Rethinking the Keys to Your Money.
Bitcoin self-custody has always offered an extraordinary promise wrapped in a slightly terrifying instruction: you are now responsible for not losing the secret. Bitkey asks whether ownership can remain sovereign without requiring ordinary people to become amateur cryptographic archivists.
By Dr. Rob Urban · On multisignature security, fingerprints, recovery, inheritance and the difficult engineering problem of making personal sovereignty survive normal human behavior
The contradiction at the center of self-custody
Bitcoin lets you remove the institution from ownership. It does not remove the human from responsibility.
There is a wonderfully clean idea buried inside bitcoin: if you control the private keys, you control the money.
Then reality arrives.
People lose phones. Houses flood. Hardware disappears into drawers. Passwords are forgotten. Paper is thrown away. Families inherit assets they do not know exist. A perfectly secure secret can become perfectly useless if the only person who understands it is no longer available.
Traditional self-custody often solves this by giving the owner a recovery seed, usually a sequence of words that can reconstruct the wallet. Cryptographically, this can be elegant. Operationally, it creates one of the strangest responsibilities in consumer finance.
Here is a secret that can control your money. Do not photograph it. Do not email it. Do not lose it. Do not let anyone copy it. Keep it safe from fire, theft, water, forgetfulness and your own estate executor. Also, please make sure the right person can somehow find it decades from now.
That is not merely a security problem.
It is an interface problem.
Bitkey exists because the team at Block looked at that contradiction and chose not to treat human fallibility as an edge case.
The architecture
Instead of one secret that can ruin everything, Bitkey divides authority across three keys.
Bitkey is built around a 2-of-3 multisignature wallet.
There are three cryptographic keys. One lives with the mobile app. One lives in the Bitkey hardware device. The third is managed by Bitkey's server infrastructure. Moving bitcoin or making sensitive changes requires an authorized combination of two keys.
The important part is not simply that there are three keys. It is that none of them is sufficient alone.
App Key
Lives in the mobile environment and is protected by the phone's security systems. An encrypted backup can reside in the owner's personal cloud account for recovery.
Hardware Key
Generated and stored in the dedicated Bitkey hardware device. Bitkey says the key never leaves the secure hardware, and biometric authentication is required to unlock the device.
Server Key
Managed by Bitkey to support recovery and optional convenience features. Crucially, the server key cannot move funds by itself.
This changes the failure model.
Stealing the phone is not enough. Compromising Bitkey's server key is not enough. Possessing the hardware device without the required authentication is not intended to be enough. Block cannot simply decide to transfer the customer's bitcoin because it holds only one of the three keys.
At the same time, losing one component does not automatically mean losing the wallet forever.
The design goal is not maximum inconvenience in the name of security. It is eliminating the single catastrophic mistake.
Security for people who behave like people
Bitkey's most interesting assumption is that eventually something will go wrong.
Security products often imagine a disciplined owner.
The disciplined owner labels backups correctly, maintains geographically separated copies, updates estate instructions, tests recovery procedures, recognizes phishing attempts and remembers exactly which piece of metal contains which seed phrase.
Some people really do this.
Most people are also capable of spending twenty minutes looking for the phone currently in their hand.
Good consumer security cannot be designed exclusively for the first person.
Bitkey therefore treats loss, replacement and inheritance as core functions of the wallet rather than support problems to solve later.
Lose the phone
An encrypted App Key backup stored in the owner's iCloud or Google Drive account can be decrypted with the Bitkey hardware device to restore access.
Lose the hardware
Bitkey's Delay + Notify recovery path can replace a lost hardware key using the remaining architecture, with a security delay intended to give the owner time to detect abuse.
Lose both
If a Recovery Contact was configured in advance and the cloud backup remains accessible, Bitkey provides a path for that trusted person to assist without gaining access to the wallet itself.
The new 2026 hardware
The physical wallet finally has something important to say.
Bitkey's first-generation hardware was deliberately minimal. The 2026 redesign keeps the distinctive compact form but adds an OLED touchscreen.
That screen is more consequential than it sounds.
In security hardware, a trusted display gives the device an independent way to show what the user is approving. The phone can request an action, but the dedicated hardware can present security-critical information on its own surface.
Bitkey says the new screen is used not just for transaction verification but for reviewing sensitive wallet settings, including recovery configuration, spending rules, notification destinations and inheritance decisions.
That moves the hardware from being a cryptographic token toward being a security console.
The current device measures 66 by 60 by 13.6 millimeters and weighs 79 grams. Its shell is Corian Solid Surface, a material more commonly associated with architecture and countertops than cryptocurrency. It includes an OLED touchscreen, biometric fingerprint sensor, NFC connectivity, USB-C charging and a manufacturer-rated battery life of up to one year per charge.
The hexagonal geometry is also unusual. Hardware wallets tend to look like USB sticks, tiny phones or pocket calculators. Bitkey looks like Bitkey.
