A seed backup is a bearer instrument. Whoever finds it owns the funds. Most advice stops at “write it down and keep it safe”, which is the part that fails first: one location loses to fire, water and burglary, and the two convenient upgrades, a photograph and a metal plate, each fail in their own way. The design that holds is split, offline, and tested before it protects a real balance.
The failures, in the order they happen
Fire and water
A house fire and a burst pipe are one event for a paper backup. Both destroy a location and neither leaves time to retrieve anything. A safe rated for documents helps with fire and not with flood, and few read the rating before buying.
The burglar takes the container
The second failure is quieter. A thief who takes the safe, the drawer or the filing box takes the backup, and a seed needs no key to spend. Storing it next to the device is the version everyone believes they are too clever to do.
The photograph is the one that fails silently
Photographing a seed feels like redundancy, and technically it is. The problem is where the photograph goes. Camera rolls sync to a cloud account by default, within seconds of the shot. From there the image joins the account backup, the family sharing group, the desktop photo library and whatever third party app was granted library access.
Nothing about this is visible. There is no notification when a picture of 24 words is uploaded, indexed and retained in a version history. Account takeover, a shared album link, a forgotten old phone: any of those now includes the seed. It works until it is the reason funds are gone, which makes it the worst of the set.
Metal fixes durability, not secrecy
A stamped steel plate survives fire, flood and a decade in a drawer. It does not survive a visitor who knows what 24 stamped words mean. Metal plates are recognisable, often labelled, and frequently sold with a holder that announces its purpose.
Two adjustments help. Leave the plate unlabelled and store it somewhere that is not obviously a safe, and treat the plate as one share rather than the whole secret. Durability is a property of the material. Secrecy is a property of the layout.
What splitting actually buys
Splitting turns one object into several, and the value depends on how you split it.
Shamir shares
A 2-of-3 scheme generates three shares, any two of which rebuild the seed. No single location holds a secret, a burglar who finds one share has nothing usable, and losing one location is survivable. The cost is tooling: a generator you trust, a documented threshold, and a record of which share is where.
Halves of a word list
Splitting 24 words into two sets of 12 is simpler and needs no software. One half alone does not reconstruct the wallet, so a single theft is not fatal. The failure is correlation: lose either half and the wallet is gone, so the scheme has the same availability as a single copy while doubling the number of places that must survive.
| Method | Survives a fire at one site | Survives a thief who knows crypto | New way to lose everything |
|---|---|---|---|
| Paper in a drawer | No | No | Any single event at that address |
| Photo in the camera roll | Yes | No | Cloud account takeover |
| Encrypted file in email | Yes | Partly | Forgotten password, provider lockout |
| Metal plate at home | Yes | No | A visitor who reads it |
| Two halves, two addresses | Partly | Partly, one theft only | Losing either half |
| Shamir 2-of-3, three addresses | Yes | Yes, below two shares | Losing two shares |
Test once, before the size is real
An untested backup is a hypothesis, and the test belongs before the balance matters. Restore the seed on a spare device or an offline software wallet, confirm the derived address matches the funded one, then wipe it. Send a small amount, spend it, restore again. That proves the words, the derivation path and your ability to follow the procedure.
The test is cheap next to the position. Moving an ERC-20 token on Ethereum L1 cost $2 to $10 in FeeEdge’s 17 August 2026 sample, and the same transfer on Base costs a fraction of a cent per Ethereum.org’s 1 to 6 October 2026 snapshot. The stablecoin float was $292.40B in October 2026, per this board’s data pack, and much of that supply sits behind one piece of paper.
What to do next
Write the location map, not the words. The map says which share is in which city and who else knows the procedure. It never contains a word of the seed.
Pick the number of locations from the size, not from enthusiasm. Below a few months of expenses, one hidden offline copy is proportionate. Above that, split, and keep the savings balance smaller than the backup procedure can carry.
Then put a date in the calendar, once a year, to confirm every location still exists. Houses are sold and safes are moved.
0 comments
No comments yet — ask a question and we will answer it here.