Bitcoin Security

Bitcoin Inheritance: Cold Storage Planning

An older hand passes one closed blank instruction envelope to a younger hand over walnut.

Bitcoin you keep in cold storage passes to your family only if they can find your keys and use them. That is the hard part of inheritance planning: the setup has to be secure enough that nobody can take your coins while you’re alive, yet simple enough that your least technical heir can recover them from written instructions. Several seeds, passphrases and hardware wallets may feel routine to you and still stop a family member who has never used bitcoin.

This guide turns that balance into an eight-step plan: take stock of your wallets, match the plan to your heirs, choose a custody model (for most families, a 2-of-3 multisig: a multisignature wallet in which any two of three keys can move the coins), write recovery instructions, keep the backups in separate places, tie it all to your will, test the recovery with your heir and review the plan every year. After the steps come five common mistakes that break a plan, and answers on collaborative custody, lost keys, borders and dead man’s switches.

Step-by-Step Guide

Step 1: Audit your current Bitcoin holdings and custody setup. Document every wallet you control — hardware wallets, multisig arrangements, Lightning channels, and any exchange accounts. For each wallet, record the type (singlesig, multisig, passphrase-protected), the approximate balance allocation, and the hardware devices involved. This inventory becomes the foundation of your inheritance plan and helps identify complexity that may need simplification.

Step 2: Assess your heirs’ technical capabilities. Have honest conversations with the people who would inherit your bitcoin. Gauge their comfort level with technology, cryptocurrency concepts, and security procedures. An heir who understands how to use a hardware wallet requires a very different plan than one who has never interacted with bitcoin. Your plan must match the least technical person who may need to execute it.

Step 3: Choose a custody model appropriate for inheritance. For most family situations, a 2-of-3 multisig arrangement provides the best balance of security and recoverable simplicity. Keep key 1 yourself, as your primary hardware wallet. Store key 2 where your executor or heir can reach it after your death, such as with a trusted relative (a bank safe deposit box may be sealed until probate, so don’t rely on one for this key). Give key 3 to a collaborative custody service like Unchained or Casa, or to a second trusted person. This ensures no single key loss prevents recovery, and no single person can spend on their own.

A 2-of-3 multisig plan with three keys in three places. Key 1 is your own hardware wallet, with you. Key 2 is with your executor or a trusted relative. Key 3 is with a collaborative custody service or a trusted person. Any one key alone can't spend. While you're alive, you sign with keys 1 and 2, or with keys 1 and 3, though a service signs only on request and after a wait of days. After your death, your heir gets key 2 and signs with keys 2 and 3. Whoever holds key 3 co-signs for your heir only after its own checks: Unchained asks for a death certificate, and Casa, for an heir you named in its app, first waits six months in which you can reject the request.
Two of three keys move the coins; no one key can. You spend with your own key plus key 2 or the service’s key, which signs only on request. After your death, the key your executor holds and the service’s key are enough.

Step 4: Create clear, written recovery instructions. Write two separate documents, assuming the reader has minimal Bitcoin knowledge. The letter of instructions holds no secrets: which hardware devices and what software to use as the coordinator (with download URLs and verification instructions), whom to call, how recovery works and how to reach any collaborative custody providers. The access sheet holds what unlocks things: where each seed backup and device is, their PINs, where any passphrase is, and where the wallet configuration file is. Use plain language and avoid jargon where possible.

Step 5: Store recovery materials with geographic separation. Distribute your seed phrase backups and key devices across three physical locations, one for each key (a custody service that holds key 3 counts as one). Common choices include home safes, bank safe deposit boxes, and trusted family members’ secure storage. No single location should contain enough information to steal the funds, but any two locations together should enable full recovery. Keep the letter with your will, your lawyer or your family, and seal the access sheet and store it in a different place, so nobody holds both documents and the seed backups at once. The wallet configuration file can’t spend, but it shows your whole balance, so store it like the seeds and never in the letter: keep a copy with each seed backup, because without it two keys can’t rebuild the wallet. If Unchained holds key 3, it keeps its own copy at all times and recommends that most clients leave the file with Unchained, but that copy helps only while Unchained exists; your own copy, stored offline and never in cloud storage, is what lets your heir recover without it.

