Multisig Inheritance Planning Guide

The Problem Multisig Solves for Inheritance

Bitcoin’s greatest strength — no intermediary can seize or freeze your funds — becomes its greatest weakness when you die. A bank can release funds to heirs with a death certificate. Bitcoin does not care about death certificates. If your heirs do not have the private keys and the knowledge to use them, your bitcoin is lost permanently.

Multisig addresses this by distributing keys across people and locations. A well-designed 2-of-3 or 3-of-5 setup ensures that your heirs can access funds even if you are unable to hand over keys personally, while preventing any single person from accessing the bitcoin prematurely. This guide covers the strategies, tools, and practical steps for making your bitcoin inheritable.

Why Standard Single-Sig Fails for Inheritance

With a standard single-signature wallet, you face an impossible dilemma:

Share your seed phrase with an heir — They can access your bitcoin at any time, including while you are alive. You are trusting them completely.
Lock your seed phrase in a safe with a letter — Your heirs must find it, understand what it is, and know how to use it. Non-technical heirs may fail at multiple points, and anyone who opens the safe first gets everything at once.
Tell no one — Your bitcoin dies with you.

A multisig configuration breaks this deadlock. You can distribute keys so that your heirs need cooperation from a trusted party — an attorney, a custody service, or another family member — preventing unilateral access while ensuring recovery is possible.

Two tests every inheritance plan must pass: is the bitcoin safe while you're alive, and can your heir recover it after you die? With one key, every option fails one test. Give your heir the seed words: your heir can take it at any time. Lock the seed in a safe with a letter: anyone who opens the safe can take everything, and your heirs recover it only if they find it and know how. Tell no one: nobody can take it, but it dies with you. A 2-of-3 multisig with keys in three hands passes both: no one key can spend, and your heir plus a trusted co-signer can. — **With one key, every way of passing it on fails one of two tests.** Either someone can take the bitcoin too early, or nobody can reach it later. Multisig splits the power to spend, so your heir needs a trusted co-signer.

Inheritance-Optimized Key Distribution

The 2-of-3 Inheritance Model

Key	Holder	Purpose
Key 1	You (hardware wallet at home)	Daily access
Key 2	Heir (sealed package)	Post-death recovery
Key 3	Attorney or custody service	Co-signer / verification

Under normal conditions, you spend using Key 1 plus Key 3 (or Key 1 plus Key 2 if Key 3 is unavailable). Casa’s key is the exception: Casa says it is never used in routine transactions, only for emergency recovery. Unchained’s key can co-sign a payment you start on its website, after you record a short verification video. After your death, your heir uses Key 2 plus Key 3 to access the funds. The attorney or custody service co-signs only after checking that you have died or can no longer act (Casa, for example, runs a six-month inactivity check).

A 2-of-3 inheritance multisig. Key 1 is yours, a hardware wallet at home. Key 2 is with your heir in a sealed package. Key 3 is held by an attorney or a custody service. Any one key alone can't spend. While you're alive you spend with keys 1 and 3, or 1 and 2 if key 3 is out of reach: you hold only one key, so every spend needs a second keyholder. After your death your heir spends with keys 2 and 3 and the wallet descriptor, but key 3 signs only after checking that you have died or can't act; Casa, for example, runs a six-month inactivity check. — **In a 2-of-3, no key spends alone, and key 3 is the gatekeeper.** While you’re alive you sign with your key and one other. After your death your heir’s key is meant to pair with key 3, whose holder signs once it has checked that you can no longer act. Your own key, if your heir can reach it, also works with theirs.

The 3-of-5 Model for Larger Estates

Key	Holder	Purpose
Key 1	You (primary device)	Active management
Key 2	You (backup in bank vault)	Redundancy
Key 3	Spouse/partner	Shared access / inheritance
Key 4	Attorney	Fiduciary co-signer
Key 5	Custody service (Casa)	Emergency recovery

A 3-of-5 setup provides greater flexibility for complex family situations or larger holdings. Multiple combinations of signers can authorize transactions, reducing the chance of permanent loss from any two keys being unavailable.

