How to Store Crypto Safely

Why Crypto Storage Matters

Here is the uncomfortable truth about cryptocurrency: if someone steals your crypto, there is no bank to call, no fraud department to file a claim with, and no chargeback button to press. Blockchain transactions are irreversible by design. Once funds move to another address, they are gone — unless the person who took them voluntarily sends them back, which virtually never happens. This single fact makes crypto storage one of the most important topics any crypto holder needs to understand.

Traditional banking has spent decades building safety nets. Your bank deposits are insured by the FDIC (up to $250,000 in the US). If someone steals your credit card number, you dispute the charge and the bank reverses it. If you forget your online banking password, you walk into a branch with your ID. None of these protections exist in crypto. When you hold cryptocurrency, you are your own bank — and that means you are also your own security department, your own fraud prevention team, and your own disaster recovery planner.

The numbers tell a sobering story. According to blockchain analytics firms, over $3.8 billion in cryptocurrency was stolen through hacks and exploits in 2022 alone. Billions more have been lost to individual mistakes — people losing access to wallets, throwing away hard drives containing private keys, falling for phishing attacks, or simply not understanding how their storage worked until it was too late. The early Bitcoin developer Stefan Thomas famously lost access to 7,002 BTC (worth hundreds of millions of dollars) because he forgot the password to an IronKey USB drive containing his private keys.

The Responsibility Shift

This responsibility shift is both the greatest strength and the greatest weakness of cryptocurrency. It is the strength because no government, corporation, or third party can freeze your assets, censor your transactions, or inflate away your holdings. It is the weakness because there is no safety net when things go wrong. The crypto community calls this principle “self-sovereignty,” and it comes with a real cost: you must take storage security seriously, or you risk losing everything.

The good news is that storing crypto safely is not complicated — it just requires understanding a few key concepts and following proven practices. You do not need to be a cybersecurity expert. You do not need expensive equipment. You need a clear understanding of the risks, a storage approach that matches your situation, and the discipline to follow through on your backup plan.

If you are new to cryptocurrency entirely, we recommend starting with our cryptocurrency for beginners guide to understand the fundamentals before diving into storage security. If you already own crypto and want to make sure it is protected, keep reading — this guide will walk you through every layer of security, from basic exchange storage to advanced multi-signature setups.

Understanding the Storage Spectrum

Crypto storage is not a binary choice between “safe” and “unsafe.” It is a spectrum, and every point on that spectrum involves a trade-off between security and convenience. The more secure your storage, the less convenient it is to access and spend your crypto. The more convenient, the more exposed you are to potential loss. Understanding this spectrum is the first step toward building a storage strategy that actually works for your life.

The Four Levels of Crypto Storage

Think of crypto storage as four levels, each offering progressively more security at the cost of convenience. Most people will use a combination of these levels, just as you might keep some cash in your pocket, some in a checking account, and some in a safe deposit box.

Level 1 — Exchange storage: Your crypto sits on a centralized exchange like Coinbase, Kraken, or Binance. The exchange controls the private keys. This is the most convenient option — you can buy, sell, and trade instantly. But you are trusting the exchange with your assets. If the exchange is hacked, goes bankrupt, or freezes your account, you may lose access to your funds.

Level 2 — Hot wallet (software wallet): You control the private keys through a software application on your phone or computer. Browser extensions like MetaMask, mobile apps like Trust Wallet, and desktop apps like Exodus fall into this category. You have custody of your keys, but the wallet is connected to the internet, making it vulnerable to malware, phishing, and remote attacks.

Level 3 — Cold storage (hardware wallet): Your private keys are stored on a dedicated hardware device (like a Ledger or Trezor) that never exposes them to the internet. To sign a transaction, you physically connect the device and approve it on the device's screen. This air gap between your keys and the internet eliminates most remote attack vectors.

