Scenarios & threat models
There is no single best setup — only the best fit for your amounts, skills, family and threats. Below are fictional example plans with step-by-step instructions. Adapt, don't copy blindly. People in these examples are invented.
Last fact-checked 24 October 2026 (time-sensitive claims re-checked against the linked sources).
Threat model matrix
| Threat | Single seed, one place | Seed + copy in 2 places | Seed + passphrase apart | SLIP-39 2-of-3 | Multisig 2-of-3 |
|---|---|---|---|---|---|
| Fire / flood at home | Lost | Survives | Only if each duplicated | Survives | Survives |
| Burglar finds one backup | Stolen | Stolen | Safe | Safe | Safe |
| Malware / compromised signing device | Stolen | Stolen | Usually stolen | Stolen | Safe |
| You die suddenly | Depends on letter | Depends on letter | Often lost | Needs plan | Needs plan + descriptor |
| Incapacity (illness) | Attorney needs access | Same | Often lost | Plan | Plan |
| Coercion ("$5 wrench") | Vulnerable | Vulnerable | Decoy possible | Can't sign alone if shares remote | Keys elsewhere = can't comply |
Plan 1 — "Ana", first hardware wallet, modest sum Beginner
Goal: survive one disaster, keep it simple.
- Buy one hardware wallet direct from the maker. Generate a 24-word BIP39 seed on the device.
- Write the seed on the paper card; copy to a stainless steel plate.
- Steel plate in a home safe; paper copy sealed at a parent's house (in a sealed, signed envelope).
- Test recovery. Record first address in a notebook (not secret).
- Write a one-page letter of instruction; give to the executor named in her will.
Home
Device + steel plate (safe)
Parent's house
Paper copy, sealed
Will file
Letter of instruction (no words)
Weakness: anyone finding either copy can steal funds. Acceptable at small amounts; upgrade later.
Plan 2 — "Ben", serious savings Intermediate
Option A — seed + passphrase:
- 24-word seed on steel in a home safe; duplicate steel in a safe deposit box.
- Strong passphrase (e.g. 5–6 random dictionary words) on a separate steel tag at his sister's home, and a second copy with his solicitor in a sealed envelope.
- Empty-passphrase wallet holds a small decoy amount.
- Test both wallets; record the passphrase wallet's fingerprint.
Option B — SLIP-39 2-of-3 (Trezor): share 1 at home, share 2 in a bank box, share 3 with his sister. Any one location can be lost or compromised.
Home
Share 1 (steel)
Bank box
Share 2 (steel, tamper bag)
Sister (another city)
Share 3 (steel)
Plan 3 — "Chen", high net worth Expert
- 2-of-3 (or 3-of-5) Bitcoin multisig with three different device vendors.
- Seeds generated with added dice entropy (see entropy); each seed on steel.
- Key A at home, key B in a private vault in another region, key C with a collaborative-custody provider or a professional trustee.
- Wallet descriptor printed and stored with every key, plus an encrypted digital copy.
- Annual recovery drill; quarterly tamper-bag checks.
- Trust or estate structure coordinated with a specialist adviser; privacy measures (no public discussion of holdings, PO box for deliveries).
Plan 4 — family / couple Intermediate
A couple wants either spouse to manage funds if the other dies, without either being able to lose everything alone.
- 2-of-3 multisig: key 1 (spouse A), key 2 (spouse B), key 3 (solicitor or collaborative-custody provider).
- Both spouses practise signing together twice a year.
- Letter of instruction describes the setup for adult children/executor.
- Consider jointly held legal ownership or trust (see UK / US guides).
Plan 5 — business / charity treasury Expert
- Multisig (Bitcoin) or Safe smart account (EVM) with signers from different officers, e.g. 3-of-5.
- Written signing policy: who signs, limits, dual verification of addresses via a second channel.
- Signers verify every transaction on hardware screens — no blind signing (lesson of the 2025 Bybit theft).
- Off-boarding procedure: rotate keys when a signer leaves (the Ledger Connect Kit incident began with an ex-employee's unrevoked access).
- Or use a regulated custodian; document board approval; audit trail for accountants.
Plan 6 — frequent traveller Intermediate
- Never travel with seed backups. Travel with a hardware wallet that holds only a spending wallet, or nothing (restore on arrival only if necessary).
- Stateless signers (SeedSigner, Jade stateless) hold nothing at border checks.
- Main savings stay in a multisig or SLIP-39 setup at home locations.
- A decoy passphrase-less wallet with a plausible small balance on the travel device.