Biometrics, used carefully
Your fingerprint does not become the bitcoin key.
Biometric authentication can sound alarming in cryptocurrency because fingerprints are not secrets in the traditional sense. You leave them on glasses, door handles and probably the screen you are reading right now.
The useful distinction is what the fingerprint is doing.
Bitkey requires biometric authentication to secure and unlock the hardware device. The fingerprint is an access control for the dedicated device. It is not the private key itself.
The current screened hardware can store up to three fingerprints, which allows redundancy if a finger is injured or inconvenient to use.
This is another example of Bitkey separating cryptographic authority from human interaction. The cryptographic key remains inside the secure hardware. The biometric interface determines whether the person holding the device is permitted to ask that hardware to act.
Security is full of these layers.
The mistake is assuming one layer has to do every job.
Recovery without a seed phrase ceremony
The difficult question is not how to secure a wallet today. It is how to recover it ten years from today.
Bitkey's recovery architecture is where the product stops behaving like a conventional hardware wallet.
When the wallet is configured, an encrypted copy of the App Key can be stored in the user's own cloud account. Bitkey says the hardware device encrypts that backup before upload, leaving the cloud copy unusable on its own.
If the phone is replaced while the hardware device remains available, the owner can reinstall the app, access the cloud account and use the hardware device to decrypt the backup.
If a key is permanently lost, Bitkey's Delay + Notify process can establish a replacement wallet configuration. The delay is not bureaucratic decoration. It is a security control. A legitimate owner can tolerate waiting. An attacker benefits from speed.
If both phone and hardware disappear, a previously enrolled Recovery Contact can assist with decrypting the cloud backup. Bitkey says that contact does not receive the owner's wallet keys or gain access to the bitcoin.
Notice the philosophy.
No single recovery mechanism is trusted with everything. Different failure scenarios use different combinations of keys, encrypted backups, delays and trusted relationships.
The tradeoff worth understanding
Bitkey makes self-custody easier by adding infrastructure, not by pretending infrastructure disappears.
There is an important philosophical distinction here.
Some bitcoin users want a security model with the smallest possible dependency surface. They may prefer an offline seed phrase, open hardware, fully independent signing devices and recovery procedures that involve no company-operated server.
Bitkey chooses a different optimization.
It uses a Block-managed third key, mobile software, personal cloud backup and recovery services to make catastrophic loss less likely and everyday use less intimidating. The architecture is designed so Block's key cannot move funds alone, but Block still participates in parts of the system.
That is not the same thing as custody by an exchange or bank. Block does not possess enough signing authority by itself to spend the wallet.
It is also not the same thing as a completely isolated single-signature hardware wallet.
Those distinctions matter because security is not a single number. It is a set of threats and tradeoffs.
Bitkey is betting that for a large group of people, the probability of losing their own recovery secret is at least as important as the probability of a sophisticated institutional attack.
I think that is an intellectually serious bet.
The problem nobody enjoys planning for
True ownership eventually has to survive the owner.
Self-custody creates an awkward estate-planning problem.
Traditional financial institutions know when an account holder dies because there are legal processes, records, beneficiaries and people whose job is to deal with exactly that situation.
Bitcoin does not know that anyone died.
A blockchain cannot read a death certificate. A private key does not understand probate. If heirs cannot recover the keys, the money may remain mathematically present and practically unreachable forever.
Bitkey introduced its Inheritance feature after the original wallet launch and has continued integrating it into the system. The owner designates a beneficiary who also has Bitkey. The beneficiary cannot see or control the wallet during the owner's life.
If the beneficiary initiates a claim, Bitkey's current process starts a six-month security period. The owner receives alerts and can cancel an erroneous or fraudulent claim. Only after the waiting period completes without cancellation can the inheritance process advance to transfer the funds.
This is fascinating because the security mechanism is time.
Cryptography determines who can authorize. Notifications establish visibility. Delay gives the legitimate owner an opportunity to object.
It is a digital version of a very old security principle: sometimes the best lock is making a dangerous action slow enough to be noticed.
A self-custody system is not complete if it works beautifully for forty years and fails on the forty-first because nobody else knows what to do.
From signing device to ownership system
Bitkey's evolution tells you what Block thinks the real problem is.
Block began testing Bitkey externally in 2023. The company opened a beta program that June, inviting customers outside Block to use the hardware device, mobile app and recovery tools with real bitcoin.
In December 2023, Bitkey opened preorders across more than 95 countries and said shipments would begin in early 2024.
The product then expanded beyond the original signing-and-recovery proposition. Inheritance arrived as a major feature, reflecting the uncomfortable truth that long-term self-custody is also estate infrastructure.
In April 2026, Bitkey introduced the current hardware generation with the OLED touchscreen, a Corian shell and a stronger emphasis on verifying security-critical settings directly on the device.