A 3-of-5 inheritance multisig, where any three of five keys can spend. Keys 1 and 2 are yours: your primary device and a backup in a bank vault. Key 3 is your spouse's or partner's, key 4 your attorney's and key 5 a custody service's. Any two keys can't spend, not even your own two. While you're alive you spend with your two keys and any one of keys 3, 4 or 5. After your death your spouse, attorney and custody service can spend with keys 3, 4 and 5 and the wallet descriptor, even if both of your keys are lost. A 2-of-3 still works with one key missing; a 3-of-5 still works with two missing. — **A 3-of-5 still works with two keys missing.** After your death, both of your keys may be out of reach. The other three are exactly enough, and no two keys can spend, not even your own two.

Casa Premium is a 3-of-5 vault in which Casa holds one key and you hold the other four. Casa’s support guide says a Premium recipient, such as your spouse or a trustee, gets your mobile key, one hardware key with its PIN (handed over at setup) and Casa’s recovery key, and can’t use them until a claim succeeds. For a spouse and an attorney who hold keys while you are alive, as in the table above, ask Casa Support before you plan that layout.

Dead Man’s Switch Options

A dead man’s switch is a mechanism that triggers action if you stop responding. For bitcoin inheritance, this means initiating the key transfer process automatically when you can no longer do it yourself.

Email-Based Dead Man’s Switch

Services like Google’s Inactive Account Manager send a message you wrote in advance to people you choose once your account has been inactive for a period you set. You configure:

An inactivity period (e.g., 90 days without a check-in).
The recipient (your heir).
The message: your letter of instructions, which holds no secrets (what exists, whom to call, how recovery works and who holds the sealed access sheet, both described below). Leave out its approximate value: an email can be read by more people than you intend.

The email never carries seed words, PINs, the passphrase or where your keys and backups are. Those belong on the sealed access sheet, kept apart from the letter. Anyone who breaks into the email account, or reads the message because the switch fired while you were travelling, learns that you hold bitcoin and whom to call, and nothing that unlocks it.

Collaborative Custody Dead Man’s Switch

Casa includes an inheritance protocol in every plan. You add a recipient and share keys with them: one of yours plus Casa’s recovery key on a 3-key vault, or your mobile key, a hardware key and Casa’s recovery key on a 5-key vault. The shared keys stay dormant until the protocol activates. After your death, the recipient files a claim in the Casa app, and Casa runs a six-month inactivity check to confirm you are unavailable before the recipient can move the coins. If someone files a claim while you are alive, that window gives you time to cancel it. Casa holds only one key in a 2-of-3 or 3-of-5 setup, so it never controls the coins on its own.

Two timelines that start when your recipient files an inheritance claim in the Casa app. If you have died, nobody cancels: Casa runs a six-month inactivity check, and after six months the shared keys are released and your recipient can move the coins. If you're still alive, a false or early claim, you cancel it during the six months and the shared keys stay dormant. Casa holds one key, so it never controls the coins on its own. — **At Casa, a claim waits six months, and you can cancel it.** The recipient’s shared keys stay dormant until a claim succeeds. The six-month inactivity check confirms you are unavailable, and gives you time to stop a claim filed while you are alive.

Manual Dead Man’s Switch (Low-Tech)

For those who prefer no third-party services:

Write the two documents described below: a letter of instructions with no secrets, and an access sheet that says where each key and backup is.
Give the letter to your heir. Seal the access sheet and leave it with your attorney or in a safe-deposit box, apart from the letter and from the keys, with instructions to release it only after your death.
Each year, check in with your heir and attorney to confirm you are alive and the plan is current.
If they do not hear from you for a set period, your heir follows the letter, which tells them who holds the access sheet.

Writing the Letter and the Access Sheet

The paperwork is the most important part of your inheritance plan. A technically perfect multisig setup is worthless if your heirs cannot understand or execute the recovery steps. Write for an heir with zero bitcoin knowledge, and split the paperwork into two documents, as the Bitcoin Inheritance Planning lesson teaches: a letter of instructions that explains and holds no secrets, and a sealed access sheet kept somewhere else. Never write seed words in either one.

