Luke Childs’ Anzen: The Bitcoin Vault That Solves the Self-Custody Trilemma

A firmware bug in a popular hardware wallet drained over $130 million from singlesig bitcoin wallets this year. The random number generator was predictable, so attackers could recreate seeds without ever touching a device.

Developer Luke Childs watched it happen and asked the question everyone was avoiding: why does one bug in one device get to cost people their life savings? His answer is a new wallet design called Anzen, and it might be the most interesting thing to happen to bitcoin self-custody in years.

The self-custody trilemma

Childs frames the problem as a trilemma. Every self-custody option today gives you two of three things: secure, trustless, easy to use. Nobody gives you all three.

Singlesig (one hardware wallet, or a hot wallet) is trustless and easy. One device, tap to spend. But it is a massive single point of failure. One bug, one theft, one bad backup, and everything is gone. Almost every Coldcard victim was sitting on this corner of the triangle.

Multivendor multisig (say, 2-of-3 across three different hardware wallets) is secure and trustless. It is also miserable to actually use. Multiple devices, multiple seed backups, multiple secure locations, multiple PINs to never forget. Recommend this to normal people and you will lose more money to user error and lockouts than to hackers.

Collaborative custody (Casa, Bitkey) is secure and easy. Casa made multisig something normal people can use. Bitkey went further: no seed phrase, phone-only spending up to a limit. The catch is the trust model. The provider holds a cosigning key and controls the app update channel for the phone app that holds one of yours. One malicious update and they hold two of three keys. Reputable companies, sure. But as Childs puts it, their employees are not going to prison to protect your stack in a 6102-style seizure scenario, and you should not expect them to.

Anzen: a vault, not a wallet

Anzen is Childs’ attempt to get all three: secure, trustless, and easy. It is a vault-like design built from two keys, your phone and a hardware wallet, using presigned timelocked transactions. No third party. No servers. No soft fork. It works on bitcoin today, enforced by consensus rules.

The vault script is simple:

• Phone + hardware wallet: spend immediately
• Phone alone: spend after 14 months
• Hardware wallet alone: spend after 15 months

On top of that, Anzen supports monthly allowances: a fixed amount your phone can pull from cold storage into its hot wallet each month, all on its own. Think of it as an automatic transfer from savings to checking on the 1st of every month.

Then there is emergency access: a larger predetermined withdrawal your phone can trigger any time, which unlocks after a one-week delay and can be cancelled during that week. A thief who steals your phone and triggers it just starts a one-week alarm clock you can shut off.

Every pre-authorized allowance can also be revoked instantly by returning the funds to cold storage.

The routine is what makes it usable: once a year, you re-approve the vault policy on your hardware wallet. One button press presigns the entire year’s transactions. The phone runs the vault for the other 364 days. Your hardware wallet goes back in the drawer.

Why this matters for being your own bank

This is exactly the thesis this site is built on: time delay is the feature that makes self-custody safe for normal people. A timelock turns panic into patience. It protects against theft, coercion, phishing pressure, and even death, all with one mechanism.

Anzen takes that idea further than anything shipping today. It has the security bar of a 2-of-3 multisig (an attacker must compromise both of two fully independent keys on fully independent devices), it survives the loss of either single key, and it asks less of you day to day than a singlesig hardware wallet, which needs the device in your hand for every spend.

Honest caveats

Anzen is early. There is a working prototype running on mainnet with real funds, it is open source and MIT licensed, and the repo is public. But it is a CLI, not a product. Childs is clear that it is not production ready.

The bigger gap is hardware. No hardware wallet today properly supports this class of design, because they are all built around one primitive: sign this transaction. Anzen needs a different primitive: approve this policy. Your phone drafts the plan, the hardware wallet shows you the whole thing in plain language, one button approves the year. Until hardware vendors build that screen, Anzen stays a prototype with a great idea.

Still, the idea is the point. Whether it ships as Anzen, or as a sovereign mode inside Bitkey, or as a Ledger plus phone combo, the direction is clear: vaults with time delays are the future of self-custody. The industry just got a $130 million lesson in why singlesig is not enough.

Read Childs’ full writeup here: Solving Bitcoin’s Self-Custody Trilemma. The code is on GitHub: github.com/lukechilds/anzen.

Find your setup

Anzen is the future. For today, a well-built multisig is the best defense most bitcoiners can actually deploy. Answer a few questions and get your recommended setup in 2 minutes: neverlosebitcoin.com/wizard/.