The progression is revealing.
The team did not simply keep adding more ways to sign a bitcoin transaction. It kept working outward from the transaction into everything that can happen around ownership: loss, replacement, recovery, spending policy, inheritance and the possibility that Bitkey itself may someday be unavailable.
That last problem is addressed by Bitkey's Emergency Exit Kit, designed to give owners a path to their funds if they can no longer or no longer want to rely on the current Bitkey app.
The product is trying to answer a larger question than “Where should the private key live?”
It is asking what ownership looks like across a human lifetime.
Bitkey opens its external beta and begins testing the hardware, app and recovery system with customers outside Block.
Preorders open in more than 95 countries, with shipping planned for early 2024.
The system expands with features including Inheritance, moving the product further into long-term ownership and recovery.
A new generation of Bitkey hardware arrives with an OLED touchscreen, Corian body and on-device verification of security-critical settings.
Four problems, four different tools
What I like most is that Bitkey refuses to call every failure “lost keys.”
Different failures deserve different responses.
A lost phone is not the same problem as stolen hardware. A forgotten cloud account is not the same problem as death. A compromised company is not the same problem as a damaged device.
Collapsing all of them into one backup phrase is beautifully simple until that phrase becomes the thing that fails.
Cloud Recovery
An encrypted App Key backup can restore the mobile side of the wallet when the owner still has the hardware device and cloud access.
Delay + Notify
A time-delayed process can replace a missing app or hardware key while creating an opportunity to detect and stop an unauthorized recovery attempt.
Recovery Contacts
A trusted person configured in advance can assist when both phone and hardware are gone, without being given control of the wallet itself.
Emergency Exit Kit
Bitkey documents an exit path intended for a future in which the owner cannot or does not want to use Bitkey's current software or services.
Why it goes in the digital time capsule
Because the interesting innovation is not storing bitcoin. It is designing ownership for imperfect humans.
The Things Worth Wanting collection is interested in moments when a technology stops being an enthusiast's project and starts becoming an object ordinary people can plausibly live with.
Bitkey sits directly on that boundary.
Bitcoin's original self-custody proposition is radical precisely because it removes the requirement for a trusted financial custodian. But removing an institution transfers responsibility somewhere else.
Usually, it transfers responsibility to you.
That sounds empowering when everything is working. It sounds different when you imagine yourself at 78 trying to remember where you put the backup you created at 43.
Bitkey's contribution is not that it makes responsibility disappear. It distributes responsibility across devices, cryptographic keys, time delays, encrypted backups and relationships while attempting to preserve the core fact that no company-held key can move the money alone.
That is a fascinating design compromise.
The new hardware makes the idea physical. A 79-gram hexagon with a fingerprint sensor and a little OLED screen becomes one piece of a much larger ownership system. The phone is another. Block's server key is another. The cloud backup is another. A recovery contact may become another. An heir may eventually become another.
What looks like a hardware wallet is really an architecture for surviving events.
Lost phone. Lost device. Forgotten backup. Death. Company failure. Human error.
Those are not glamorous product features. They are the things that happen when technology leaves the demo and enters a life.
And that is exactly why Bitkey belongs here.
A few important questions
About Bitkey
What is Bitkey?
Bitkey is a bitcoin-only self-custody wallet from Block built around a mobile app, dedicated hardware device and a 2-of-3 multisignature architecture.
What does 2-of-3 multisig mean?
The wallet has three keys: an App Key, Hardware Key and Server Key. An authorized combination of two keys is required, so no single key can move the bitcoin by itself.
Does Block control the bitcoin in a Bitkey wallet?
Block manages one of the three keys, but Bitkey says that server key cannot move funds on its own. The architecture requires two keys.
Does Bitkey use a seed phrase?
Bitkey is designed around seedless recovery rather than requiring the owner to maintain a traditional recovery phrase. Recovery uses combinations of the hardware, app key, encrypted cloud backup, delays and optional Recovery Contacts.
What are the current Bitkey hardware specifications?
The 2026 device measures 66 × 60 × 13.6 mm, weighs 79 g, uses a Corian Solid Surface exterior, OLED touchscreen, fingerprint sensor, NFC and USB-C charging, with up to one year of manufacturer-rated battery life.
What happens if I lose my phone?
If the encrypted App Key backup remains available in the owner's cloud account and the hardware device is available, the hardware can decrypt that backup to restore the mobile side of the wallet.
Can Bitkey be inherited?
Yes. Bitkey has an Inheritance feature that lets an owner designate a beneficiary. The current claim process includes a six-month security period during which the owner can cancel an incorrect or fraudulent claim.
Is Bitkey the same as leaving bitcoin on an exchange?
No. An exchange generally controls the keys to custodial bitcoin. Bitkey is designed as self-custody: Block has one server key, but that key is insufficient by itself to spend the wallet.