What the Letter Should Include

An explanation of what bitcoin is — One paragraph. They do not need a deep understanding, just enough to know this is real money and worth recovering.
The approximate value — Give them motivation to follow through. “As of [date], this wallet holds approximately $X worth of bitcoin.” Update this annually, and leave this line out of any copy you load into an email dead man’s switch.
Who holds the access sheet — For example: “[Attorney’s name and firm] holds a sealed envelope marked ‘access sheet’.” The letter never says where your keys, seed backups or devices are; that is what the access sheet is for.
The wallet configuration file — Say that a copy of the wallet configuration file (the descriptor) is stored with each key, and that this file, together with any two of the three keys, is needed to rebuild the wallet. Don’t attach it to the letter: it can’t spend, but it shows your whole balance and history to anyone who reads it.
Step-by-step recovery instructions — Written for a non-technical person:
- Download Sparrow Wallet from sparrowwallet.com and check the download before installing it (how to verify Bitcoin software).
- Load the wallet configuration file into Sparrow.
- Connect two of the three hardware wallets, unlocking each with the PIN from the access sheet. If the access sheet says a key uses a passphrase, get it from where the sheet says it is kept and enter it exactly as written: a wrong or missing passphrase gives a different key, which can’t sign for this wallet. If a device is lost or broken, restore its seed backup onto a new hardware wallet bought from the maker’s own shop, then enter that key’s passphrase too, if it has one. The recovery words never go into the computer or a phone.
- Move the bitcoin to wallets of your own, or sell through a reputable exchange. Before you confirm, check on each device’s own screen that the address you are sending to matches the one your new wallet shows.
Contact information for your custody service — If using Casa, Unchained, or an attorney, give their names, your account details and their recovery procedure.
A trusted technical contact — Name a bitcoin-savvy friend or advisor your heirs can call for help. Pay this person a retainer or include them in the inheritance plan.
A scam warning — “No genuine person or company will ever ask for the recovery words. Never type them into a website or app someone sent you a link to, and be wary of anyone offering to recover bitcoin for a fee or a share.”

What the Access Sheet Should Include

Where each key is: each hardware wallet and each seed backup.
The PIN of each device (never stored with the device itself).
Whether a passphrase is used, and where it is kept (never with the seed).
Where each copy of the wallet configuration file is.

The letter can sit with your will, your attorney or your family. Seal the access sheet and store it somewhere else, for example with your attorney or in a safe-deposit box, so that nobody holds the letter, the access sheet and the keys at once. If your attorney also holds one of the keys, keep the access sheet in the safe-deposit box instead, so the person with one key doesn’t also hold the map to the others. Before you rely on a safe-deposit box, check who is authorised to open it after your death: a bank can freeze access to a box until the estate is settled, which may take weeks or months. Someone who reads only the letter learns that you hold bitcoin, roughly how much, and whom to call, but can’t reach it. The seed phrase security guide covers physical storage of the backups themselves.

Where each piece of a 2-of-3 inheritance plan goes when an attorney holds key 3. You keep key 1, a hardware wallet, and a copy of the wallet descriptor. Your heir keeps the letter of instructions, key 2 in a sealed package and a descriptor copy. Your attorney keeps key 3 in a sealed bag and a descriptor copy, but not the access sheet, because the attorney already holds a key. The sealed access sheet goes in a safe-deposit box instead; check who can open the box after your death, because a bank can freeze it until the estate is settled. The access sheet never sits with a key, because it's the map to all of them; the letter, with no secrets, tells your heir who holds the access sheet. — **Nobody holds a key together with the map to the others.** A copy of the wallet descriptor goes with every key. The sealed access sheet, which says where each key, backup and PIN is, stays apart from all of them.

Time-Locked Transactions

Bitcoin supports time-locked transactions at the protocol level. These transactions are valid but cannot be included in a block until a specified time or block height. For inheritance, time-locked transactions offer a programmatic dead man’s switch.

