Compare methods side by side
No method wins on every measure. These matrices show the trade-offs — security, resilience to fire, flood, theft and loss, cost, complexity, inheritance and skill — with the reasoning and sources behind every rating, so you can weigh them against your own situation. Each row links to the deep page rather than repeating it. Pair this page with the decision guide and the scenarios.
At a glance Beginner
- Every method trades one risk for another. Copies protect against loss but help thieves; splitting protects against theft but adds ways to lose access; companies remove complexity but add a party you must trust.
- The two failures that matter most are loss and theft. Good setups survive losing any one backup, device or location and survive any one of them being found by someone else.
- Do not cut your words into pieces yourself. Each piece gives away most of the secret. If you want splitting, use a standard such as SLIP-39 or multisig (anti-patterns).
- Complexity is a risk in its own right. A setup you or your heirs cannot operate under stress can lose more money than a simple one.
- Exchange accounts are not bank deposits. In the UK the FCA says crypto is "highly unlikely" to be covered by the FSCS; in the US the FDIC does not insure crypto assets, and SIPC does not protect crypto that is not a registered security (UK vs USA).
- Whatever you choose, test recovery and tell someone the plan exists. See the checklist and letter of instruction.
Master matrix: 15 methods compared Beginner Intermediate
One row per backup or custody method, from a single sheet of paper to a regulated custodian. Ratings are editorial and qualitative for a careful individual (see How to read the ratings above); cost notes link to sources where a figure is published. Click a method for its pros, cons, pitfalls and community advice. Methods can be combined — for example metal plates for SLIP-39 shares or multisig seeds.
| Method | Theft if a backup is found | Fire / flood at one site | Loss or misplacement | Cost | Complexity | Inheritance-friendliness | Single point of failure | Skill level | Deep dive |
|---|---|---|---|---|---|---|---|---|---|
| Paper, one copy | Exposed | Poor | High | Very low | Low | Fair if found | The one sheet | Beginner | Paper |
| Stamped, engraved or punched metal plate (2+ copies apart) | Exposed | Good | Low | One-off; varies | Low–medium | Fair | Any one copy gives full access | Beginner | Stress tests |
| Letter-tile or cassette kit | Exposed | Varies by design | Low with copies | One-off; varies | Low | Fair | Any one copy; loose tiles | Beginner | Design lessons |
| Seed + BIP-39 passphrase | Low | Depends on media | Medium | Very low | Medium | Poor unless documented | The passphrase record, if only one exists | Intermediate | Passphrase |
| Seed XOR (all parts needed) | Low | Depends on media | High | Very low | Medium | Poor | Every single part | Expert | Seed XOR |
| SLIP-39 Shamir 2-of-3 | Low | Good | Low | Low | Medium | Fair | The device that recombines shares; wallet support | Intermediate | SLIP-39 |
| Multisig 2-of-3 (self-custody) | Very low | Good | Low | Several devices | High | Fair | Wallet descriptor, if not stored with each key | Expert | Multisig |
| Timelocked recovery (Liana, Nunchuk) | Low | Good | Low | Software can be free | High | Good | Descriptor; refreshing coins before timelocks expire | Expert | Custody |
| Collaborative custody (you hold 2 of 3) | Very low | Good | Very low | Subscription | Medium | Good | Your recovery data if the company disappears | Intermediate | Providers |
| Inheritance service (claim with delay) | Depends on claim checks | Good | Medium | Varies — Check | Low | Good | The provider's process; a beneficiary setting may not match your will | Beginner | Services |
| MPC wallet (phone + server shares) | Low | Good | Medium | Low | Low | Fair | Provider plus your email and cloud account | Beginner | MPC |
| Identity-based seed recovery (Ledger Recover) | Medium | Good | Low | Monthly fee | Low | Check | Your identity documents and the providers | Beginner | Recovery services |
| Exchange / custodial account | Medium | Not applicable | Medium | Trading fees | Very low | Fair (probate needed) | The company | Beginner | Custody |
| Qualified / institutional custodian | Low | Not applicable | Low | High | Low | Good | The institution | Intermediate | Institutional |
| Cutting words into pieces yourself (anti-pattern) | High | Depends on media | High | Very low | Medium | Poor | Every piece — and each piece leaks most of the seed | Avoid | Why not |
Cost notes, checked 24 October 2026: Casa Standard (3-key vault, inheritance included) is listed at $250 a year (Casa pricing); Ledger Recover is $9.99 a month according to Ledger (Ledger Academy); Liana Wallet is free, open-source software (Wizardsardine). Prices for metal plates and other services vary — see the directory and check with the provider. UK buyers paying in US dollars may also face currency conversion costs. Fire and flood ratings for metal and tiles come from Jameson Lopp's stress tests; for other methods they assume shares or keys are kept in different places.