Level 4 — Multi-signature (multi-sig): Instead of a single private key, transactions require approval from multiple independent keys — for example, 2 of 3 keys held on separate devices in different locations. This eliminates single points of failure entirely. Even if one key is lost or compromised, your funds remain safe. Multi-sig is the gold standard for large holdings but adds complexity to every transaction.

The key insight is that you do not need to pick just one level. Most experienced crypto holders use a tiered approach: a small amount in a hot wallet for daily use, the majority in cold storage for long-term holding, and multi-sig for their largest positions. We will cover how to build your own tiered plan in the security plan section below. For a deeper dive on wallet types, see our crypto wallets explained guide.

Exchange Storage: Convenient but Risky

Let us be clear: keeping crypto on an exchange is not inherently reckless. For many people — especially newcomers who are making their first purchases — exchange storage is a reasonable starting point. The problem is not using exchange storage temporarily. The problem is treating it as a long-term solution without understanding the risks.

When Exchange Storage Makes Sense

Exchange storage is reasonable in a few specific scenarios. If you are actively trading and need instant access to your funds, keeping your trading capital on a reputable exchange is practical — transferring between a hardware wallet and an exchange for every trade would be slow and expensive in gas fees. If you are brand new to crypto and just bought your first $100 of Bitcoin, leaving it on Coinbase while you learn is fine. And if you are using exchange staking services, your tokens need to be on the exchange by definition.

The key word in all of these scenarios is “reputable.” Not all exchanges are equal. Look for exchanges that are publicly traded or operate under regulatory oversight, publish proof of reserves, have a track record of handling security incidents transparently, and offer insurance on custodied assets. Even the best exchanges are not risk-free, but a well-run exchange with regulatory accountability is far safer than an unregulated offshore platform.

The Real Risks of Exchange Storage

The history of crypto is littered with exchange failures. Mt. Gox, once handling 70% of all Bitcoin transactions, collapsed in 2014 after losing 850,000 BTC to hackers. Creditors waited over a decade for partial repayment. QuadrigaCX's founder allegedly died with the only keys to $190 million in customer funds. And the most devastating example in recent history: FTX, which appeared to be one of the most legitimate exchanges in the industry, collapsed in November 2022 when it was revealed that customer funds had been misappropriated. Billions of dollars in customer assets were frozen.

Beyond outright failure, exchanges can also freeze your account for regulatory compliance, restrict withdrawals during periods of market stress, impose new geographic restrictions that lock you out, or suffer targeted hacks where specific accounts are drained through social engineering of support staff. In all of these scenarios, you have no recourse except through the exchange's own processes — or, in the worst case, through bankruptcy court.

The bottom line: exchange storage is a tool, not a vault. Use it for what it is good at (trading, on-ramping, staking) and move long-term holdings to storage you control. A good rule of thumb is to never keep more on an exchange than you would feel comfortable losing. For detailed guidance on avoiding common pitfalls, check our crypto security mistakes guide.

Exchange Security Checklist

If you do keep funds on an exchange, minimize your risk: enable two-factor authentication (preferably a hardware key like YubiKey, not SMS), use a unique email address dedicated to your exchange account, set up withdrawal address whitelisting so funds can only be sent to pre-approved addresses, enable withdrawal delays for new addresses, use a strong unique password stored in a password manager, and never click login links from emails — always navigate to the exchange directly. Use our security checklist tool to audit your current setup.

Hot Wallet Best Practices

Hot wallets — software wallets connected to the internet — are the workhorse of daily crypto usage. If you interact with DeFi protocols, mint NFTs, swap tokens on decentralized exchanges, or send crypto to friends, you are almost certainly using a hot wallet. The challenge is that convenience comes with exposure. Every connection to the internet is a potential attack surface. But with the right practices, you can significantly reduce your risk.

Choosing a Reputable Wallet

Not all hot wallets are created equal. When selecting a wallet, prioritize open-source code (so security researchers can audit it), a long track record without major security incidents, active development and regular updates, and a large user base (which means more eyes on potential bugs). For Ethereum and EVM chains, MetaMask remains the most widely used option. For Solana, Phantom is the standard. For multi-chain usage, Rabby has gained popularity for its transaction simulation features that show you what a transaction will do before you sign it.