Single-location vs geo-distributed
| Item | Single location | Geo-distributed (2–3 sites, different towns) |
|---|---|---|
| Fire, flood, burglary | All copies at risk together | Independent |
| Convenience | High | Lower — travel to sign or recover |
| Heirs' recovery | Easy to find | Needs clear map in letter of instruction |
| Coercion | Attacker can force access | "I physically can't" is genuine |
Death, incapacity & coercion Expert
- Death: see estate planning.
- Incapacity: a Lasting Power of Attorney (England & Wales), continuing power of attorney (Scotland) or durable power of attorney (US) gives legal authority, but your attorney still needs a practical, documented way to access keys.
- Coercion: physical "wrench attacks" are documented worldwide (Lopp's list). Defences: privacy (don't advertise holdings), geographic key separation, decoy wallets, duress PINs (COLDCARD), timelocks, and home security. Your life is worth more than any coins — comply if threatened.
More worked scenarios: what to do and what not to do
The people below are invented (illustrative only), but the rules and procedures are quoted from official sources. New on 24 October 2026: burglary, moving house, a call after a data leak, a US flood and a partner's incapacity. Nothing here is legal or tax advice; laws differ between the UK nations and between US states.
| Situation | First priority | Biggest mistake | Level |
|---|---|---|---|
| House fire or flood | People first, then confirm your off-site copy | Assuming a missing backup was destroyed | Beginner |
| Device or phrase compromised | Move funds to a new phrase at once | Keeping the old phrase "with a new passphrase" | Beginner |
| Forgotten passphrase | Rule out simpler causes and list candidates offline | Paying a "recovery" service that contacted you | Intermediate |
| Executor for a solo holder | Secure everything and get legal authority | Guessing PINs until the device wipes | Intermediate |
| Separation or divorce | Full disclosure through your lawyer | Moving or hiding coins | Intermediate |
| Travel and border checks | Carry no backups | Refusing or lying to officers | Intermediate |
| Moving between the UK and US | Tax advice in both countries before you move | Leaving keys somewhere you can no longer reach | Expert |
| Burglary at home | Check whether the backup is accounted for | Leaving funds on a phrase a burglar may have seen | Beginner |
| Moving house (UK and US) | Carry backups yourself; redirect post | Packing the only backup in a removal box | Beginner |
| A convincing call after a data leak | Hang up and contact the firm yourself | Moving coins to a "safe" address | Beginner |
| Hurricane or flood (US) | Check copies in different places | Assuming a bank box is insured | Beginner |
| Partner loses capacity (UK and US) | Legal authority first, then technical access | Using the partner's PIN or words without authority | Intermediate |
House fire or flood: "Dev" Beginner
Dev's kitchen fire destroys the ground floor. His hardware wallet and steel plate were in a home safe; a paper copy is at his sister's flat across town.
Do
- Get everyone out and let the fire service work. No backup is worth going back in for.
- Once safe, confirm that the off-site copy still exists, without moving it in a hurry.
- If the home copy is unaccounted for rather than clearly destroyed, treat it as exposed: firefighters, salvage contractors and insurers may handle the debris. Set up a new wallet on a new device and move the funds (Ledger's change-your-phrase procedure sets out the steps).
- If it was clearly destroyed, restore on a replacement device bought from the maker, check the first address against your records, then make a new second backup and put it in a new location.
- Afterwards, check how your media performed against published tests (stress tests, fire).
Don't
- Don't photograph the surviving copy or type it into a phone "to be safe".
- Don't buy a replacement from a marketplace in a rush (see the second-hand device case).
- Don't leave the only remaining copy in a temporary place for months.
Sources: Ledger: change your recovery phrase, Lopp metal tests, 2025 wildfires
Tax after a theft or loss: in the UK, losing a key is not a disposal and a negligible value claim may be possible (CRYPTO22400); in the US, see lost or stolen crypto. Take professional advice before claiming.
Device or phrase compromised: "Gita" Beginner Intermediate
Gita typed her recovery phrase into a "wallet sync" page she reached from a search advert. A day later she realises it was phishing. Some funds are still there.
Do
- Act immediately. Using the hardware wallet, send everything to an account that comes from a different recovery phrase. Ledger advises sending tokens first, then native coins such as ETH, so that fees can be paid.
- Reset the device and set it up as new, which generates a new phrase. Write it down offline, test it, then move the funds back.
- Remove the old, empty accounts from the app so you do not pay into them by mistake.
- If malware on a computer was the cause, do not set up the new wallet with that computer (see the Luke Dashjr case).
- Report it: in England, Wales and Northern Ireland to Report Fraud, in Scotland to Police Scotland, and in the US to the FBI's IC3 (see if your phrase is exposed).
