Self-Custody Backups: Seed, Metal, or Shamir?

A seed phrase is usually called a backup of your wallet. It is not. It is 128 or 256 bits written in an alphabet you can copy by hand, and every key and address you own is arithmetic on those bits that any compatible device can repeat. People guard the words as a secret, which they are, and forget they are also a specification, which they must be. Below: what the words encode, what the checksum actually catches, the three ways backups fail, and the restore drill worth running tonight. (seed backup guide)

What the words encode. BIP39 uses 2,048 words at 11 bits each. I checked the official English list: 2,048 unique entries, sorted, all four-letter prefixes distinct — which is why a wallet expands aband into abandon without complaint. Twelve words carry 132 bits, 128 of entropy plus 4 of checksum; twenty-four carry 264, 256 plus 8. Nothing else is in the phrase: no wallet name, no derivation path, no network. Monero takes another route. Its list has 1,626 words with all three-letter prefixes distinct, and the encoder turns 4 bytes into 3 words: for the little-endian uint32 v it writes v mod 1626, (v div 1626 + previous) mod 1626, (v div 1626^2 + previous) mod 1626, the loop in electrum-words.cpp. A 32-byte spend key becomes 24 words plus a 25th that is not a checksum over the list but seed[crc32 of the 24 prefixes mod 24] — always one of your own 24 words.

What the checksum actually catches. I simulated 20,000 single-word slips at each length and applied the real rule. BIP39 12-word phrases still validated 6.35% of the time — theory says 1 in 16 — and 24-word phrases 0.395%, close to 1 in 256. Monero's 25-word phrases passed 4.2%, and that is structural rather than a bug: the index is crc32 mod 24, so when it lands on a word you did not touch, the comparison succeeds by construction at 1 in 24, with the rest coincidence. Read it from the other side: one slip in twenty-five gets through on Monero, one in sixteen on a 12-word BIP39 phrase. A phrase a wallet accepts proves spelling, not completeness, and the checksum has no opinion about meaning — if your copy is internally consistent but the fifth word should have been something else, it validates perfectly. Only a restore that reproduces an address you already know answers the real question.

Three ways backups fail. First, the passphrase: a BIP39 passphrase is neither stored in the phrase nor derived from it, so a different one yields a different, perfectly valid, empty wallet with no error at all. Two people with the same 24 words and different passphrases hold two unrelated wallets, and nothing in the words says which was intended. Second, one copy with no redundancy — fire, water, a move, a bag left at an airport, an heir clearing a drawer. A seed has no recovery desk to call. Third, a digital copy: a photo in a gallery that syncs, a note in a synced app, a spooled print job, a screenshot in a chat. That is the failure that matters most over time, because a seed cannot be revoked; after exposure the only remedy is a new seed and moving the funds, paid for in fees and timing rather than a settings toggle. (how Monero fees work)

Choosing a medium. Paper is cheap and easy to check, and it fails to water, fire and handling; ink fades under UV. Stamped metal survives fire and water for decades and does nothing against discovery — a plate in a drawer is a plate a visitor can read. Splitting 24 words into two halves stored apart is cryptographically sound, since the missing half leaves 132 unknown bits, but it only works if word order survives and whoever restores knows both halves exist. An encrypted file in a password manager trades physical risk for remote risk plus the risk of forgetting the master password, and a locked-out account is as final as a fire. One rule outranks the medium: a passphrase, if used, never travels with the words.

Shamir and SLIP-39. SLIP-39 applies Shamir byte by byte over GF(256) and encodes each share as a mnemonic from a 1,024-word list at 10 bits per word. A 128-bit secret becomes 20 words per share, a 256-bit secret 33. Shares of the same secret begin with the same two words and shares of the same group with the same three, so a set is sortable by eye — including by whoever finds it. A 4-byte HMAC-SHA256 digest inside each share makes an insufficient or mismatched set abort instead of producing a wrong wallet, which is the property naive splitting lacks. The cost is a threshold you must document somewhere other than with the shares, and a restore path most wallets do not implement natively. Watch the geometry: a 2-of-3 with two shares stored together is a 1-of-1 with extra paperwork.

The restore drill. Write down the receiving address you use today plus a second derived address — a Monero subaddress or a second Bitcoin account — so a wrong derivation path cannot hide behind a lucky match. Take the backup copy, not the live device, to a spare machine that is offline. Type the words by hand rather than pasting: that also tests whether your transcription is legible to a human under stress. Compare addresses character by character. On Monero set the restore height at or before your first transaction, because too high silently misses history and too low scans from genesis for hours. Send a small amount in, spend it out from the restored wallet, wipe the spare machine, and date the envelope. A backup untested since the last firmware change is a hypothesis, not insurance.

Where this meets a swap. Our order form asks for the payout address and optionally a refund address; the create-order endpoint validates asset codes, amount and address length at 256 characters, and stores nothing else — no email, no account, no password to reset. That is deliberate, and it moves the entire recovery burden onto you: with the seed gone, no ticket and no appeal reconstructs the keys behind a payout address. Timing is equally unforgiving — an order is payable for 30 minutes from creation, late deposits are chased for 6 hours after a local expiry, and at 24 hours it closes. Money arriving at an address you no longer control is not destroyed, it sits on-chain in plain view, but you cannot spend it, which from where you stand is indistinguishable from loss. (recovering misdirected funds)

Numbers at the time of writing. Quotes on 2026-10-26 at about 18:05 UTC: 100 USDT-TRC20 gave 0.14772457 XMR, 500 gave 0.81018058, 1,000 gave 1.63812328, 5,000 gave 8.26013651 — implied 676.9, 617.1, 610.4 and 605.3 USDT per XMR, the spread coming from the per-order floor rather than price movement. 10 LTC gave 0.93171887 XMR, 1 XMR gave 10.21937454 LTC, 0.001 BTC gave 0.12310131 XMR, and the pair minimum was 19.704235 USDT. One snapshot only; the live quote on the page is the number to act on. A swap is a one-shot handoff, the payout lands once, and the seed you tested last year is the only thing between that payout and an awkward week. (XMR to USDT exit)

Mistakes that keep showing up. A passphrase on the same plate as the words, or nowhere at all. A restore first tested after the funds arrived. An exchange deposit address used as a refund address — it is not yours, and refunds return the same asset on the same network only. A seed photo in a syncing gallery. One seed shared by a phone wallet and a wallet that was supposed to be cold. Confidence that a checksum-valid phrase proves a good copy. No record of the scheme, threshold or derivation path, which is how a 3-of-5 becomes worthless to an heir. Backups are the one part of self-custody you cannot outsource and cannot verify after the fact, so the work is small: write down two addresses, restore from the copy in the drawer, compare characters, move a test amount. If they match, you have bought certainty while it is still cheap. (recovering misdirected funds)