{"id":2060,"date":"2026-10-01T18:43:56","date_gmt":"2026-10-01T18:43:56","guid":{"rendered":"https:\/\/neverlosebitcoin.com\/?p=2060"},"modified":"2026-10-01T18:45:17","modified_gmt":"2026-10-01T18:45:17","slug":"xyzvault-cant-see-vs-wont-look","status":"publish","type":"post","link":"https:\/\/neverlosebitcoin.com\/de\/xyzvault-cant-see-vs-wont-look\/","title":{"rendered":"&#8220;We Can&#8217;t See Your Data&#8221; vs &#8220;We Won&#8217;t Look&#8221;: The Custody Privacy Litmus Test"},"content":{"rendered":"<p>Most Bitcoin custody marketing protects your coins. Almost none of it protects your privacy. In June 2026, a new vault provider called XYZVault showed up on Stacker News with a sharp framing of the difference, and the post became one of the most engaged <a href=\"https:\/\/neverlosebitcoin.com\/de\/multisig\/\">multisig<\/a> discussions of the year: 23.8k sats and 13 comments. The framing is worth your attention regardless of what you think of the vendor.<\/p>\n<p>One warning up front: everything about the company&#8217;s architecture below is their claim, not independently verified fact. I will flag that each time, because the distinction the post draws is exactly about not taking companies at their word.<\/p>\n<h2>The litmus test<\/h2>\n<p>XYZVault&#8217;s proposed test is simple: if a vault service can report its total assets under custody, or if it charges you a percentage of your holdings, then it can read every customer&#8217;s balance. Full stop. A provider that prices off your stack size necessarily knows your stack size.<\/p>\n<p>The company claims it cannot produce that number for its own platform. That is a strong claim, and it is the right kind of claim: falsifiable in principle, structural rather than promissory. &#8220;We can&#8217;t see your data&#8221; is a statement about architecture. &#8220;We won&#8217;t look&#8221; is a statement about intentions. Architecture beats intentions, because intentions change and math does not.<\/p>\n<h2>The architecture, as the vendor describes it<\/h2>\n<p>All of the following comes from XYZVault&#8217;s own posts, and I could not independently verify it. Their site is referenced as xyzvault.io, but a direct check of the site failed, so treat everything here as vendor claims:<\/p>\n<ul>\n<li><strong>2-of-3 multisig vault.<\/strong> The company holds 1 of 3 keys. The user holds the other two on hardware wallets. The company can never move funds alone.<\/li>\n<li><strong>Browser-side encryption.<\/strong> Encryption happens in the user&#8217;s browser. The passphrase-derived key never leaves the browser. Servers store only ciphertext: vault names, device info, wallet configuration, everything.<\/li>\n<li><strong>No balance or history storage.<\/strong> The company claims it stores no addresses, balances, or transaction history. The browser derives addresses locally and queries a blind proxy to a private Bitcoin node that relays data without linking addresses to users.<\/li>\n<li><strong>Enclave-enforced spending rules.<\/strong> Spending rules like address allowlists, daily limits, and hold timers are stored encrypted and enforced inside a secure enclave, changeable only with a hardware-wallet signature.<\/li>\n<li><strong>Recovery without the company.<\/strong> If XYZVault disappears, the user sweeps funds into Sparrow with their two keys. No company cooperation needed. That only works if you kept the wallet descriptor: <a href=\"https:\/\/neverlosebitcoin.com\/de\/seed-words-not-enough\/\">seed words are not enough<\/a> to recover a multisig.<\/li>\n<\/ul>\n<p>If true, this is a meaningful step beyond the standard assisted-custody model, where the co-signer typically sees your full balance and holds your email. The August 2026 discussion of Nunchuk&#8217;s platform key showed exactly that privacy cost: identity tied to the wallet, balance visible to the co-signer.<\/p>\n<h2>How to evaluate claims like these<\/h2>\n<p>The vendor&#8217;s framing gives you the tool to evaluate the vendor. Ask of any custody provider:<\/p>\n<ol>\n<li>Can they tell you their total assets under custody? If yes, they read balances.<\/li>\n<li>Do they charge a percentage of holdings? If yes, they read balances.