How Time-Locked Inheritance Works

Create a transaction that sends your bitcoin from your current wallet to your heir’s address.
Set the nLockTime to a date 12 months in the future, and check that at least one input has a sequence number below 0xffffffff. If every input uses that maximum, the lock is ignored and your heir could broadcast the transaction at once.
Sign the transaction and give the signed (but unbroadcast) transaction to your heir.
Every 6 months, well before that date, move your bitcoin to a new address, which invalidates the old time-locked transaction.
Create a new time-locked transaction that spends the coins from the new address, again dated 12 months ahead, and give it to your heir.

If you stop refreshing the time-locked transaction (because you are incapacitated or dead), your heir can broadcast the last valid transaction after the lock time passes. If you are alive and active, the transaction is always invalid because the UTXO it references has already been spent.

Two timelines for a pre-signed transaction that pays your coins to your heir and can't be mined before its date. You sign transaction 1, valid from month 12, and give it to your heir. If you refresh every 6 months: at month 6 you move the coins from address A to address B, so transaction 1 spends a coin that is already spent and is invalid for good, and you sign transaction 2, valid from month 18; at month 12 you move them to address C, which kills transaction 2, and you sign transaction 3, valid from month 24. Each transaction dies six months before its date. If you stop refreshing: the coins stay at address A, and at month 12 transaction 1 becomes valid and your heir can broadcast it and take the coins, whether you're alive or not. Its fee was fixed when you signed it. — **A pre-signed transaction is a dead man’s switch you must keep resetting.** Moving your coins before the date kills the old transaction. Miss a refresh and, once the date passes, your heir can broadcast it even while you’re alive.

Limitations of Time-Locked Transactions

Maintenance burden — You must refresh the transaction every cycle. Missing a refresh means your heir could access funds early.
Every refresh is a full signing session — From a multisig wallet, the pre-signed transaction needs the full number of signatures when you create it, so each refresh means gathering your signing devices.
Fee uncertainty — The fee rate is fixed when you sign the transaction. If fees increase dramatically by the time the heir broadcasts, the transaction may take a long time to confirm or fail to propagate.

Time-locked transactions work best as a complementary mechanism alongside a multisig inheritance plan, not as the sole strategy. Wallets such as Liana and Nunchuk’s on-chain option build the delay into the wallet’s own spending rules instead, so there is no pre-signed transaction to hand over; you still have to act before the delay runs out (in Liana, by moving each coin to yourself; in Nunchuk’s option, by moving the coins to a new wallet), and your heir needs the wallet descriptor as well as the recovery key. The inheritance planning lesson explains how these timelock wallets work.

Inheritance Services

Casa

Casa’s inheritance protocol integrates with their collaborative custody model. In a 2-of-3 or 3-of-5 setup, Casa holds one key. You invite a recipient by email and share keys with them that stay dormant until the protocol activates: one of your keys on a 3-key vault, or two on a 5-key vault, plus Casa’s recovery key either way. The recipient files a claim in the Casa app, and Casa runs a six-month inactivity check, during which you can cancel the claim if you are alive, before the recipient can move the coins. The process is designed so that Casa alone never controls the funds.

Cost: inheritance is included in every Casa plan, starting with Standard at $250 a year (Casa’s site, checked November 2026). The Multisig in Practice lesson compares Casa, Unchained and Nunchuk, and what each needs you to save.

Unchained

Unchained offers inheritance setup in its Signature plan and a separate programme. Its inheritance page describes an Inheritance Protocol (documents with step-by-step guidance that let your executor recover the bitcoin without prior technical knowledge), transfer-on-death beneficiary designations and trust vaults. You hold two of the three keys and Unchained holds the third, so it co-signs during recovery but can’t move the coins alone.

Attorney-Based Approach

An estate attorney can hold one key of your multisig as a sealed package kept in the attorney’s safe: a seed backup on paper or metal, or a hardware wallet, in a tamper-evident bag. In a 2-of-3, that key alone can’t move anything. The key never goes into your will or trust documents: in many places a will becomes public during probate. Your will can say that you hold bitcoin and that a letter of instructions exists, and nothing more. Benefits include established fiduciary obligations. Risks include the attorney not understanding bitcoin technology, losing the package, or mishandling it during probate.

