16 May 2023. Ledger announced Ledger Recover: an optional paid service that would encrypt your seed, split it into three shards held by three separate companies, and restore it to your device after identity verification.
Nothing was breached. Nothing was stolen. The service was opt-in.
The reaction was the loudest in the company's history, and the reason is worth understanding precisely.
To make it work, the firmware shipping on every device had to include a code path capable of packaging seed material and sending it off the device, gated on the user consenting on-device.
That sat against years of messaging that your keys never leave the secure element.
Ledger's chief executive argued the meaningful residual risk was legal compulsion, since subpoenas across the three custodians' jurisdictions could reconstruct a seed. The company delayed the launch and committed to publishing the code.
Whether the risk profile genuinely changed is still argued about, and both positions are reasonable. What is not in dispute is what users learned.
The property they thought they had bought was enforced by the vendor's policy, not by the hardware. And they found out from a press release.
That is the question this lesson exists to make you ask before you buy anything: not what a product promises, but which of its promises would survive the vendor deciding otherwise.
You have the taxonomy, the tiers, the setup ceremony, the backup and the drill. This lesson turns them into one decision, and then into a written specification.
Physics, mathematics, or policy
Sort every guarantee you are offered into one of three bins.
Enforced by mathematics. Your seed cannot be brute-forced. Nobody can derive your private key from your address. These do not change, they do not depend on anybody's intentions, and F103-01's arithmetic is why.
Enforced by physics. An air-gapped machine cannot transmit over a network it is not connected to. A metal plate in a safe cannot be read remotely.
Enforced by policy. Everything else. What the firmware will and will not do. Whether the vendor holds a key. Whether the terms transfer title, per F103-03. What the company does when a court asks.
Policy guarantees are not worthless. Most of a good setup is built from them, and a reputable vendor's policy is worth more than a stranger's. They have one property you must account for: they can change, and you will learn afterwards.
So the diligence question is never "is this secure". It is: which bin is each promise in, and what happens to me if every policy promise is withdrawn tomorrow?
Run it on the autopsy. "The key never leaves the device" was believed to be physics. It was policy. Nothing was stolen, and a great many people had built a plan on the wrong bin.
Three inputs
Everything about your choice follows from three facts about you, and none of them is a brand.
How much. Not exactly, but the order of magnitude, and honestly.
How often. Daily activity and a long-term hold are different jobs, which is F104-02's entire argument.
Who else. A partner, an heir, a business, a co-signer. This changes the answer more than the amount does, and F110 is where it is developed.
The procedure
Read down until a row describes you. The tiers from F104-02 apply throughout; this is about what each tier is made of.
| Situation | Vault | Daily | Burner |
|---|---|---|---|
| Learning, under a few hundred | Not needed yet | Reputable software wallet | Same wallet, second account |
| Meaningful but replaceable | One hardware wallet, paper backup, drilled | Software wallet on a phone | Separate software wallet |
| More than you could replace | Hardware or air-gapped software, metal backup in two locations, annual drill | Hardware wallet, separate seed | Software wallet |
| Life-changing, or others depend on it | Multi-signature across devices and locations, plus F110-06 written plan | Hardware wallet | Software wallet |
| A business, or you hold for others | Multi-signature with separated signers and a written policy | Policy-controlled account | Not applicable |
Two rows deserve comment.
The first row is a real answer, not a placeholder. A beginner with $200 who is told to buy hardware frequently buys nothing and stays on an exchange. A reputable software wallet with a small amount, used carefully, is a better place to build competence.
The last two rows involve other people, and at that point the technical question stops being the hard one. Multi-signature is a coordination problem before it is a cryptography problem, and F110 exists because most holders never solve it.
When complexity starts costing you
This is the part that the industry, which sells complexity, does not say.
Every component you add reduces one risk and adds a way to lose access. Multi-signature removes the single point of compromise and adds a set of keys to lose and a quorum to coordinate. A passphrase defends against physical discovery and adds an unrecoverable secret. A clever hiding place defends against a burglar and adds the possibility that nobody ever finds it.
The crossover is where the probability you cannot operate the setup exceeds the probability it is attacked.
And F103's survey tells you which side most people are on. 35 percent had lost access. The leading causes were a forgotten password, a lost phrase and lost two-factor access. Not one is an attacker.
The correct order is not the one the marketing implies.
A simple setup you have drilled, maintained and can operate under stress beats a sophisticated one you half-configured. A two-of-three multi-signature you have never rehearsed is worse than a single hardware wallet you have wiped and restored twice.
So the honest upgrade path is: get one tier working, drill it, live with it for a few months, and add complexity only when you can state which specific threat the addition removes and confirm you can still recover after adding it.
If you cannot name the threat in one sentence, per F106-01's first question, the addition is theatre with a maintenance cost.
Write it down
The output of this course is not a purchase. It is a specification, and it becomes the input to two other things.
Write down, on one page:
- Each tier: what it holds, roughly how much, what it is allowed to connect to
- What each one is made of: device, seed, passphrase or not, derivation path if non-default
- Where each backup lives, by location rather than by content
- The drill date for each tier and when the next one is due
- What triggers a review: a threshold crossed, a house move, a new person involved
This page is what F104-L1 asks you to build with real but small funds, and it is the technical half of the document F110-06 asks you to leave behind.
Store it where you would store the rest of your important paperwork, dated, containing no secrets.
The right answer is whatever the most security-conscious people use.
The people whose setups you read about online have a threat model you almost certainly do not share, and copying their answer without their inputs produces a worse outcome than choosing your own.
F106-01 made this point about threat models and it applies with more force here, because a custody setup has to be operated for decades. A configuration that a security professional maintains comfortably is a configuration you will stop maintaining in month four, and an abandoned setup fails in the direction of lost access, which is the more common failure.
There is a second problem with copying. The public advice in this field is disproportionately written by people who sell components of the answer, and F104-01's commercial disclosure is on this page for the same reason. Notice what a recommendation would cost the recommender if it were wrong.
The defensible method is the boring one. Start from your three inputs, choose the simplest configuration that covers them, drill it, and add only what you can justify in a sentence. That produces a setup nobody will write an article about, which will still be working in ten years.
Closing F104
You now have the architecture that the rest of the Freshman level assumes. F105 is what you sign with it. F106 is who is coming for it. F110 is what happens to it when you are not there.
F104-L1 builds the three tiers. F104-L2 is the wipe drill. Both are components of the Custody Practical, and both are done with real but small funds, because a setup that has never held anything has never been tested.
Sort every guarantee into physics, mathematics or policy, and remember that policy can change by press release, which is what Ledger Recover taught a great many people about a property they thought they had bought. Choose from three inputs, how much, how often and who else is involved, rather than from a brand, and read down the table until a row describes you. Then stop, because every component you add removes one risk and adds a way to lose access, and the crossover arrives sooner than the marketing suggests: a simple setup you have drilled beats a sophisticated one you half-configured. Write the specification on one page with no secrets in it, and hand it to F104-L1 now and to F110-06 later.