Crypto inheritance means arranging things so that the people you choose can reach your coins after you die or can no longer act, while nobody can reach them before. For self-custodied crypto it comes down to one fact: whoever holds the seed phrase, plus the passphrase if you set one, controls the funds, and there is no bank or password reset to fall back on. A working inheritance plan, for bitcoin or any other coin, keeps the backup and the instructions apart and gets both to the right people at the right time. This guide covers what heirs need, five ways to pass on access, why the phrase stays out of your will, a letter of instruction checklist and testing. New to recovery phrases? Start with how a seed phrase works.
Not legal or tax advice. Inheritance law differs between countries and states, so ask an estate lawyer how to make your plan valid where you live.
The developer of a non-custodial wallet does not hold your phrase and cannot restore it. If nobody finds your backup or understands it, the coins stay on the blockchain, unspendable. And the words alone are often not enough:
The opposite failure is as real: a backup many people can reach can be stolen or spent early. Every method below balances the two.
Whatever the method, heirs need:
Wallet details cannot spend anything, so they can be written down. For the public BIP39 test phrase (abandon eleven times, then about; never send funds to it):
Backup type: BIP39, 12 words, no passphrase
Script type: Native SegWit (P2WPKH), BIP84
Account path: m/84'/0'/0'
Master fingerprint: 73c5da0a
First address: bc1qcr8te4kr609gcawutmrza0j4xv80jy8z306fyu
That address is the official BIP84 test vector. An heir who restores the wallet and sees the same first address knows the words, passphrase and path are right. Anyone who reads the address can also look up its history, so keep the document private.
The backup stays in secure storage (see how to store a seed phrase), and a letter of instruction with no secrets in it tells your heirs where it is and what to do. The letter can sit with your estate documents or your lawyer; the backup goes where your executor can reach it.
It is cheap, and any compatible wallet can restore the backup. The weakness: whoever finds it, before or after your death, can take everything. A passphrase kept elsewhere adds a second factor, as long as the letter says it exists.
SLIP-39 uses Shamir's secret sharing to split a wallet's master secret into shares, any threshold number of which restores it. Fewer shares than the threshold reveal nothing about the secret, so in a 2-of-3 set one lost or stolen share does no harm. The spec allows up to 16 shares per group and 16 groups, so friends and family can hold separate groups. Each share is written in words from a separate 1,024-word list: 20 of them for a 128-bit secret, 33 for a 256-bit one.
Trezor calls this Multi-share Backup and supports it on the Safe 7, Safe 5, Safe 3 and Model T. A 20-word single-share backup made since June 2024 can be upgraded in Trezor Suite under Settings → Device → Create Multi-share Backup, but the original backup stays valid and still needs protecting. A 12- or 24-word wallet, or a 20-word one from before June 2024, cannot be upgraded: you create a new wallet and move the funds. SLIP-39 vs BIP39 compares the formats.
Heirs need enough shares and a wallet that restores SLIP-39, and shareholders who reach the threshold can restore it without you, so pick people unlikely to collude.
In a multisig wallet, a set number of its keys must sign each spend. One inheritance layout is 2-of-3: you keep two keys in different places and an heir or trusted person holds the third. You can spend alone, the heir cannot, and after your death the heir adds one of your keys, found through the letter.
The catch is the configuration. The script behind a multisig address lists every cosigner's public key (BIP 383), so two seeds alone cannot find the coins: the wallet also needs the third public key, usually saved as an output descriptor or a configuration file. Keep a copy with every key. It cannot spend, but it reveals balances and history.
Bitcoin scripts can add a second spending path that opens only after a delay. In Liana, an open-source wallet, your primary key spends at any time, and a recovery key, such as an heir's, only after a period of inactivity you choose. The timelock is relative: the clock starts when each coin is received, and each coin must be spent at least once per timelock period to keep the recovery path closed; when that path is close to opening, Liana v15's home screen offers a Reset timelock button that does it with a transaction to yourself. BIP 68 caps a block-based relative timelock at 65,535 blocks, about 15 months. After the delay, the heir restores the wallet from its descriptor, opens the Recovery menu and sends the coins to another wallet, signing with the recovery key.
In Nunchuk's on-chain design, the wallet is 2-of-4 with Nunchuk's Platform Key until the timelock and 1-of-3 without it afterward; the beneficiary needs the inheritance key and the wallet configuration, and postponing the timelock takes a guided migration.
The heir cannot spend early, but if you forget to refresh, the recovery path opens while you are alive, and each refresh costs a fee.
Inheritance services follow a few patterns, going by their own documentation:
They can spare heirs much of the technical work, but they tie the plan to a company: check the fees, and ask what happens if the provider shuts down.
| Approach | Security | Complexity | What heirs must do |
|---|---|---|---|
| Letter plus storage | One backup controls everything; a passphrase adds a factor | Low | Find the backup, restore in a compatible wallet, add the passphrase |
| SLIP-39 shares | Fewer shares than the threshold reveal nothing; enough holders together can restore | Medium | Collect the threshold of shares, restore in a SLIP-39 wallet |
| Multisig, 2-of-3 | No single key can spend; descriptor needed | High | Gather two keys and the descriptor, restore in a multisig wallet |
| Time-locked recovery | Heir's key works only after the timelock; coins need refreshing | Medium to high | Wait out the timelock, load the descriptor, sign the recovery spend |
| Inheritance service | A waiting period or timelock blocks early claims; depends on the company | Low to medium | File a claim, wait (six months at Bitkey, and at Casa by default), then sign or transfer |
A will passes through many hands: lawyers, executors, family, sometimes a court. It can also become public: in England and Wales, the government's probate guidance says the will is kept by the probate registry and becomes a public record; once probate is issued, copies can be ordered online. Rules elsewhere differ. Wills are also updated rarely, while wallets change often.
Keep the words in secure storage and only instructions in documents. Your lawyer can advise how the will should mention your digital assets and the letter.
Write for a non-technical reader, date it, and keep every secret out: no words, passphrase or PINs. Include:
Test without exposing the real backup:
Review the plan yearly and after any change: a new wallet, device, address type or passphrase, new heirs, a move, or a wallet app that is discontinued. Record the standards (BIP39, BIP84, the path), not just app names, put timelock refreshes in your calendar, and destroy old letters.
It is safer not to. Many people handle a will, and in England and Wales a will that goes through probate becomes a public record. Keep the words in secure storage and let a letter of instruction say where to look.
Coins in a self-custodied wallet stay on the blockchain, but nobody can move them. Coins on an exchange are different: the exchange holds the keys, so the estate's legal representative files a claim with it. Kraken, for example, asks for a death certificate, proof of appointment such as probate, photo ID and a signed letter.
No. The PIN only unlocks that one device. With the backup, plus any passphrase, heirs can restore the wallet on a new device or in a compatible app. Multisig and time-locked wallets also need their descriptor.
They solve different problems. SLIP-39 splits the backup of a single-signature wallet, which controls the coins once enough shares are combined. Multisig needs several signatures for every spend: stronger against theft, harder for heirs.