Label the bag with the attorney’s role in the multisig setup (“Key 3 of a 2-of-3; release to [heir] only on my death”), never with the words themselves, and include a copy of the wallet configuration file in it, as you do with every key.

Testing Your Inheritance Plan

An untested inheritance plan is not a plan — it is a hope. Test it while you are alive.

Create a test multisig wallet with a small amount of bitcoin (50,000–100,000 sats).
Give your heir the letter and a practice access sheet for the test wallet without any additional guidance.
Ask them to recover the funds using only the written instructions and the designated keys.
Observe where they struggle and rewrite those sections of the letter.
Repeat until they can do it independently.

This rehearsal reveals gaps that are invisible on paper: software installation issues, firmware update prompts on hardware wallets, seed phrase entry confusion, and address verification hesitation. Fix these gaps before they matter.

Ongoing Maintenance

Your inheritance plan requires periodic maintenance:

Annual review — Verify that keys are still in their designated locations, hardware wallets still function, and backup materials are intact.
Software updates — Ensure the coordinator software (Sparrow, Nunchuk) is still available and compatible. Consider keeping an offline installer as backup.
Life changes — Marriage, divorce, birth of children, and death of designated key holders all require updating the plan.
Update the letter and the access sheet — Approximate portfolio value, wallet software instructions, contact information for trusted advisors, and where each key and PIN is all change over time.
Firmware updates on hardware wallets — Update annually to maintain security. Check firmware update best practices before applying.

Part of our free Bitcoin course: This topic is covered in depth in Bitcoin Inheritance Planning from the Advanced Bitcoin Security & Privacy course.

Frequently Asked Questions

Can I just include my seed phrase in my will?

No. In many places a will becomes public during probate: in England and Wales, for example, anyone can order a copy once probate is granted, and most US states treat probate files as public records. A seed phrase in a will is exposed to court officials, attorneys and potentially the public. Your will can say that you hold bitcoin and that a letter of instructions exists; keep seed words, passphrases, PINs and the locations of keys and backups out of it. Those go on a sealed access sheet kept somewhere else, as the inheritance planning lesson explains.

What if my heir loses their key before I die?

In a 2-of-3 setup, the two remaining keys (yours and the one held by your attorney or custody service) can still sign. Create a new multisig wallet with a replacement key, move the funds from the old wallet to the new one, and give your heir the new key; the lost key then controls nothing. Update the descriptor copies and the access sheet to match. This is exactly why multisig is better than single-sig for inheritance — you have redundancy.

Should I tell my heirs about the bitcoin while I am alive?

At minimum, one trusted person should know that the bitcoin exists and that an inheritance plan is in place. They do not need to know the exact amount or hold any keys. They just need to know that a letter of instructions exists and where to find it. Discovering bitcoin wealth for the first time during grief makes the recovery process much harder.

How do collaborative custody services handle company failure?

Both Casa and Unchained design their systems so that your own keys can move the coins without them, as long as you have saved what recovery needs. At Unchained you hold two of three keys, enough to spend together with the wallet configuration file. At Casa you hold two of three (Standard) or four of five (Premium), and Casa’s Sovereign Recovery guide shows how to move your coins with the wallet descriptor in open-source wallets such as Sparrow or Electrum. Save an up-to-date copy of the descriptor (and, for Casa, the Sovereign Recovery email) while the company is running: without the descriptor your keys can’t rebuild the wallet, though at Casa the email can stand in for it. On Casa Standard’s default layout one of your two keys lives in the Casa app on your phone, so you also need that phone and your Casa password, which exporting the key asks for; keep the app’s Clear Cache on Logout setting off so it still opens offline. The Multisig in Practice lesson lists what each service needs you to keep.

Is there a minimum amount of bitcoin where multisig inheritance makes sense?

There is no strict minimum, but the setup cost (hardware wallets, potential custody subscriptions, attorney fees) typically makes sense for holdings above $50,000–$100,000 in bitcoin. Below that, a well-documented single-sig setup with a properly secured seed phrase, a letter of instructions and a sealed access sheet may be sufficient.

Filed under: Bitcoin Security