Risk scores: custody and splitting methods Intermediate
| Method | Loss risk | Theft risk | Complexity | Ongoing cost | Inheritance-friendliness | Vendor dependence |
|---|---|---|---|---|---|---|
| Single-sig, one seed backup | High | Medium | Low | Low | Poor | Low |
| Single-sig, two or three identical copies | Low | High | Low | Low | Fair | Low |
| Single-sig + BIP39 passphrase | Medium | Low | Medium | Low | Poor | Low |
| Seed XOR (e.g. 2 or 3 parts, all required) | High | Low | Medium | Low | Poor | Low |
| SLIP-39 Shamir 2-of-3 | Low | Low | Medium | Low | Fair | Medium |
| Multisig 2-of-3 (self-custody) | Low | Very low | High | Medium | Fair | Low |
| Collaborative custody 2-of-3 (you hold 2 keys) | Very low | Very low | Medium | High | Good | Medium |
| Timelocked recovery / inheritance (Liana, Nunchuk) | Low | Low | High | Low | Good | Low |
| Exchange / custodial account | Medium | Medium | Very low | Low | Fair | Very high |
| Qualified / institutional custodian | Low | Low | Low | High | Good | Very high |
| MPC wallet (key shares on phone + server) | Medium | Low | Low | Low | Fair | High |
| Identity-based seed recovery (e.g. Ledger Recover) | Low | Medium | Low | Medium | Fair | High |
For risk, complexity, cost and dependence, green means lower (better); for inheritance-friendliness, green means better.
Threat-by-method matrix Intermediate
Read across a row to see which methods survive a given event. Protected, Partly and Exposed assume each method is set up as its makers recommend, with copies, shares or keys in different places. "Check" means the answer depends on a provider's terms that we could not confirm for every provider.
| Threat | Single seed, one copy | Seed, 2–3 copies | Seed + passphrase | SLIP-39 2-of-3 | Multisig 2-of-3 | Collaborative 2-of-3 | MPC wallet | Exchange | More |
|---|---|---|---|---|---|---|---|---|---|
| House fire or flood at one site | Exposed | Protected if copies are apart | Only if seed and passphrase copies are each duplicated | Protected | Protected | Protected | Cloud backup | Not applicable | Physical threats |
| Burglar or visitor finds one backup | Exposed | Exposed | Seed alone is not enough | One share reveals nothing | One key cannot spend | Protected | No seed to find | Not applicable | Locations |
| Targeted coercion ("wrench attack") | Exposed | Exposed | Decoy wallet possible | If shares are elsewhere | If keys are geographically spread | Casa lists an emergency lockdown | Check | Check | Coercion |
| Forgetting a PIN, passphrase or your own scheme | Seed restores | Seed restores | Forgotten passphrase = loss | Need enough shares | Need enough keys | Provider helps replace a key | Email + cloud file | Account recovery | Passphrase |
| Hardware wallet broken or lost | Protected | Protected | With passphrase record | Protected | Protected | Protected | Phone loss: cloud file needed | Not applicable | Devices |
| Phishing or malware that asks for your words | Exposed | Exposed | Unless passphrase also typed in | Shares can still be phished | One seed cannot spend | Protected | Account takeover risk | Account takeover risk | Scams |
| Weak randomness when the seed was made | Exposed | Exposed | Strong passphrase adds margin | All shares come from one secret | Only if keys come from different devices | Your keys still matter | Check | Not applicable | Entropy failures |
| Counterfeit or tampered device | Exposed | Exposed | A fake Trezor cut passphrases to one character | Exposed | One bad key is not enough | Protected | Not applicable | Not applicable | Supply chain |
| Provider insolvency or shutdown | Protected | Protected | Protected | Protected | Protected | Documented recovery without the company | Depends on provider; Zengo uses an escrow trustee | Celsius, FTX, Mt. Gox | Custodial cases |
| Account freeze or legal compulsion of a provider | Protected | Protected | Protected | Protected | Protected | Cannot move funds alone | Check | Exposed | Custody |
| Owner dies without instructions | Heirs may not find or recognise it | Exposed | Passphrase usually lost | Exposed | Descriptor and devices needed | Provider inheritance process | Check | Death claim with probate | Estate planning |
| Owner loses mental capacity | Attorney must find it | Partly | Exposed | Partly | Partly | Partly | Check | Power of attorney accepted? Check | UK LPA · US POA |
Sources: counterfeit Trezor (case file); weak randomness (COLDCARD 2026 and entropy incidents); collaborative recovery without the company (Casa, Unchained); Casa's emergency lockdown is listed on its pricing page; Zengo's escrow and trustee arrangement (Zengo); Zengo recovery uses email and a cloud recovery file (Zengo help); custodial failures (CNBC on Mt. Gox, Reuters on FTX, Celsius case); exchange death claims need probate documents (Coinbase, Kraken).