Be extremely cautious with wallet browser extensions. Only install wallets from official sources — go to the project's official website and follow their link to the browser extension store. Fake wallet extensions are a common attack vector. Scammers create extensions with names like “MetaMask Wallet Pro” or “Phantom Secure” that look identical to the real thing but steal your seed phrase the moment you enter it. Always verify the publisher and review count before installing.

Browser Extension Safety

Your browser is a shared environment, and every extension you install has some degree of access to your browsing activity. For maximum security, use a dedicated browser profile (or a separate browser entirely) for crypto activities. Keep the number of extensions in your crypto browser to an absolute minimum — every additional extension is a potential vulnerability. Disable your wallet extension when you are not actively using it. And never, under any circumstances, enter your seed phrase into a browser — legitimate wallet extensions only ask for your seed phrase during initial setup or recovery, and they do it within the extension's own interface, never on a web page.

Mobile Wallet Tips

Mobile wallets offer convenience for on-the-go transactions, but your phone is also a personal device running dozens of apps, any of which could theoretically be compromised. Keep your phone's operating system updated. Only install wallet apps from official app stores, and verify the developer name matches the official project. Enable biometric authentication (face ID or fingerprint) on your wallet app. Set up a separate PIN for the wallet that differs from your phone unlock PIN. Avoid using wallet apps on rooted or jailbroken devices, as these bypass the operating system's built-in security protections. And be aware that clipboard malware exists — some malicious apps monitor your clipboard and replace copied wallet addresses with the attacker's address. Always double-check the first and last several characters of any address before sending.

Token Approval Management

Every time you interact with a DeFi protocol, you typically grant it permission (an “approval”) to spend your tokens. Many protocols request unlimited approvals — meaning they can move any amount of that token from your wallet at any time. If the protocol's smart contract is later exploited, the attacker can drain any tokens you have approved. Regularly review and revoke unnecessary token approvals using tools like Revoke.cash. Only approve the specific amount you intend to use, not unlimited amounts. And be especially cautious about approving tokens on unfamiliar protocols — this is one of the most common ways crypto is stolen through DeFi exploits.

For a comprehensive understanding of wallet types, features, and how to choose the right one, see our crypto wallets explained guide. And take our hardware wallet quiz to see if it is time to upgrade from a hot wallet to cold storage.

Cold Storage and Hardware Wallets

Cold storage is the gold standard for protecting cryptocurrency you are not actively using. The concept is simple: keep your private keys on a device that is never directly connected to the internet. Since most crypto theft happens through online attack vectors — phishing, malware, remote exploits — removing the internet connection from the equation eliminates the majority of threats. Hardware wallets are the most practical form of cold storage for individual users.

How Hardware Wallets Work

A hardware wallet is a small physical device (usually resembling a USB drive or a small calculator) that generates and stores your private keys in a secure chip. When you want to send a transaction, the process works like this: you create the transaction on your computer or phone, the unsigned transaction is sent to the hardware wallet, the device displays the transaction details on its own screen for you to verify, you physically press a button on the device to approve, the device signs the transaction internally and sends only the signed transaction back to your computer, and your computer broadcasts the signed transaction to the blockchain.

The critical security feature is that your private key never leaves the hardware wallet. Even if your computer is completely compromised with malware, the attacker cannot extract your private key from the device. They could try to trick you into signing a malicious transaction (which is why you always verify the details on the device's screen), but they cannot steal the key itself. This is a fundamental security advantage over software wallets, where the private key exists in your computer's memory and is potentially accessible to malware.

Ledger vs. Trezor: A Practical Comparison

The two most established hardware wallet brands are Ledger and Trezor. Both are solid choices, but they differ in philosophy and implementation. Here is a practical comparison to help you decide.

