Crypto Inheritance: Who Can Actually Recover Your Coins

A backup and an inheritance look identical on paper: a few dozen words, written down, stored somewhere else. They answer different questions. A backup answers "my phone fell in a river." An inheritance answers "I did." The first needs redundancy of one secret; the second needs a threshold among several people, plus somebody who knows the thing exists at all. Most self-custody advice collapses the two, which is why carefully backed-up wallets become permanently unreachable on the day their owner stops being available. The difference is measurable in the words themselves. We ran 20,000 trials at each BIP-39 length: replace one word at random in a 12-word mnemonic and 6.07% of the results (1,213 of 20,000) still pass the checksum; at 24 words the rate falls to 0.33% (66 of 20,000). Every one of those restores opens a valid wallet with a zero balance. For you that is a five-minute annoyance. For an heir who has never restored a wallet, it is proof that the money is gone and that they did something wrong.

Inheritance needs four things a backup does not. Discovery: someone other than you must know an asset exists and where its instructions are. Authority: the plan has to name who may act, in a form a bank, a lawyer or a court will accept. Threshold: no single holder, and no single compromise, may be enough to move the funds. Clock: it has to work when nobody is in a hurry, because probate takes months and an heir may not start for a year. A second copy of the same seed in a second location satisfies redundancy and nothing else. It is still one person away from total loss, and if nobody knows where it is, it is one search away from zero.

Start with the arithmetic, because it decides how the plan fails. A BIP-39 mnemonic is 11 bits per word: 12 words carry 132 bits, of which 128 are entropy and 4 are a SHA-256 checksum; 24 words carry 264, split 256 and 8. That is a deliberately weak detector. Our substitution runs put numbers on it: 6.07% of one-word errors survive at 12 words, 0.33% at 24. SLIP-39 spends its bits differently. It uses a 1,024-word list, so 10 bits per word, and every share carries a 30-bit Reed-Solomon checksum (RS1024) over the rest of the share. The specification guarantees detection of any error touching up to three words. We checked that claim against the 45 official test vectors: 89 shares, 87 pass, and the two failures are precisely the vectors labelled "invalid checksum" - the detector doing its job. Then we mutated shares at random: 445 of 445 single-word substitutions were caught, 445 of 445 two-word, 445 of 445 three-word, and 783 of 783 adjacent transpositions (five adjacent pairs in the vectors were the same word twice, so there was nothing to catch). A 128-bit share is 20 words; a 256-bit share is 33. The first two words encode a 15-bit identifier plus the iteration exponent, which is how a combining tool knows the shares belong to one backup before it tries to use them.

The simplest plan is one seed, two locations, and a letter. It costs nothing, works on every chain, and is wrong for inheritance in one specific way: the threshold is one. Anyone who finds either copy - a burglar, a curious relative, a cloud backup, a screenshot in a chat thread - owns the funds outright and forever, and no second signature is required. The same property that makes it robust against your own death makes it fragile against everyone else's curiosity. If the second location is a bank box, ask the bank in writing who may open it after your death and what document they require. If it is a law firm, ask what happens if the firm dissolves. And do not put the seed in a will: a will is filed and often becomes a public record, and it is read by people whose job is to distribute property, not to keep secrets. Put the location in the will if you must; put the words where the will points.

For Bitcoin the threshold can be enforced by the chain. A 2-of-3 multisig wallet holds three keys - yours, your heir's, and one held by a neutral party such as a lawyer or a second heir - and any two can spend. Two, not three: a 3-of-3 plan dies with the first lost key, which is the exact failure you were insuring against, and a 1-of-3 plan is a backup with extra steps. Schnorr aggregation does not solve this: BIP-327 states in one line that MuSig2 is an n-of-n scheme and not a t-of-n threshold scheme, so an aggregated key still needs every signer. The cost objection does not survive measurement. A 2-of-3 P2WSH input is 41 bytes of non-witness data plus a 254-byte witness - 418 weight units, 104.5 vB - against 68 vB for a single-signature P2WPKH input. At the mempool we measured at 14:04 UTC today (45,462 transactions, 11.16 MvB, every recommended tier at 1 sat/vB) that difference is about 36 satoshi, three cents at $78,307 per bitcoin; a full one-input, two-output spend is roughly 177 vB, or $0.14. What a threshold plan actually costs is coordination: three people who each know what they hold, and a written procedure for the day two of them have to act.

Bitcoin also offers the only mechanism where the heir needs nobody: an absolute time lock. BIP-65 makes an output unspendable until a block height or a UNIX time is reached, after which a branch of the script becomes valid. At 10-minute blocks one year is 52,560 blocks; with today's tip at 974,532, a one-year branch would sit at height 1,027,092. The trap is that the branch never expires. Once the height passes, the heir's key is live permanently, while you are still alive and still using the wallet. A dead-man switch built this way therefore has a maintenance cost: the coins must be moved to a fresh output with a fresh deadline before each one lapses, and every one of those moves is an on-chain transaction that links the old and new outputs. The fee is a few cents; the discipline is annual and unforgiving. (how Monero fees work)

Monero removes this whole layer. There is no scripting language, so no branch can say "after height H, this other key may spend". The transaction-level unlock_time only delays when your own outputs become spendable; it grants nobody anything. Monero multisig wallets do exist in M-of-N form, but signing is an interactive, round-based protocol between the participating wallets, and the project's own December 2021 advisory - still online - warned that the multisig creation and signing code could let one signing party take the funds. Bugs get fixed; the point is that this is a path to rehearse with an amount you can afford to lose, not one to discover at the worst moment. For most people the practical Monero inheritance primitive is SLIP-39 over the 32-byte seed. A standard Monero seed is 25 words from a 1,626-word list, the last word being a checksum; SLIP-39 does not split that string, it splits the 32 bytes behind it and returns 20-word shares. A 2-of-3 plan means your heir types 40 words, not 25, into a SLIP-39 tool and then rebuilds a Monero wallet from the recovered secret - a different menu in every wallet from "restore from mnemonic". We measured what one share is worth: in a 2-of-3 split, a single share is consistent with all 256 possible values of each secret byte, so it reveals zero bits. That is the property you want against a thief, and it is also why one share at the lawyer and one in a drawer is not a plan.

The failure that actually happens is discovery, and it is not cryptographic. Write one page that names the wallet type and version, the number of shares, the threshold, who holds what, where, and which tool restores it. Never put words on that page. Then rehearse: create an empty wallet, split its seed, destroy the original, and have your heir restore it while you watch and say nothing. If they cannot, the plan is a hypothesis. The last step is the exit. Today's quotes: 10 XMR to USDT-TRC20 returned 6,345.93 (634.59 per XMR against a $641.20 spot), 1 XMR returned 634.289, and 0.1 XMR returned 63.125 - 631.25 per XMR, because the fixed charge bites hardest at the small end. Whichever number applies, the refund address on that order must be a wallet the heir controls, on the same network, because a failed swap returns funds only to the refund address and only in the original asset. Every figure here is a 4 November 2026 snapshot; the live quote governs. (recovering misdirected funds)

Four things to take away. A backup protects against losing a device; an inheritance protects against losing a person, and the second needs a threshold, not a second copy. A checksum is not a detail when the person restoring is not you: 6.07% of single-word errors pass at 12 words, 0.33% at 24, and SLIP-39 caught every one of 445 substitutions and 783 transpositions we threw at it. Bitcoin can enforce a threshold, and even a deadline, on-chain for about fourteen cents; Monero cannot, so its plan lives in how the seed is split. And the only test that counts is the one where somebody else does the restore without you in the room.