Single points of failure and what you must back up Intermediate
A single point of failure is one thing whose loss or exposure is enough to lose the funds. Most "advanced" setups move the single point of failure rather than remove it, so it helps to name it.
| Method | Single point of failure | What must be backed up | Mitigation |
|---|---|---|---|
| Single seed (any medium) | The seed copy itself; whoever holds it holds the funds | Seed words (and passphrase, if used) | Duplicate in separate places; consider a passphrase or a threshold scheme |
| Seed + passphrase | The passphrase memory or record | Seed and passphrase, stored apart, each duplicated | Write the passphrase down; test it; tell heirs where both are |
| Seed XOR | Every part (N-of-N) | All parts, plus any passphrase — the COLDCARD docs say parts protect only the words | Duplicate each part; COLDCARD notes splitting does not strengthen a weak seed |
| SLIP-39 Shamir | The device used to create and recombine shares; continued wallet support | Threshold of shares (and passphrase, if used) | Check that heirs can use a SLIP-39 wallet (Trezor FAQ); keep shares apart |
| Multisig | The descriptor or configuration file, if it is not backed up | Seeds or devices for the quorum, plus the descriptor | Store the descriptor with every key (Unchained); use more than one device maker |
| Collaborative custody | Your own recovery information if the company vanishes | Your keys plus the wallet configuration or "Sovereign Recovery" details | Keep the recovery details offline and test them (Casa) |
| Timelocked inheritance | The configuration "map" and the heir key; coins not refreshed in time | Descriptor, keys, heir key and the timelock schedule | Nunchuk says the heir needs both the inheritance key and the wallet configuration (Nunchuk) |
| MPC wallet | The provider and your email/cloud account | Recovery kit as the provider defines it | Read the provider's shutdown plan; Zengo says it cannot help if your recovery file is lost (Zengo) |
| Identity-based recovery | Your identity and the providers' processes | Subscription and identity documents | Keep an independent offline backup too; see the controversy |
| Exchange account | The company; access to your login and email | Login details and 2FA recovery codes; a record that the account exists | Exchanges named here do not offer beneficiary designations (Coinbase, Kraken); executors need probate documents |
Exchange beneficiary statements: Coinbase says it "doesn't currently support naming a beneficiary for individual accounts" (Coinbase Help); Kraken says it "doesn't currently offer the option to add a beneficiary" (Kraken Support). Unchained describes the configuration file as a "treasure map" needed with two keys for recovery if its service is unavailable.
Pros, cons, pitfalls and community advice by method Beginner Intermediate
The reasoning behind each row of the matrices, with sources. Physical media are covered below the media matrix.
Single-sig, one seed backup Beginner
One metal or paper copy of a 12- or 24-word seed. Simple and cheap, but any single fire, flood or misplacement loses everything, and anyone who finds the copy can take everything. Heirs only need the one copy, but they must find it and know what it is.
Pros
- Cheapest and simplest
- Works with almost every wallet (BIP-39)
Cons
- One event can lose or expose everything
Pitfalls
- Photographing or typing the words "just once"
- Keeping the only copy next to the device
Community advice
- Treat it as a starting point, not a final setup; add a second copy elsewhere (Casa: 21 tips, tip 16)
More: BIP-39 · Start here · loss cases
Single-sig, two or three identical copies Beginner
Duplicates in separate places sharply cut loss risk, but every extra copy is another place a thief or nosy relative might find it. A common, sensible starting point for modest amounts.