Ledger's advantage is its secure element chip (present in all models), broader coin support, Bluetooth connectivity for mobile use, and a more polished companion app. The trade-off is that its firmware is not fully open-source, which means you are trusting Ledger's internal security practices to some degree. The 2023 controversy around Ledger Recover (an optional cloud backup feature) raised concerns about the security architecture, though the feature is opt-in and does not affect users who do not activate it.

Trezor's advantage is its fully open-source firmware (anyone can audit the code), native support for Shamir's Secret Sharing backup (splitting your seed into multiple shares), and a philosophy of radical transparency. The trade-off is fewer supported coins, no Bluetooth (USB only for some models), and historically less robust physical tamper resistance — though the newer Safe 5 model addresses this with its own secure element chip.

Firmware Updates and Purchasing Safety

Always buy hardware wallets directly from the manufacturer's official website or their authorized resellers. Never buy from third-party marketplace sellers on Amazon, eBay, or similar platforms — tampered devices have been documented where attackers pre-initialize the wallet, include a fake “seed phrase card,” and wait for the victim to deposit funds before draining them.

Keep your hardware wallet's firmware updated. Manufacturers release firmware updates to fix security vulnerabilities, add support for new blockchains, and improve the user experience. Always update firmware through the official companion app (Ledger Live or Trezor Suite). Verify that firmware updates are legitimate before installing — both Ledger and Trezor sign their firmware cryptographically, and the companion apps verify this signature automatically. If your device ever prompts you for your seed phrase during a firmware update, something is wrong — a legitimate firmware update never requires your seed phrase.

Not sure which hardware wallet is right for you? Take our hardware wallet quiz to get a personalized recommendation based on your needs. You can also compare features side by side with our wallet comparison tool.

Seed Phrase Backup Strategies

Your seed phrase is the master key to your crypto. It is more important than the hardware wallet itself, more important than any password, and arguably the single most critical piece of information you will ever need to protect. If your hardware wallet breaks, gets lost, or is stolen, your seed phrase lets you recover everything. If your seed phrase is compromised, nothing else matters — your crypto is gone.

A seed phrase (also called a recovery phrase or mnemonic) is a sequence of 12 or 24 words generated when you first set up a wallet. These words, in the correct order, mathematically encode your entire wallet — every private key, every address, every account derived from that wallet. The BIP-39 standard ensures that seed phrases are compatible across different wallet brands. A seed phrase generated on a Ledger can restore on a Trezor, and vice versa (assuming both support the same derivation paths).

Metal Backups: The Durable Standard

Paper backups are the default — most hardware wallets ship with paper cards for writing down your seed phrase. But paper is fragile. It can be destroyed by fire, water, or simply degrade over years of storage. For any meaningful amount of crypto, upgrade to a metal backup. Products like Cryptosteel Capsule, Billfodl, and Blockplate let you stamp or engrave your seed words into stainless steel or titanium plates that can survive house fires (up to 1,500 degrees Celsius), flooding, and decades of storage. At $20-80, a metal backup is the cheapest insurance policy you will ever buy.

When creating a metal backup, double-check every word carefully. A single wrong word, a misspelling, or an incorrect word order will make your backup useless. Most BIP-39 word lists only require the first four letters of each word to be unique, so some metal backup products only require you to stamp four letters per word. After stamping, verify the backup by checking each word against the original — ideally have someone read the metal backup back to you while you check against the original.

Geographic Distribution

Storing your only seed phrase backup next to your hardware wallet defeats the purpose. If a fire, flood, or theft hits your home, you could lose both the device and the backup simultaneously. Store at least one copy in a geographically separate location: a bank safe deposit box, a fireproof safe at a family member's home, or a secure location in a different city. The exact locations depend on your personal situation, but the principle is simple: no single event should be able to destroy all copies of your seed phrase.

Some people maintain three copies in three different locations. This provides redundancy against loss while keeping the number of copies manageable. More copies mean more security against accidental loss but more exposure to potential theft. Find the balance that fits your risk tolerance.

