The Custody Trilemma

If the company that made your wallet disappeared tonight, servers off, app pulled from the store and the team unreachable, could you still move your money tomorrow morning?

Most people can't answer this question about their wallet, which is strange, because it's the only question that matters. Everything else: the swaps, the portfolio chart, the yield graphs, is just decoration on top of a single promise: that the money is truly yours.

A word that means nothing (anymore)

Nearly every wallet you can download today calls itself “self-custodial”.

Almost all wallet extensions and exchange apps have adopted this term. Even products that keep a piece of your key material on their servers have started using it.

To better understand what it means, we first must make an important distinction.

There is a difference between “self-custodial” and “non-custodial”, even though these terms are used seemingly interchangeably in the industry:

• Self-custodial is defined as a wallet or account where all private keys are managed by the user, and no single external service provider has the ability to censor or prevent the user's transactions at any point.
• Non-custodial is defined as a wallet or account where the private keys are distributed between the user and an external service provider, with that provider retaining some form of control over the account.

The first describes ownership. The second describes a partnership.

Since the label isn't really trustworthy, we need a test that completely ignores it. A test that doesn't ask what a wallet calls itself, but what's left of your money once its maker is gone. Building that test means first knowing what a wallet is supposed to do. So we'll start there, with the three things you actually want from it.

What you actually want

You essentially want three things from wallet software.

First, nobody can take your money. Not a thief, not a service freeze, or even the company whose logo is on the app. Celsius users thought they were earning yield on their own coins, right up until June 2022, when withdrawals stopped. The bankruptcy court later made it official: under the terms of use everyone had clicked through, the coins in those interest accounts had belonged to Celsius all along. Users weren't owners, they were “unsecured creditors”. The company's slogan was “Unbank yourself”.^[1]

Second, you can't lose it by being human. Humans lose their phones all the time. They forget passwords. They write twelve words on paper and then move apartments, cities and countries. A meaningful part of all bitcoin, by some estimates a fifth, sits in addresses nobody can access anymore.^[2] A system that punishes ordinary life circumstances with total, permanent loss, is not a system for ordinary people.

Third, you don't need to become an expert. There's a document called the “Glacier Protocol”, which describes a meticulous procedure for storing Bitcoin with maximum security.^[3] It is excellent work, and almost nobody on Earth has completed it. Security that depends on homework protects only the people who do homework.

Let's call these three properties sovereignty, resilience, and usability.

Pick two

For most of crypto's history, you could have only two of the three.

A hardware wallet with a proper backup scheme gives you sovereignty and resilience. However, onboarding is a project: devices, seed phrases, maybe a multisig spread across locations. Every day after is a ritual, where you need to find the device, plug it in, verify the address on a screen the size of a stamp, sign, repeat per key. Nobody can take the money and no single mistake destroys it, but you will not pay for coffee this way. You won't even check your balance without opening a drawer.

A hot wallet with a seed phrase gives you sovereignty and most of the usability. You're up and running in a few minutes and sending with a tap. Very quickly, you start to see where this “smoothness” leaks. Onboarding opens with a ceremony: copy twelve words onto paper like a medieval scribe, then pass a quiz proving you did it. Recovery is where the interface disappears entirely. There's no "forgot password" in self-custody; there's the seed phrase, or there's zero. You're one screenshot, one phishing site, one bad approval away from that zero, forever.

An exchange account gives you resilience and usability in full. Email signup, password resets, a support inbox, no gas to worry about, no forty-character addresses. It feels like every other app on your phone because it is like every other app on your phone: an account you access, not property you control. Recovery is smooth because the exchange can reset your access. The catch is that the same power lets it freeze you out.

Why you can't have all three

This isn't a coincidence of bad design, but actually the structure of the problem.

A private key is a single secret. To protect yourself from losing it, you have to copy it or split it; there is no third option. Every copy is a new way to be robbed. Every person or server holding a piece is someone new to trust, and every safeguard you add is friction the user pays, either at setup or every day after. You cannot make trust disappear, but you can move it around, onto paper, into hardware or onto third-party servers.

Self-custody is responsibility. Whoever carries the burden of the keys has the custody. This burden cannot be eliminated, only moved to somewhere or someone else, along with the ownership.