Pros
- Big drop in loss risk for little cost
- Easy for heirs: any one copy works
Cons
- Theft risk grows with every copy
Pitfalls
- Copies in the same building (one fire takes both)
- Forgetting where the second copy is
Community advice
- Separate copies by distance, and record where they are in your inventory template, not the words themselves
More: Separation · locations
Single-sig + BIP-39 passphrase Intermediate
A found seed alone is useless to a thief, but forgetting or mis-recording the passphrase loses funds permanently — the classic failure. BIP-39 says every passphrase produces a valid wallet, so a typo shows an empty wallet rather than an error (BIP-39). Heirs need both pieces and clear instructions, stored separately.
Pros
- Protects a found or photographed seed
- Allows decoy wallets
Cons
- A second secret to keep for life
- No error message for a wrong passphrase
Pitfalls
- Relying on memory alone
- Storing the passphrase with the seed
Community advice
- Write the passphrase down and store it apart from the seed; test recovery; Casa lists Seed XOR and Trezor Shamir as acceptable, but warns against improvised splitting (Casa)
More: Passphrase · splitting with a passphrase · passphrase pitfalls
Seed XOR (e.g. 2 or 3 parts, all required) Expert
Splits a seed into 2, 3 or 4 parts that are all required (N-of-N). Each part is itself a valid BIP-39 seed, which allows decoy funds on each part (COLDCARD docs). Losing any one part loses the lot, so each part usually needs its own duplicate. COLDCARD now warns that splitting "does not add entropy" and does not repair a seed affected by its 2026 advisory (COLDCARD).
Pros
- One found part reveals nothing useful
- Plausible deniability with decoy funds
- Done with paper and a device; no special wallet needed to restore once combined
Cons
- N-of-N: no tolerance for a lost part
- Mainly supported by COLDCARD
Pitfalls
- Not duplicating each part
- Assuming XOR fixes a weak seed
Community advice
- Duplicate every part; test a full recombination before depositing funds (COLDCARD)
More: Seed XOR · COLDCARD 2026 case
SLIP-39 Shamir 2-of-3 Intermediate
Any two of three shares recover; one lost or stolen share is not fatal, and fewer than the threshold reveal nothing about the secret (SLIP-39). The secret is created and reassembled on one device, so that device is a temporary single point of trust (Unchained). Fewer wallets support SLIP-39, so check your heirs can use it.
Pros
- Survives one lost and one stolen share in 2-of-3
- No extra data such as descriptors
- One secret covers all coins on that wallet
Cons
- Recombination happens on one device
- Limited wallet support
- Shares cannot be revoked; you must make a new wallet
Pitfalls
- Mixing shares from different sets
- Storing two shares in one place (that is the whole wallet)
Community advice
- Prefer the SLIP-39 standard over generic Shamir tools (Casa, Bitcoin Wiki)
More: SLIP-39 · Shamir vs multisig · which wallets restore SLIP-39
Multisig 2-of-3 (self-custody) Expert
Three independent keys on different devices; any two sign. Resistant to a single theft, device bug or coercion of one person. You need the wallet descriptor backed up as well, and heirs need a guide. It is the most robust self-custody option but the most to learn. Changing the quorum means moving coins to new addresses (Unchained).
Pros
- No single key can spend or lose the funds
- Mix device makers to survive a bad device or weak randomness
- Open standards; many coordinators
Cons
- Most moving parts
- Descriptor must be kept with each key
- Higher fees for larger transactions
Pitfalls
- Losing the descriptor
- All keys from one maker or one seed generator
- No written guide for heirs
More: Multisig across vendors · descriptor backups · multisig recovery
Collaborative custody 2-of-3 (you hold 2 keys) Intermediate
Like multisig, but a company holds one key and helps with recovery and inheritance. Fees and some identity checks apply; the company cannot move funds alone. Both Casa and Unchained publish ways to recover with your own keys if the company disappears (Casa, Unchained). Bitkey uses a similar 2-of-3 design with a phone key, a hardware key and a Block server key (Bitkey).
