Cold Sharding: Splitting a Private Key Into Offline Shamir Shares

Cold sharding is a way to back up a private key or wallet seed by splitting it into several shares with Shamir’s secret sharing and keeping each share offline in a different place. A set number of shares, for example any 3 of 5, rebuilds the secret, while fewer reveal nothing about it: a thief who finds one share learns nothing, and a fire that destroys one location loses nothing. The trade-off is that the secret has to be put back together on one device before it can sign, which is the main difference from a multisig wallet. It builds on cold storage: the shares are created on an offline device and never touch an online one.

Cold Sharding at a Glance

How Does Cold Sharding Work?

The method comes from Adi Shamir’s 1979 paper How to Share a Secret, which shows how to divide data into n pieces so that any k of them rebuild it, while even complete knowledge of k − 1 pieces reveals absolutely no information. The secret becomes one point of a random polynomial of degree k − 1 and each share is another point on it; k points fix the polynomial, and fewer leave every possible secret equally likely. No amount of computing power changes that, because the missing information is simply not in the shares.

For wallets, SatoshiLabs standardized the scheme as SLIP-39, which splits a wallet’s master secret into word lists called shares and states that knowing fewer than the required number does not leak information about the secret. Trezor’s description of Shamir backup gives the usual example: in a 2-of-3 scheme you create three shares of 20 or 33 words, any two restore the wallet, and a single lost or stolen share leaves it safe. SLIP-39 can also nest thresholds in groups, for example two of your own shares, or three of five friends together with two of six family members. SLIP-39 vs BIP39 explains the share format word by word.

“Cold” refers to where this happens: the shares are generated on a hardware wallet or an offline computer, written on paper or metal, and never typed into a phone or a connected computer.

How Do You Create and Store the Shares?

1. Pick the threshold. For one person, 2-of-3 tolerates one lost share, or one share that falls into the wrong hands. For a family or a company, 3-of-5 or a group scheme spreads trust further.
2. Generate the shares on a device that supports SLIP-39, such as a Trezor, instead of on a general-purpose computer. The device creates the secret and shows the words on its own screen (hardware wallets explained).
3. Write each share down by hand, on paper or stamped metal (metal seed phrase backups), and label it with its number but not with the locations of the others.
4. Spread the shares out: a home safe, a bank deposit box, a trusted relative. Keeping a threshold’s worth of shares in one place turns the scheme back into a single backup.
5. Test recovery before funding the wallet. Use the device’s backup check, or restore on a second device, while the balance is still small (how to check a Trezor backup).
6. Write down the scheme itself: how many shares exist, how many are needed and who holds them, so that your heirs can use it (crypto inheritance).

What Are the Risks of Cold Sharding?

• The reconstruction moment. To sign, the shares are combined back into the full secret on one device. If that device is compromised, the scheme fails at once. Combining shares inside a hardware wallet, which is how Trezor’s recovery works, keeps the assembled secret off computers that run other software.
• Homemade splits are not secret sharing. Cutting a 24-word phrase into pieces that each show some of the words gives every finder part of the phrase and makes the rest easier to guess (how guessable a seed phrase is). Use a real Shamir implementation.
• Format lock-in. SLIP-39 shares restore only in wallets that support SLIP-39, and an existing BIP39 phrase cannot be turned into shares of the same wallet. SLIP-39 exists partly because non-standard tools carry the risk of being unable to recover the secret once the tooling changes.
• Wrong or damaged shares. Plain Shamir sharing cannot tell a wrong share from a right one. SLIP-39 adds a checksum to every share and a digest that confirms the recovered secret, which is another reason to prefer it over custom scripts.
• Collusion and coordination. Any T shareholders together can take the funds, and if too many shares are lost or nobody knows the scheme, the funds are gone. Pick holders who would not collude, and keep the list current.

Cold Sharding vs Multisig: Which Should You Use?

Sharding protects the backup; multisig protects the spending. A sharded wallet is an ordinary single-key wallet, so it costs no more in fees and works anywhere SLIP-39 does, but its secret exists in one place whenever you sign. In a multisig wallet each key signs on its own device and is never assembled, at the cost of more devices, a configuration file to back up and larger transactions. The two can be combined, for example by backing up each multisig key as Shamir shares, though every layer adds work.

A third approach is threshold signatures: any k of n key holders produce one ordinary signature that verifies under a single public key, so the spend looks like a single-key payment. In schemes such as FROST the full key is never assembled, though support in consumer wallets is still new; Bitcoin Optech’s topic page tracks the work.

Our rule of thumb: the extra hardware, locations and testing begin to pay off once losing the funds would change your life, which for many people means somewhere around $100,000. Below that, one well-stored seed phrase, perhaps with a BIP39 passphrase, is usually enough (how to store a seed phrase). Sparrow Wallet’s best-practices guide draws a similar line, suggesting single-signature storage up to about US$100,000 and multisig cold storage beyond it. The attacks each scheme defends against are covered in the threats and defenses guides.

Frequently Asked Questions

Is cold sharding the same as a Shamir backup?

In practice, yes. Shamir backup is the common name for SLIP-39 shares, which Trezor now calls Multi-share Backup; cold sharding adds the rule that the shares are created and kept offline, in separate places.

Can I shard my existing seed phrase?

Not into the same wallet with SLIP-39. Create a new wallet with a Shamir backup, check the shares, then send your funds to it.

How many shares should I make?

Enough that losing one or two still leaves the threshold, and few enough that you can keep track of them all. For one person, 2-of-3 is a sensible default; 3-of-5 suits groups and larger amounts.