How everyone else “solved” it

Before building anything, we looked at how the rest of the industry had solved this tension. We quickly realized that the trilemma was not resolved, just disguised.

The modern version of “custody” looks like this:

You download a wallet, and sign up with Google. No seed phrase ceremony, no quiz, just a familiar OAuth screen and you're in. It feels like an exchange account, and the website says self-custodial.

Behind that friendly screen sits a tradeoff never shown to you: your keys now live, in whole or in part, on infrastructure you don't control.

With MetaMask social login (built on Web3Auth), your recovery phrase is encrypted and split across a network of nine nodes, five of which must cooperate.^[4] Getting it back requires their shard network, your Google, or Apple account, and a password. In Privy's default setup, your key is split into three shares, one on your device, and two (the login share and recovery escrow) on Privy's side.^[5] With Turnkey, the key never touches your device at all. It lives and signs inside Turnkey's secure enclaves.^[6] Magic does the same with a different box, generating the key on your device and then sealing it inside a third-party HSM.^[7]

That last part sounds reassuring, and it is exactly the trick. The hardware guarantees the key can't be stolen. It does not guarantee that only you can use it. The enclave signs for whoever passes the app's login, and the login is whatever the developer built: an SMS OTP, an email link or a session token. The key can stay perfectly safe while your money is being drained. One weak password reset, and the enclave signs for the attacker, exactly as designed.

MPC wallets are often presented as the way out of this problem. They are not. Splitting the key into shares changes the mechanics of signing, not the question of custody, and the question comes straight back: who holds the shares, who can trigger signing, who controls recovery when your phone is gone? In most consumer wallets the answer is the same: one share for you and the rest for the provider. That provider may not move your money alone, but it can still be required to sign, recover, enforce policy, or decide whether your account works at all.

By our two definitions, these wallets are non-custodial, not self-custodial. The deciding question is simple: who else has to cooperate before you can move or recover your funds?

The apps aren't lying to you, exactly. There's usually an export button buried somewhere in the settings. The catch is that the average user never finds it, never knows it matters, and discovers what their wallet actually was on the day the company has an incident, an outage, or an opinion about their account.

The dead-man test

This is the test we held ourselves to. Two questions, and a trap.

Key material

Can you rebuild your keys from things only you have, like a device and a password?

Or does getting them back mean going through someone else's servers, their shard network, whatever they decide to approve?

Operations

If the app died tomorrow, is there a public, documented way to move your money without us? Could someone who knows what they're doing follow it from the docs alone?

The trap

Say your wallet passes both. Maybe it only passes because you were supposed to do something first, like export a key or save a backup. Did you actually do it?

Where the wallets land

A hardware wallet like a Trezor or Ledger, with the seed phrase stamped in steel, holds sovereignty and resilience, and passes both halves of the dead-man test. The key format is an open standard, so a dozen other tools can restore your backup with the company long gone. The price is usability. Nobody onboards their mother onto a multisig.

A classic seed-phrase wallet holds sovereignty and usability, and credit where due, it passes the test cleanly. The phrase is portable, and any competing wallet restores it tomorrow morning. Its problem was never hidden custody. It's that the entire resilience corner is a piece of paper in your handwriting.

An exchange account holds resilience and usability. The dead-man test isn't failed so much as inapplicable: there were never keys for you to lose. Your balance is a row in their database, and the test for databases is bankruptcy court.

That leaves the middle, where the wallets from the last section live: MetaMask's social login, and the embedded wallets inside Privy, Turnkey, or Magic-powered apps. These are the only wallets that market all three corners at once, and the test is what exposes the one they only pretend to hold. All of them fail the key-material half by default: the shares that matter sit on infrastructure you don't control and mostly can't name.

Argent's cloud recovery stores an encrypted recovery kit in your iCloud or Google Drive, but the key needed to decrypt it lives on Argent's infrastructure. Its Ethereum account also ships with Argent as the default recovery guardian, verified by email and phone.^[8] You can replace that setup, but the default recovery path still runs through the company.

Nature or design?

A fair question at this point: is the trilemma a law of nature, or just an artifact of old technology?

It turns out to be partly both.

One half is a real law: the burden of the keys can't be destroyed, only moved, so somewhere a tradeoff always remains. The other half is an accident of history. The trilemma as we've known it assumed a single secret that does everything. The key that spends your money is the key you must back up is the key whose loss is fatal.