What NOT to Do with Your Seed Phrase

This list of mistakes may seem obvious, but every single one of these has caused real people to lose real money:

• Never photograph your seed phrase. Photos sync to cloud services (iCloud, Google Photos) automatically. Your seed phrase would then exist on Apple's or Google's servers, accessible to anyone who compromises your cloud account.
• Never store it in a notes app, text file, or document. These files are not encrypted by default and can be accessed by malware, synced to the cloud, or discovered through device access.
• Never email it to yourself. Email is not encrypted end-to-end in most cases, and your email provider has access to your messages.
• Never store the full phrase in a password manager. Password managers are designed for passwords, not master keys to irreversible financial systems. If your password manager is compromised, so is your crypto.
• Never enter it on any website. No legitimate service will ever ask for your seed phrase through a website. This is always a phishing attack. Always. See our common crypto scam patterns guide for more examples.
• Never share it with anyone — not support staff, not friends, not family members (unless as part of a deliberate inheritance plan with proper safeguards).
• Never store it in a location that can be easily accessed by others — unlocked desk drawers, unsecured filing cabinets, or taped to the bottom of your keyboard.

Use our seed phrase analyzer tool to evaluate your current backup strategy and identify potential weaknesses without ever entering your actual seed phrase.

Advanced Security Measures

The previous sections cover the essentials that every crypto holder should implement. This section is for those holding significant amounts of cryptocurrency (generally $50,000 or more) or anyone who wants maximum security regardless of portfolio size. These techniques add layers of protection, but they also add complexity — implement them only if you fully understand how they work and can reliably operate them long-term.

Multi-Signature (Multi-Sig) Wallets

A multi-sig wallet requires multiple private keys to authorize a transaction. The most common configuration is 2-of-3: three keys are created, and any two must sign to approve a transaction. This provides two critical protections. First, if one key is lost or destroyed, you can still access your funds with the remaining two. Second, if one key is stolen or compromised, the attacker cannot move your funds without a second key.

In practice, a 2-of-3 multi-sig might look like this: key one on a Ledger in your home safe, key two on a Trezor in a bank safe deposit box, and key three on another hardware wallet at a trusted family member's home (or stored with a specialized custody service). To send a transaction, you need physical access to any two of these locations. This makes theft extremely difficult while still allowing recovery if one key is lost.

For Ethereum, Gnosis Safe (now Safe) is the most widely used multi-sig solution, securing over $100 billion in assets. For Bitcoin, platforms like Unchained and Casa offer guided multi-sig setups with co-signing services — they hold one key as a backup, but cannot move funds without your additional signatures. These services are particularly useful for people who want multi-sig protection without managing all three keys themselves.

Passphrase (25th Word)

Both the BIP-39 standard and most hardware wallets support an optional passphrase (sometimes called the “25th word”) that is added on top of your seed phrase. The passphrase creates an entirely different set of wallets and addresses. Without the correct passphrase, someone who discovers your seed phrase would only find the default wallet — which you would deliberately keep empty or with a small decoy amount. Your real holdings would be on the passphrase-protected wallet, invisible without the passphrase.

This provides plausible deniability and an additional layer of protection. However, it introduces a new risk: if you forget the passphrase, you lose access to every account derived from it. The passphrase is case-sensitive and can be any string of characters. There is no way to recover or reset it. If you use this feature, back up the passphrase separately from the seed phrase (different location, different medium) and make sure you will not forget it. Some people use a memorable sentence rather than a random string.

Air-Gapped Signing

For maximum isolation, some hardware wallets support fully air-gapped transaction signing — the device never physically connects to a computer. Instead, transactions are transferred via QR code or microSD card. You create the transaction on your connected computer, display it as a QR code, scan it with the air-gapped device, sign it on the device, display the signed transaction as another QR code, and scan that back with your computer. The Keystone hardware wallet is designed specifically for this workflow. Some Trezor models support it via microSD.

