts near nothing. If losing it would be devastating, targeted theft starts meaningfully higher and company failure lower — big holders are mostly off exchanges already, and perceived worth is what attracts targeting.

Then your situation moves each bar individually. The assessment is 29 plain yes/no statements — “true of me?” — and every single one carries its evidence in the same breath, so you can see why checking it moves the bar. Checking everything in a section pushes that bar high, but never to the top of the scale: total certainty about the future is not something this page gets to claim, and neither does the bar.

Low, typical, elevated, high — and why there are no numbers

Your result is always one of four words per concern. Typical means you sit inside the research band above — you are the base rate. Low means below it, elevated meaningfully above it, high well above it. That’s the whole scale.

We don’t show you a score, and that is a decision, not a limitation. The sources behind these defaults measure different things, over different periods, with different denominators — a “your remote-theft risk is 43.7” would be false precision, dressing a judgment call up as a measurement. The words carry exactly as much confidence as the evidence does. No more.

The questions we deliberately don’t ask

Most risk quizzes ask some version of these. We looked for the evidence and didn’t find it — so the assessment doesn’t ask, and this list stays published as part of the method.

The concern we tested and did not add

One risk on this list nearly became a seventh row: the device you bought is quietly broken and you cannot tell. It is not hypothetical — a hardware wallet we rate shipped a seed generator that produced predictable seeds, and the wallets drained because of it are the reason for our standing advisory. It is a real way to lose Bitcoin and it belongs somewhere on this site.

So before writing a word of it we ran it through the engine as if it were live, across every combination of answers the finder can produce, to see what it would actually change. The answer was the opposite of what we expected:

• It got quieter as the stakes got higher

  Turned all the way up, it changed the recommendation for roughly half of readers holding Bitcoin they are learning with, one in five with meaningful money on the line, fewer than two in a hundred at serious stakes — and not one reader at all where losing it would change their life. Exactly backwards. It was loudest for the people we have deliberately decided not to push, and silent for everyone else, because our floor for money that would hurt to lose had already moved them.

• And it would have moved bars nobody touched

  Every concern here starts from a base rate, so a seventh one would have quietly re-weighted the answer for readers who never opened that section at all. The only version that left them alone was one whose base rate was zero — and a concern with no base rate is not a concern on this page, it is a thumb on the scale with a label.

What we did instead is the part that matters. The defence against a broken device is not a different rung — it is not having a component whose failure is total, which is already the floor we hold you to. What it really argues for is a property of how you build your setup: keys from more than one maker, and randomness that did not come only from the device. Those are decisions you make on your plan and your checklist, so that is where they now bite — including a plan that is fully filled in and still has one brand holding enough keys to spend on its own. A risk score would have been a worse version of a thing we can simply check.

We are publishing this because a finding that says “don’t build it” is worth as much as one that says build it, and because a method you cannot see us change our minds inside is not a method.

The headline statistics behind these defaults — the FBI’s IC3 annual report, Chainalysis’s crime reporting, and the physical-attack registry — are on our freshness watch and re-checked on a schedule, like the prices and claims everywhere else on this guide. The verified date at the bottom of this page is real, and it moves when the evidence does.