Pros
- Professional help with key loss and inheritance
- Company alone cannot spend
- Documented recovery without the company
Cons
- Subscription cost (Casa Standard $250 a year, Casa)
- Account and identity data held by a company
- Some services and features are US-focused
Pitfalls
- Never testing the recovery-without-company route
- Losing the configuration file
Community advice
- Import your wallet descriptor into Sparrow to confirm addresses and balances without moving funds (Casa)
Timelocked recovery / inheritance (Liana, Nunchuk) Expert
A recovery or heir key only becomes valid after a period of inactivity, enforced on-chain with Miniscript timelocks. Wizardsardine says Liana funds remain accessible with any Miniscript-compatible wallet if the company stops (Liana). Nunchuk's on-chain plan reduces the quorum after the timelock (for example 2-of-4 to 1-of-3) and requires the heir to hold both the inheritance key and the wallet configuration (Nunchuk). You must refresh coins before timelocks expire.
Pros
- Inheritance and lost-key recovery without a company
- Rules enforced by the Bitcoin network
Cons
- Newer tooling; fewer compatible wallets
- Coins need moving before each timelock expires
Pitfalls
- Forgetting to refresh, so the recovery path opens early
- Heir lacks the configuration file
Community advice
- Practise on testnet first; Nunchuk encourages it (Nunchuk)
Inheritance services (claim with a waiting period) Beginner
Some providers let a named beneficiary start a claim that completes after a delay unless you cancel it. Bitkey uses a six-month waiting period; the beneficiary needs their own Bitkey device, and Bitkey warns that naming a beneficiary "does not guarantee they are the legal owner" because your will may take precedence (Bitkey). Casa includes inheritance in its plans (Casa).
Pros
- Simple for non-technical families
- Owner can cancel a wrongful claim
Cons
- Depends on the provider's process continuing
- May not match your will or local law
Pitfalls
- Not telling your executor the plan exists
- Beneficiary not set up in time
More: Inheritance services
Exchange / custodial account Beginner
Easy to use, and account recovery is possible, but you depend on the company's solvency, security and policies (see Mt. Gox, FTX and Celsius). In Celsius's bankruptcy the court held that, under its terms of use, crypto in "Earn" accounts belonged to Celsius (US Bankruptcy Court). Inheritance runs through the company's death-claim process, which needs probate documents and time (Coinbase, Kraken).
Pros
- Very easy; customer support
- Account recovery if you forget a password
Cons
- Not your keys
- No FSCS (UK) or FDIC cover; SIPC only for registered securities (UK vs USA)
Pitfalls
- Leaving long-term savings on a platform
- Yield products that change who legally owns the coins
Community advice
- Read the terms: who owns the assets if the firm fails? (TechCrunch on Celsius)
More: Custody spectrum · custodial cases
Qualified / institutional custodian Intermediate
Regulated, audited and often insured custody, typically for larger sums or entities. Not your keys; minimums and fees apply. Insurance and segregation terms vary — check them in writing.
Pros
- Governance, audit and reporting
- Suits trusts and companies
Cons
- Fees and minimums
- Company and legal-process risk
Pitfalls
- Assuming insurance covers every loss
Community advice
- Ask how assets are segregated and what happens in insolvency
More: Institutional custody
MPC wallet (key shares on phone + server) Beginner
No single seed phrase to steal; signatures are computed jointly from key shares. Recovery depends on the provider: Zengo, for example, uses email plus a recovery file in your cloud storage and says it cannot help if that file is lost (Zengo), and has an escrow and trustee arrangement for a shutdown (Zengo). Unchained lists several published threshold-ECDSA flaws (2020–2023) and notes there is no agreed standard (Unchained).
Pros
- No seed to lose or photograph
- Easy, phone-based
Cons
- Proprietary; hard to audit
- Depends on provider and cloud account
Pitfalls
- Losing the cloud account
- Not knowing the provider's shutdown plan
Community advice
- Ask: "If this company vanished tomorrow, could I still recover with open-source software?" (see proprietary sharding)
Identity-based seed recovery (e.g. Ledger Recover) Beginner
Your device encrypts seed entropy and splits it into three fragments held by Ledger, Coincover and EscrowTech; recovery uses two fragments after identity checks (Ledger). It protects against loss, but adds legal-process, data-breach and identity-theft risks and is controversial with privacy-minded users.
Pros
- Recovery without paper
- Ledger says Coincover offers $50,000 compensation if funds are stolen through the service
Cons
- Monthly fee ($9.99 according to Ledger)
- Seed leaves the device (encrypted); identity-linked
Pitfalls
- Treating it as the only backup
- Availability limited to some countries and devices — check
Community advice
- Many experienced users keep an offline backup as well; see the 2023 controversy
More: Recovery services
Cutting the words into pieces yourself (anti-pattern) Beginner
Storing words 1–12 in one place and 13–24 in another, or overlapping "2-of-3" schemes, feels like Shamir but is not. Andreas Antonopoulos worked through one such scheme: each piece held 16 of 24 words, leaving about 80 bits to brute-force instead of 256 — "not 3 times easier", but 2176 times easier (transcript). Losing a piece can also make recovery impossible.
