The Bitcoin Inheritance Runbook

The same secrecy that protects your keys while you're alive makes them unreachable when you're gone — an estimated 3–4 million BTC are lost forever, mostly to exactly this. The fix isn't writing your seed down in more places. It's a runbook.

The one rule: map, not vault

The plan never contains a seed phrase, a passphrase, or a PIN. It records where each secret lives ("metal plate, home safe, bottom drawer"), what it unlocks, and who may help. If the plan leaks, the attacker learns your filing system — not your keys. If it's found by the right person, it's exactly enough.

What to document (all pointers, no secrets)

• Every wallet — hardware model, roughly what it holds ("most of it" beats numbers that go stale), and where the device is.
• Every seed backup — its location, its format (paper, steel), and whether a passphrase (the "25th word") exists. Say THAT it exists and where it lives — never what it is.
• The setup type — single-sig, multisig (which quorum, which key is where), or a timelock/inheritance product. Include wallet fingerprints and the descriptor's location: with them, recovery is mechanical; without them, it's forensics.
• The helper — the one technically competent person (or paid service) your heir should do this WITH, and how to verify it's really them (see the Trusted-Helper Protocol).

The rules your heir must know

• There is no customer support. No reset, no undo. That is why nothing is done alone or quickly.
• Nobody legitimate ever asks for seed words. Not the helper, not "Ledger support", not a lawyer. Anyone who does is a thief, full stop.
• Recovery happens on a clean machine, with wallet software downloaded from the official site and verified — the helper knows what this means.
• A wrong passphrase doesn't fail — it opens an empty wallet. If balances look wrong, nothing was lost; pause and re-check with the helper.
• Verify addresses on the device's screen, never only on the computer.

Design out the single points of failure

• One seed in one house is one fire away from zero. Two geographic locations, minimum.
• If the amount justifies it, consider collaborative multisig or an on-chain timelock — inheritance that doesn't depend on any one company (or on us) existing.
• Whatever you choose: test it. A dry run with your heir finds the broken assumption while you can still fix it.

Keep it alive

Wallets migrate, devices get replaced, helpers move away. Review this runbook once a year — the app nudges you when it goes stale — and re-export after every change. A stale runbook is false comfort with a timestamp.