Two ways to store recovery material, and what one bad event does to each. All in one safe: seed backups, wallet file, instructions and device PINs together. A fire there loses everything, with nothing left to recover; a burglar there gets every key, so the coins are stolen. Spread over three places, a home safe, a bank box and a family member's safe, each holding one key and a copy of the wallet file. A fire at one place leaves two, so the coins are still recoverable; a burglar at one place gets one key, which can't spend, so the coins stay safe.
One safe is one fire or one burglary away from losing everything. Spread the keys so that no single place can spend and any two can recover, with a copy of the wallet file next to each key.

Step 6: Integrate with your legal estate plan. Work with an estate attorney to reference your Bitcoin holdings in your will or trust without including sensitive security details. The legal documents should direct executors to specific locations where the detailed recovery instructions are stored. Consider whether a trust structure offers advantages for your tax situation and jurisdiction.

A chain of three documents. Your will, which can become public, says only that you hold bitcoin and where the recovery instructions are. The recovery instructions, kept private in a secure place, say which devices and app to use, where each backup is and how to reach the custody service. They lead to the keys and backups: seed backups, hardware wallets and the wallet file. Seed words, private keys, PINs and passphrases never go in the will, because in many places a will becomes public during probate.
The will points to the instructions; it never holds the secrets. A will can become public during probate, so it says only that the bitcoin exists and where the recovery instructions are kept.

Step 7: Conduct a supervised test recovery with your heir. The most critical step is walking your intended heir through the recovery process while you are still available to guide them. Have them use the written instructions to move the coins out of a test multisig holding a small amount of bitcoin, collecting its keys and signing the transaction themselves. A watch-only import of your real wallet can’t sign, so it checks only that the wallet configuration file rebuilds the right addresses and balance. Document any confusion or gaps in the instructions and update them accordingly. Repeat this test annually or after any significant changes to your custody setup.

Step 8: Establish a regular review schedule. Set a yearly calendar reminder to review and update your inheritance plan. Hardware wallets may need firmware updates, collaborative custody providers may change their processes, and your family situation may evolve. An outdated inheritance plan can be as dangerous as having no plan at all.

Common Mistakes to Avoid

1. Over-engineering the custody setup. Complex arrangements with multiple passphrases, Shamir secret sharing, and obscure hardware devices may maximize security during your lifetime, but they dramatically increase the chance your heirs will fail to recover the funds. If your heir cannot execute the recovery process independently using written instructions, your setup is too complex for inheritance purposes.

Two recovery paths side by side. A plan your heir can follow has four steps: read the instructions, collect the keys and the wallet file, load them in the wallet app, move the coins. An over-engineered plan has the same four plus four more, drawn dashed, after collecting the keys: rebuild a seed from Shamir shares, find passphrase 1, find passphrase 2 and get an obscure device working. The recovery stops at the first step your heir can't do. If your heir can't follow it alone from your written instructions, it's too complex.
Every extra layer is one more step your heir must get right alone. Passphrases, Shamir shares and unusual devices can add security while you’re alive, but each one is a new place where the recovery can stop.

2. Storing all recovery information in one location. Keeping seeds, instructions, and device PINs together in a single safe creates a single point of failure — both for theft and for loss. A house fire, burglary, or natural disaster could destroy everything needed for recovery. Geographic distribution is essential.

3. Failing to update the plan after life changes. Marriage, divorce, births, deaths, and changes in your custody setup all require updates to your inheritance plan. Outdated instructions that reference old hardware devices, expired collaborative custody accounts, or former trusted parties can render your inheritance plan useless.