Pros
- None that a standard scheme does not do better
Cons
- Each piece leaks most of the secret
- No threshold tolerance unless overlapping, which leaks more
Pitfalls
- Believing it is "like Shamir"
Community advice
- "Don't manually split up your seed phrases" (Casa); use SLIP-39, multisig or a passphrase instead
More: Why you must not cut a phrase in half · anti-patterns · the numbers
More detail on every method: Shamir, SLIP-39 & splitting · Custody & services · Passphrases · Case files.
Physical media
| Medium | House fire | Flood | Crush | Cost | Readable by heirs | Notes |
|---|---|---|---|---|---|---|
| Plain paper (pencil/ink) | Poor | Poor | Good | Low | Good | Burns at about 230 °C and is ruined by water; fine as a temporary or secondary copy. |
| Laminated / sleeved paper | Poor | Fair | Good | Low | Good | Lamination helps with water only; it melts in a fire. |
| Waterproof 'stone' paper | Poor | Good | Good | Low | Good | Water-resistant, not fire-resistant. |
| Stamped/engraved steel plate | Good | Good | Good | Medium | Fair | Survives typical house fires; stamping takes time and care. |
| Centre-punched steel plate | Good | Good | Good | Medium | Fair | Simple single plates graded best in Lopp's tests. |
| Letter tiles in a cassette/capsule | Fair | Good | Fair | Medium | Fair | Many tile designs scattered or deformed under crush tests. |
| Aluminium or brass products | Poor | Fair | Fair | Medium | Fair | Low melting points; several such products failed heat tests. |
| SeedQR on paper or steel | Fair | Fair | Good | Low | Poor | Fast to scan into stateless signers; unreadable to people without a device and instructions. |
Based on Jameson Lopp's metal storage stress tests and manufacturer material ratings. See Physical storage.
Paper, metal plates and tile kits: pros, cons and pitfalls
| Medium | Pros | Cons | Pitfalls | Community advice |
|---|---|---|---|---|
| Paper | Free, immediate, easy to read | Burns; ruined by water | Printing from a computer; one copy only | Fine as a temporary or secondary copy; see paper |
| Stamped, engraved or punched plate | Simple single plates did best in Lopp's tests | Takes time and care to make | Anyone who finds it can read it | Upgrade to metal for meaningful sums; see metal backups |
| Letter-tile or cassette kit | Quick to assemble; no tools | Many tile designs scattered or deformed in crush tests (Lopp) | Loose tiles lost or put in the wrong order | Check the specific product's test grade in the stress-test table |
| Any medium | — | — | Home-made ciphers and obfuscation | "Don't get creative and try to obfuscate your seed backups" (Casa) |
Which method for which person Beginner Intermediate Expert
| Holding (relative to your wealth) | Beginner Beginner | Intermediate Intermediate | Expert Expert |
|---|---|---|---|
| Learning amount or pocket money | Reputable wallet; seed on paper, then a second copy (duplicates) | Hardware wallet; practise recovery on it | Use small amounts to rehearse SLIP-39 or multisig recovery |
| Meaningful savings | Hardware wallet plus two metal copies in separate places; or a collaborative or inheritance service if self-custody feels too much (collaborative) | Add a passphrase stored apart (passphrase) or SLIP-39 2-of-3 (Shamir) | SLIP-39 or multisig 2-of-3 across device makers |
| Life-changing sums | Collaborative custody (you hold 2 of 3), or a regulated custodian if you do not want to hold keys; written plan for heirs | Multisig 2-of-3 (self or collaborative) with descriptor stored with each key | Multisig across makers and locations; optional timelocked recovery (timelocks) |
| Family, trust or business treasury | Professional help: qualified custodian or collaborative custody | Collaborative custody with documented roles | Multisig with a written policy; key agents; see business scenario |
Why the beginner column leans towards services for large sums: a setup you cannot operate is itself a risk, and services such as Casa and Unchained document how you can still recover without them (Casa, Unchained). Experts are expected to verify that kind of claim themselves. See also the decision guide quiz and scenarios.