Air-gapped signing eliminates even the theoretical risk of USB-based attacks against the hardware wallet. It is the most paranoid level of transaction security available to individuals. For most people, a standard hardware wallet connected via USB or Bluetooth provides more than sufficient security, but air-gapped signing is worth considering for very large holdings.

Shamir's Secret Sharing (SLIP-39)

Shamir's Secret Sharing is a cryptographic method for splitting a secret (your seed) into multiple shares, where a defined threshold of shares is required to reconstruct the original. For example, you might split your seed into 5 shares and require any 3 to recover it. Unlike simply cutting a seed phrase in half, each individual share reveals absolutely nothing about the original seed — they are mathematically independent. This is supported natively by Trezor (SLIP-39 standard) and is significantly more secure than naive seed splitting.

A practical Shamir setup might distribute 5 shares across: your home safe, a bank safe deposit box, a trusted family member, a second geographic location, and a sealed envelope with your attorney. Any three can reconstruct your wallet. If two shares are lost or compromised, you still have access with the remaining three. If two shares fall into wrong hands, the attacker still cannot reconstruct your seed. This provides excellent resilience against both loss and theft. For a deeper understanding of the blockchain fundamentals that make all of this possible, see our blockchain explained guide.

Building Your Personal Security Plan

Theory is useful, but what matters is implementation. The best security plan is one you will actually follow. An overly complex setup that you cannot reliably maintain is worse than a simpler setup that you execute consistently. This section helps you build a practical, tiered storage strategy based on how you actually use your crypto.

The Three-Tier Storage Model

Think of your crypto storage in three tiers, mirroring how you might manage traditional money:

Tier 1 — Daily wallet (pocket cash): This is your hot wallet for everyday transactions. DeFi interactions, small purchases, token swaps, and NFT mints. Keep only what you need for the next week or two of active use. Accept that this wallet has higher risk and limit your exposure accordingly. If your hot wallet is compromised, the loss should be annoying, not devastating. For most people, this means keeping no more than 5-10% of their total crypto holdings in hot wallets.

Tier 2 — Active storage (checking account): This is your hardware wallet for holdings you may want to access within the next few months. Medium-term positions, tokens you might want to sell if the market moves significantly, and assets you want to keep liquid but secure. A single hardware wallet with a proper seed backup handles this tier well. You might access this wallet a few times per month.

Tier 3 — Vault storage (savings/retirement): This is for long-term holdings you do not plan to touch for years. Your Bitcoin conviction stack, your largest ETH position, and anything you consider generational wealth. This tier should use the highest security available to you: a dedicated hardware wallet (separate from your Tier 2 device), ideally with multi-sig or passphrase protection, metal seed backups in geographically distributed locations, and a documented recovery plan. You might access this wallet a few times per year, or less.

Security Audit Checklist

Use this checklist to audit your current security posture. Go through it honestly and address any gaps. Run this audit quarterly — security is not a one-time setup but an ongoing practice.

• Wallet inventory: Can you list every wallet you use, what is in each one, and how to access each one? If not, create that inventory now.
• Seed phrase verification: Have you verified that each seed phrase backup is accurate and readable? When was the last time you checked? Metal backups can be misread, and paper can fade.
• Backup redundancy: Do you have at least two copies of each seed phrase in separate physical locations? Could a single event (fire, flood, theft) destroy all copies?
• Device firmware: Are your hardware wallets running the latest firmware? Outdated firmware may have known vulnerabilities.
• Token approvals: Have you reviewed and revoked unnecessary DeFi token approvals? Old approvals to compromised contracts are a common loss vector.
• Exchange exposure: How much of your total holdings are sitting on exchanges? Is that amount more than you could afford to lose?
• Recovery test: Have you ever tested recovering a wallet from your seed phrase? If you have never done this, you do not actually know if your backup works. Test it with a small amount.
• Succession plan: If something happened to you tomorrow, could your family access your crypto? If not, see the recovery planning section below.

Use our interactive security checklist to walk through this audit with guided steps and track your progress. And our self-custody planner can help you design a tiered storage strategy based on your specific holdings and usage patterns.

