Inheritance and Self-Custody: The Failure Nobody Designs For

Self-custody security is designed against one threat: someone other than you gaining access. Executed well, it produces an arrangement where exactly one person can move the funds. Death converts that from a feature into a permanent loss, and it is the one scenario in the threat model with a probability of one.

Why the obvious answer is wrong

The instinct is to put the seed phrase in a will. This fails on two counts.

In many jurisdictions a will becomes a public record once probate begins. A seed phrase written into it is a secret with a publication date, and anyone reading the file can empty the wallet before the estate is settled.

Even where a will stays private, probate takes months. A seed phrase sitting with a solicitor for that period is accessible to more people than you would choose, and the arrangement gives you no way to know if it has been read.

The correct pattern separates the instructions from the secret. The will, or a letter alongside it, says that assets exist, where the access mechanism lives and who to contact. The secret itself sits somewhere the will does not reach.

Four arrangements that work

A sealed instruction with a custodian. The seed sits in a sealed envelope with a solicitor or in a safe deposit box, and the will directs the executor to it. Simple, uses existing legal machinery, and depends entirely on the custodian's integrity and continued existence.

Multisig with a third key held by counsel or a service. Two of three where you hold two keys and a professional holds one: you can transact alone, your heirs can reconstruct with the professional's key plus one of yours, and the professional alone can do nothing. This is the arrangement that best matches how estates actually work, and it requires the descriptor to be documented alongside.

Split secrets across trusted parties. Divide the seed so that a threshold of holders can reconstruct it and no individual can act alone. Powerful in principle, and it fails when the holders lose their shares, do not know they hold something important, or cannot be located.

A time-locked or dead-man arrangement, where a transfer becomes possible only after a period without activity. Elegant, and it introduces a dependency on a mechanism that has to keep working for years without your attention, which is a real risk in a young industry.

The part everyone skips: the instructions

The technical arrangement is usually the easy half. The harder problem is that whoever inherits will very likely not know what any of it means.

An executor holding a seed phrase and no context does not know it is a seed phrase, what software restores it, what a derivation path is, or that entering the words into the first website that offers to help is the worst available option — and that website is well optimised for exactly this search.

The document that matters is therefore a plain-language one: what exists, roughly how much, which device, which software, where the backup is, whether a passphrase is in use, and step by step what to do. Written for someone who has never used crypto, because that is who will read it.

It is also the document most likely to be out of date, because holdings and arrangements change and the letter does not. Reviewing it on a schedule is the unglamorous half of the work.

Testing it

An inheritance plan that has never been rehearsed is a hypothesis. The test is whether a non-technical person can, following only the written instructions and without asking you anything, locate the access mechanism and describe what they would do.

You do not need to hand over real funds to run that test. Set up a small wallet under the same arrangement, give someone the instructions, and see how far they get. The failures found this way are consistently mundane — a missing derivation path, software that no longer exists, an instruction that assumed knowledge — and every one of them would have been permanent.

• Does anyone know the assets exist. This is the failure mode where funds are lost without anyone ever looking for them.
• Are the instructions separate from the secret, so the will can be public without exposing it.
• Would a non-technical reader know what to do, including what not to type into a website.
• Is a passphrase in use, and does the plan mention that one exists even if the value is held elsewhere.
• Has someone actually rehearsed it on a test wallet.

The uncomfortable framing is the useful one: you are designing a system whose security requirement inverts on a specific date, and the date is not scheduled.