4. Not testing the recovery process. Many inheritance plans fail because they were never tested. Theoretical plans that seem clear when written often contain ambiguities, missing steps, or assumptions about technical knowledge that heirs do not possess. A supervised test recovery reveals these gaps while they can still be fixed.

5. Including sensitive details in legal documents. Seed phrases, private keys, or detailed security information should never appear in wills or trust documents, which may become public record during probate. Legal documents should reference the existence of digital assets and point to secure locations where recovery materials are stored — nothing more.

Frequently Asked Questions

Should I use a collaborative custody service for my Bitcoin inheritance plan?

Collaborative custody services like Unchained Capital and Casa offer managed multisig solutions where they hold one key in your multisig quorum. For inheritance purposes, these services provide significant advantages: they offer institutional-grade key storage, documented recovery procedures, and professional support for heirs who need help accessing funds. The trade-off is introducing a third-party dependency — if the service ceases operations, your heirs must rely on the remaining keys. In a 2-of-3 setup, this risk is manageable only if your heir can reach the two other keys and a copy of the wallet configuration file kept outside the service, because two keys alone can’t rebuild the wallet. For significant holdings, collaborative custody often represents the best balance of security and heir accessibility.

What if my heir loses one of the keys before I pass away?

In a well-designed multisig inheritance plan, losing one key is an inconvenience, not a catastrophe. If you are using a 2-of-3 multisig, any two remaining keys can sweep the funds to a new wallet. The priority is replacing the lost key promptly: generate a new seed on a new hardware device, create a new multisig wallet with the updated key set, and transfer all funds to the new wallet. Then update all stored instructions and backups to reflect the new configuration. Delaying this process risks a situation where a second key is lost or compromised while you still have only two functioning keys.

Replacing a lost key in four steps. 1: key 1 of the old 2-of-3 wallet is lost, but keys 2 and 3 still work. 2: make a new key 1 from a new seed on a new hardware device and build a new 2-of-3 wallet from it and the old keys 2 and 3. 3: keys 2 and 3 sign one transaction that moves every coin from the old wallet to the new one, so the lost key no longer controls anything. 4: update the backups, the wallet file and the instructions. Until the coins move there is no spare key: lose one more and they're locked for good.
Losing one key of a 2-of-3 is fixable, if you act promptly. The two remaining keys move everything to a new wallet that leaves the lost key out. Until then, one more lost key would lock the coins for good.

How do I handle Bitcoin inheritance across international borders?

Cross-border inheritance introduces legal complexity around taxation, reporting requirements, and recognition of foreign estate documents. The technical aspects of Bitcoin inheritance remain the same regardless of jurisdiction, but you should consult estate attorneys in both your country of residence and your heirs’ country. Some jurisdictions treat cryptocurrency as property, others as currency, and the tax implications vary significantly. Distribute physical key backups across jurisdictions only if you are confident they can be legally accessed by your heirs, and consider that bank safe deposit boxes in some countries are sealed upon the account holder’s death pending probate.

Is a dead man’s switch a good approach to Bitcoin inheritance?

Dead man’s switches — automated systems that release information if you fail to check in periodically — are appealing in theory but risky in practice. If you become incapacitated without dying (long hospital stay, travel to areas without connectivity), the switch could trigger prematurely, exposing sensitive recovery information. Technical failures in the switch mechanism could either trigger false releases or fail to trigger when needed. Bitcoin also offers an on-chain version, a timelock: a wallet such as Liana adds a recovery key that can spend only after a delay you set, with no company involved, but you must restart the clock by moving your coins to yourself before the delay runs out (our dead man’s switch guide compares the options). For most people, a well-documented multisig setup with trusted key holders and clear written instructions provides more reliable inheritance transfer than an off-chain switch.

Related Resources

Part of our free Bitcoin course: This topic is covered in Bitcoin Inheritance Planning: Protecting Your Legacy, from the Advanced Bitcoin Security & Privacy course.
Filed under: Bitcoin Security
← Back to All Articles