Recovery Planning

Most crypto security guides focus on protecting against external threats — hackers, scammers, exchange failures. But there is another risk that few people plan for: what happens to your crypto if something happens to you? Cryptocurrency has no beneficiary forms, no automatic inheritance, and no institution that will transfer your assets to your heirs. If you are incapacitated or pass away without a recovery plan, your crypto could be lost forever. This is not a theoretical concern — billions of dollars in cryptocurrency are estimated to be permanently inaccessible because the holder died or became incapacitated without leaving adequate recovery instructions.

The Inheritance Challenge

The fundamental challenge of crypto inheritance is a security paradox: you need to make your crypto accessible to trusted people after you are gone, without making it accessible to anyone (including those trusted people) while you are alive. If you give your spouse your seed phrase today, you are trusting them not just with access to your assets, but with the discipline to store that seed phrase securely. You are also creating a single point of failure — if their storage is compromised, your assets are at risk.

Several approaches can help resolve this tension. The right choice depends on the size of your holdings, the technical sophistication of your heirs, and your overall estate planning situation.

Trusted Contact Approach

The simplest inheritance method is to designate a trusted contact — typically a spouse, adult child, or sibling — and provide them with the information needed to access your crypto. But do not simply hand them your seed phrase. Instead, create a sealed document containing: instructions for accessing your wallets, which devices to use and where to find them, where the seed phrase backups are located (but not the seed phrases themselves), and who to contact for technical help if needed. Store the seed phrase backups in locations your trusted contact can access (like a safe deposit box where they are a co-signer), but separately from the instructions. This way, the instructions alone are not enough to steal your crypto, and the seed phrases alone do not tell someone what to do with them.

Multi-Sig Inheritance

Multi-sig is particularly well-suited for inheritance planning. In a 2-of-3 setup, you might hold two keys yourself (for normal use) and give the third to a trusted family member, an attorney, or a specialized custody service. While you are alive, you operate the wallet normally using your two keys. If something happens to you, the family member can work with the custody service (or attorney) to access the funds using their key plus one of yours that is stored with your estate documents. Services like Casa and Unchained offer this as a structured product with guided inheritance processes.

Dead Man's Switches

A dead man's switch is a mechanism that triggers if you fail to perform a regular action — like confirming you are alive by clicking a link in a monthly email. If you miss enough check-ins, the service sends pre-designated information (such as the location of your seed backups and access instructions) to your designated recipients. Google's Inactive Account Manager is a basic version of this concept for Google accounts. Specialized crypto services offer more sophisticated implementations. The risk with dead man's switches is that a period of inactivity (illness, travel, simply forgetting) could trigger the switch prematurely. Set generous timeout periods and use multiple confirmation channels.

Documentation Without Exposure

Whatever inheritance approach you choose, you need to document it without creating a security vulnerability. Here is a practical framework:

• Layer 1 — The letter of intent: A plain-language document stored with your will that explains that you own cryptocurrency, that it has significant value, and that detailed access instructions exist. This document should not contain any keys, phrases, or specific access details — just the awareness that crypto exists and the process to follow.
• Layer 2 — The instruction set: A detailed document stored separately (safe deposit box, attorney's office) that explains which wallets you use, which devices to look for, where seed phrase backups are located, and step-by-step recovery instructions. This document references locations but does not contain the actual seed phrases.
• Layer 3 — The seed phrases: The actual seed phrase backups, stored in the locations referenced by Layer 2. These are only useful to someone who also has the Layer 2 instructions and understands what to do with them.

By separating awareness (Layer 1), instructions (Layer 2), and keys (Layer 3) across different locations and access methods, you create a system that is recoverable by your heirs but not easily compromised. Keep these documents updated — if you change wallets, add new holdings, or move your seed backups, update the instruction set. A yearly review is a reasonable cadence.

For help building your complete recovery and inheritance plan, use our recovery planning tool. And to walk through setting up your wallet from scratch with security best practices built in, see our wallet setup guide.