A rough rule of thumb by amount Beginner
| Holdings (relative to your wealth) | Typical setup people choose | Why |
|---|---|---|
| Pocket money | Reputable mobile wallet, seed on paper | Convenience matters more than maximum resilience |
| Meaningful savings | Hardware wallet, two metal copies in separate places; optional passphrase | Big drop in loss risk for modest cost |
| Life-changing sums | SLIP-39 2-of-3 or multisig 2-of-3 (self or collaborative) | Removes single points of failure for both loss and theft |
| Family / business treasury | Multisig with documented policy, collaborative custody or a qualified custodian | Governance, succession and auditability |
Typical choices observed, not recommendations. See which method for which person for the same bands split by skill level.
UK vs USA: what changes the comparison Intermediate
The technology works the same everywhere; what differs is the safety net around custodians, how estates reach accounts, and tax. Rows link to the deep estate guides rather than repeating them.
| Topic | United Kingdom | United States | Effect on the comparison |
|---|---|---|---|
| Compensation if a crypto firm fails | The FCA says crypto is largely unregulated and it is "highly unlikely" you will be covered by the FSCS (FCA); you generally will not have access to the Financial Ombudsman (FCA). | FDIC insurance does not cover crypto assets or the failure of non-bank crypto firms (FDIC, FDIC). SIPC "does not protect any digital or crypto asset that does not qualify as a 'security'" (SIPC, FINRA). | Custodial rows carry company risk in both countries. |
| Misleading "insured" claims | Being on the FCA register "doesn't mean you'll have access to the FSCS or the Financial Ombudsman" (FCA). | The FTC says Voyager falsely claimed FDIC insurance (FTC); see the case file. | Check insurance claims in writing. |
| Exchange accounts on death | Coinbase and Kraken both say they do not offer beneficiary designations; executors provide a death certificate, probate or letters of administration, ID and a signed letter (Coinbase, Kraken). Kraken has UK-specific pages; requirements may differ by country — check. | Custodial inheritance is "Fair": it works, but needs probate time. | |
| Crypto as property | Property (Digital Assets etc) Act 2025; Scotland's Digital Assets (Scotland) Act 2026 (UK guide) | Fiduciary access to digital assets under RUFADAA, with state variations (US guide) | Self-custody methods depend on heirs finding the keys, whatever the law says. |
| Powers of attorney | Lasting Power of Attorney (UK) | Durable power of attorney (US) | Complex self-custody is hard for an attorney to operate; document it. |
| Tax on death | Inheritance Tax (UK guide) | Federal estate tax and some state taxes (US guide) | Executors must value holdings, so a clear inventory matters for every method. |
| Safe deposit boxes | Many high-street banks have closed their services (details) | Contents are not FDIC-insured; state law governs access after death (details) | A box is one location; it does not remove the need for a second. |
| Service availability and pricing | Several collaborative services price in US dollars; Casa notes its enhanced verification is "available in the US only" (Casa). Check UK availability. | Unchained and Onramp are described on this site as US-focused (providers). | UK readers may have fewer service options; self-custody methods are unaffected. |
Community advice: where experts agree and disagree Intermediate
| Advice | Who says it | Our note |
|---|---|---|
| Never cut a seed into pieces yourself | Andreas Antonopoulos (transcript); Casa (dos and don'ts) | Widely agreed. Use SLIP-39 or multisig instead. |
| Avoid generic Shamir tools; SLIP-39 and Seed XOR are acceptable | Casa (21 tips, SSS shortcomings); Bitcoin Wiki | Disagreement on whether SLIP-39 is enough for large sums; Unchained argues for multisig at that level (Unchained). |
| Do not get creative or obfuscate backups | Casa (dos and don'ts) | Agreed; improvised ciphers are a common cause of self-inflicted loss. |
| Spreading funds across many single-sig wallets is not the same as removing single points of failure | Casa: it "decrease[s] your risk of catastrophic loss" but "increases your risk of partial loss" (Casa) | A useful reminder that more wallets mean more secrets to keep. |
| For large sums, use a threshold; no single component should be able to lose the funds | Unchained (Unchained) | Note that collaborative custody firms sell threshold products; the reasoning stands on its own, but read it with that in mind. |
| Keep the wallet configuration or descriptor with your keys, and test recovery without the provider | Unchained (config file); Casa (shutdown FAQ) | Agreed across self-custody and collaborative models. |