<\/li>\n<li>Do they require an email or phone number? If yes, they link identity to the wallet.<\/li>\n<li>As a co-signer, what exactly can they see? Get the specific answer, not the marketing answer.<\/li>\n<li>If the company vanished tomorrow, could you recover with standard open-source tools? If no, you do not have self-custody, you have an account.<\/li>\n<\/ol>\n<p>&#8220;Can&#8217;t see&#8221; is a high bar. Most providers in the market today are &#8220;won&#8217;t look&#8221; at best. Knowing which one you are buying is the entire game.<\/p>\n<p>For comparing assisted options against pure DIY multisig, the <a href=\"https:\/\/neverlosebitcoin.com\/de\/wizard\/\">multisig wizard<\/a> lays out the tradeoffs, and the <a href=\"https:\/\/neverlosebitcoin.com\/de\/best-bitcoin-wallet\/\">Die beste Bitcoin-Wallet<\/a> comparison covers the hardware side. The <a href=\"https:\/\/neverlosebitcoin.com\/de\/compatibility\/\">compatibility checker<\/a> shows which coordinators support assisted-multisig workflows.<\/p>\n<p><em>Discussed on Stacker News: <a href=\"https:\/\/stacker.news\/items\/1504805\" target=\"_blank\" rel=\"noopener\">XYZVault &#8211; &#8220;we can&#8217;t see your data&#8221; vs &#8220;we won&#8217;t look&#8221; which one matters to you?<\/a><\/em><\/p>","protected":false},"excerpt":{"rendered":"<p>Most Bitcoin custody marketing protects your coins. Almost none of it protects your privacy. In June 2026, a new vault provider called XYZVault showed up on Stacker News with a sharp framing of the difference, and the post became one of the most engaged multisig discussions of the year: 23.8k sats and 13 comments. The&#8230;<\/p>","protected":false},"author":5,"featured_media":2061,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_kad_blocks_custom_css":"","_kad_blocks_head_custom_js":"","_kad_blocks_body_custom_js":"","_kad_blocks_footer_custom_js":"","_kadence_starter_templates_imported_post":false,"_kad_post_transparent":"","_kad_post_title":"","_kad_post_layout":"","_kad_post_sidebar_id":"","_kad_post_content_style":"","_kad_post_vertical_padding":"","_kad_post_feature":"","_kad_post_feature_position":"","_kad_post_header":false,"_kad_post_footer":false,"_kad_post_classname":"","footnotes":""},"categories":[11],"tags":[],"class_list":["post-2060","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-self-custody"],"taxonomy_info":{"category":[{"value":11,"label":"Self-Custody"}]},"featured_image_src_large":["https:\/\/neverlosebitcoin.com\/wp-content\/uploads\/2026\/10\/nlb-thumb-xyzvault-cant-see-vs-wont-look-1024x576.webp",1024,576,true],"author_info":{"display_name":"WUMBOLOVER","author_link":"https:\/\/neverlosebitcoin.com\/de\/author\/wumbolover\/"},"comment_info":0,"category_info":[{"term_id":11,"name":"Self-Custody","slug":"self-custody","term_group":0,"term_taxonomy_id":11,"taxonomy":"category","description":"","parent":0,"count":27,"filter":"raw","cat_ID":11,"category_count":27,"category_description":"","cat_name":"Self-Custody","category_nicename":"self-custody","category_parent":0}],"tag_info":false,"_links":{"self":[{"href":"https:\/\/neverlosebitcoin.com\/de\/wp-json\/wp\/v2\/posts\/2060","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/neverlosebitcoin.com\/de\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/neverlosebitcoin.com\/de\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/neverlosebitcoin.com\/de\/wp-json\/wp\/v2\/users\/5"}],"replies":[{"embeddable":true,"href":"https:\/\/neverlosebitcoin.com\/de\/wp-json\/wp\/v2\/comments?post=2060"}],"version-history":[{"count":1,"href":"https:\/\/neverlosebitcoin.com\/de\/wp-json\/wp\/v2\/posts\/2060\/revisions"}],"predecessor-version":[{"id":2062,"href":"https:\/\/neverlosebitcoin.com\/de\/wp-json\/wp\/v2\/posts\/2060\/revisions\/2062"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/neverlosebitcoin.com\/de\/wp-json\/wp\/v2\/media\/2061"}],"wp:attachment":[{"href":"https:\/\/neverlosebitcoin.com\/de\/wp-json\/wp\/v2\/media?parent=2060"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/neverlosebitcoin.com\/de\/wp-json\/wp\/v2\/categories?post=2060"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/neverlosebitcoin.com\/de\/wp-json\/wp\/v2\/tags?post=2060"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}