In 2013, when a wallet was a file on a laptop and a backup was a piece of paper, that assumption was simply true. It isn't anymore. Phones ship with dedicated secure hardware. Blockchains run programmable accounts. The single all-powerful secret is now a design choice, and you can choose differently.

You still can't make the tradeoff vanish, but you can decide where it falls, and you no longer have to bind spending, backup, and catastrophic loss to one fragile secret.

What we built

A MozaikPay account is an on-chain smart account, controlled by two distinct keys.

The first is a spending key, generated on your phone the moment you sign up. It lives in the device's secure hardware, the Secure Enclave on iOS or the Keystore on Android. It never leaves your phone. It is not backed up, synced, or sent to our servers, and it is not recoverable by us if your phone is gone. It can do exactly one thing: move your funds around.

The second is a recovery key, generated on the same phone in the same moment, then immediately encrypted with a password only you know and set. The encrypted blob is what gets backed up: to your iCloud, your Google Drive, a file you email yourself, wherever you like. The password is never sent anywhere. We never see it, and we never see the key it protects. The recovery signer's only power is rotation: it can replace the spending signer, and it can replace itself. It can never move money.

You can also use a hardware wallet (like a Ledger or Trezor) as the recovery signer for your account. This way, you keep the everyday smoothness of a phone that spends with a tap, while the one key whose loss is fatal lives in cold storage.

The split is not a convention our app enforces.

It is enforced by the account contract itself, in Solidity. The contract checks the action being called against the key that signed for it, and rejects the wrong pairing on-chain. A spending signer that tries to rotate keys reverts. A recovery signer that tries to send funds reverts.

This is the rearrangement the older wallets couldn't make: the key you use every day is not the key whose loss is fatal.

If your phone is destroyed, the spending signer dies with it, and nothing you own is lost. You restore the encrypted blob on a new phone, type your password, and the recovery signer rotates a fresh spending signer into place, on-chain. The old phone's key, even if someone later pulls it from a landfill, signs for nothing.

If your password is forgotten and your backup is gone, the recovery signer is gone, but your spending signer is still on your phone and your money is still spendable. You have time to move funds to a new account while the device still works. The only total loss is losing both at once, which is the same shape as losing your phone and your password manager on the same day. It is the failure mode of every account you already have.

If by any chance you ever suspect your backup has leaked, the recovery key can be rotated to a fresh one under a new password, on-chain. The old recovery key, wherever it ended up, is instantly worthless.

The dead-man test, on us

Key material: The spending key sits on your device, in hardware we can't reach. The recovery key is encrypted with a password we've never seen, in a file we don't host. We hold no shares, no escrow, no shards and no master key. If we vanish, no part of your key material vanishes with us.

Operations: The account is a public ERC-4337 contract. Any competent developer with your recovery key and minimal docs can build a transaction that rotates the spending signer and submit it to any public endpoint. There is no proprietary RPC and no MozaikPay server anywhere in the path.

The tradeoff we accepted

We didn't escape the trilemma. We moved it, and the corner that bends is convenience.

Today MozaikPay sponsors every transaction through a paymaster we run, so you never hit a "buy ETH for fees" screen and never pay to send. We also handle the parts nobody enjoys doing by hand: getting digital dollars in, and cashing them back out to local currency through licensed local partners, with the full cost shown before you tap confirm, not after.

All of that depends on us being here. If we shut down tomorrow, your account still exists, and your funds still move; you would simply fund your own gas and find your own off-ramp, the way every other self-custodial user already does.

The funds are yours unconditionally. The smoothness of moving them for free on a Tuesday afternoon, and the licensed rails that turn them into spendable local money, are the parts that lean on us still being here. Convenience can degrade, but ownership shouldn't.

What's left

Ownership is not what the app lets you do while the project is alive. It is what you can still do after it's gone.

Apps get pulled, servers shut down, teams disband. Every wallet eventually becomes software nobody maintains, from a company nobody remembers. The question is whether your money survives that transition.

So, if your wallet's maker vanished tonight, would your money still be yours in the morning?

We're the team behind MozaikPay, a digital dollar wallet for paying, getting paid, and cashing out. Join the waitlist below.👇

https://mozaik.money