| MPC is "more complicated, more to get wrong" | Adam Back, quoted by Unchained (Unchained) | MPC providers argue the opposite on usability and flexibility; the published key-extraction flaws listed by Unchained are a matter of record. |
| Identity-based recovery suits people likely to lose paper | Ledger (Ledger) | Strongly disputed by privacy-minded users; see the controversy. |
Anti-patterns: setups that look clever but fail Beginner
| Anti-pattern | Why it fails | Do instead |
|---|---|---|
| Cutting words into halves or overlapping thirds | Each piece leaks most of the seed; a 16-of-24-word piece leaves about 80 bits to guess (details) | SLIP-39, multisig or a passphrase |
| Photo, cloud note or password manager copy of the seed | Digital copies have been stolen at scale (case files) | Offline paper or metal only |
| Home-made ciphers, word shuffles or "secret" substitutions | Easy to forget; checksums make many tricks easy to reverse (Casa) | A BIP-39 passphrase stored apart |
| Every copy, share or key in one building | One fire, flood or burglary defeats the scheme | Separate locations |
| Seed XOR or a passphrase with no duplicate of each part | Loss of one part is total loss | Duplicate every part; test recovery |
| Multisig without the descriptor | Enough keys may still not rebuild the wallet | Descriptor backups |
| Long-term savings in an exchange yield product | Terms may make the coins the firm's property in insolvency (Celsius) | Read the terms; consider self-custody or segregated custody |
| A setup nobody else knows exists | Heirs cannot claim what they cannot find (loss cases) | Letter of instruction |
Expert: Shamir vs multisig vs MPC Expert
All three create an m-of-n threshold, but they enforce it in different places. This table summarises Unchained's comparison (Multisig, Shamir's secret sharing & MPC compared, updated April 2026) together with the SLIP-39 specification (SLIP-39). Unchained sells multisig products, so read its conclusions with that in mind.
| Property | Shamir (SLIP-39) | Script multisig | MPC / threshold signatures |
|---|---|---|---|
| Where the threshold is enforced | Key level (off-chain) | Bitcoin script (on-chain) | Key level (off-chain) |
| Is the full key ever in one place? | Yes — at creation and at every recombination | No | No (shares sign jointly) |
| Changing who holds shares or keys | Old shares cannot be revoked; move funds to a new wallet | Move coins to new addresses (fees) | Most implementations can reshare without moving funds |
| On-chain visibility | Looks like single-sig | Policy revealed when spent (Taproot can hide unused paths) | Looks like single-sig |
| Multi-coin | Yes | Per chain; some chains lack native multisig | Yes |
| Standards and maturity | Published SLIP-39 standard | In wide use since the P2SH soft fork (2012) | No agreed standard; first practical threshold-ECDSA protocols 2018 |
| Published key-extraction flaws | Not documented for SLIP-39 itself | Not documented for the script mechanism | AS20 (2020), Alpha-Rays (2021), TSSHOCK and BitForge (2023) in some protocol implementations |
| Recovery if the vendor disappears | Any SLIP-39 wallet | Open coordinators (Sparrow, Caravan, Electrum) with the descriptor | Depends on the provider's arrangements (Zengo: escrow trustee) |
Combining methods. Unchained describes multisig where each key-holder (for example a company acting as key agent) protects its own key with Shamir or MPC, so that a flaw in one layer does not immediately expose funds. For physical combinations — metal plates for each SLIP-39 share or multisig seed — see combining metal backups.
Migrating later. Moving from one method to another generally means creating the new wallet, testing recovery, then sending the coins across, rather than converting the old backup in place. Old backups of the previous wallet remain valid for anything left on it, so empty the old wallet fully and destroy or label its backups.
Where to go next
| If you want to… | Read |
|---|---|
| Create a seed with good randomness | Randomness: confidence ladder · generation methods compared |
| Choose a backup material and location | Materials · stress tests · physical threat matrix |
| Choose a signing device | Hardware wallet matrix · advisories |
| Understand SLIP-39, Seed XOR and multisig in depth | Shamir, SLIP-39 & splitting |
| Compare custody providers | Custody & services · directory |
| Plan for death or incapacity | UK estate guide · US estate guide · rest of the world |
| Learn from failures | Case files · patterns across cases |
Last reviewed: · Educational information only — verify current details with official sources.