Don't
- Don't keep using the old phrase with a new passphrase added. Whoever has the words can try passphrases; start again with a new phrase.
- Don't answer people who offer to "recover" stolen funds. The FBI warns that recovery fraudsters charge upfront fees and may claim links to law enforcement (IC3, 2023).
- Don't destroy old backups until the new set is tested.
Sources: Ledger: change your recovery phrase, FBI IC3 recovery-scam PSA, start here: compromised, exposed-seed checklist
Forgotten passphrase: "Femi" Intermediate
Femi set a BIP39 passphrase three years ago. Today his 24 words open a wallet with only a small balance, and none of his guesses work.
Do
- First rule out simpler causes: right standard, address type, account and path (see restore checks).
- Write every candidate on paper, offline: capitals, spaces, keyboard layout, autocorrect and old password habits.
- Use a recorded fingerprint or first address to recognise the right wallet when you find it.
- If you remember most of it, the open-source BTCRecover can test variations. Its authors say passphrase recovery is mainly useful when you have a reasonable idea of what it was. It needs your seed, so run it only on an offline computer, and move the funds to a new seed afterwards.
- If you consider a professional service, you are handing over your seed: check who they are independently and get references.
Don't
- Don't expect the maker to help. Trezor states that passphrases cannot be changed, removed or recovered (Trezor).
- Don't share your seed or guesses with anyone who contacts you offering help; fake recovery firms and fake law firms target people who have lost crypto (IC3, 2024).
- Don't test guesses in a hot wallet on an internet-connected phone.
Sources: Trezor passphrase guide, BTCRecover, FBI IC3 fake law firms PSA
Executor for a solo holder: "Harriet" Intermediate
Harriet is executor for her brother, who held bitcoin alone. She finds a hardware wallet, a notebook and a sealed envelope, but no letter of instruction.
Do
- Secure everything together and privately: devices, papers, notebooks, phones and computers. List what you found on the inventory.
- Get legal authority before moving anything: probate in England, Wales and Northern Ireland, confirmation in Scotland, and letters testamentary or letters of administration in the US (see UK, US).
- Have two people present when envelopes are opened, and record what happens.
- Value holdings at the date of death for tax (see HMRC on crypto, US tax).
- Once authorised, move funds to a wallet with a new phrase controlled for the estate, then distribute.
Don't
- Don't guess PINs. Ledger devices reset after three incorrect PINs (from Ledger's reset guidance); other devices have similar limits. The words, if found, still work; the PIN does not matter for recovery.
- Don't type any words you find into a website, a phone app or an online computer.
- Don't throw away old phones, computers or papers until a specialist has checked them.
- Don't use a "recovery company" that approached you (FBI IC3).
Sources: estate planning, a UK family that gave up, Ledger reset guidance, FBI IC3
Separation or divorce: "Ian and Jo" Intermediate
Ian and Jo are separating. Jo set up the wallet; Ian knows where one backup is kept and once saw the words.
Do
- Disclose. In England and Wales, financial remedy cases use Form E, which requires "full, frank and clear disclosure" of all assets. Form E has no dedicated crypto box, so holdings go under other assets (section 2.14 in the version on GOV.UK) (Form E). Scotland and each US state have their own procedures, so ask a family lawyer where you live.
- Evidence balances without exposing keys, for example with a watch-only wallet or exported transaction history, given through your lawyer.
- Agree in writing how crypto will be valued: date, price source and who pays fees.
- After the final order, the person keeping the funds should move them to a new phrase the other person never saw. Update wills, LPAs, letters of instruction and any collaborative-custody key holders.
Don't
- Don't move, hide or "lose" coins to defeat a claim. Public blockchains record transfers, and Form E warns that a false statement can lead to proceedings for contempt of court.
- Don't rotate keys or change backups mid-proceedings without asking your lawyer first.
- Don't hand your seed to the other side or their lawyer: disclose holdings, not keys.
Sources: Form E (GOV.UK), key rotation
Travel and border checks: "Kofi" Intermediate
Kofi flies from Manchester to New York for work and wonders whether to take his hardware wallet.
Do
- Travel with no seed backups at all, and with a device holding only spending money or nothing (see plan 6).
- Know the UK rules. Under Schedule 7 of the Terrorism Act 2000, examining officers at ports can question travellers, who must give any information requested. Wilfully failing to comply, or obstructing an examination, is an offence (legislation.gov.uk). In 2017 a campaign group director was convicted for refusing to give his phone PIN and laptop password at Heathrow; the High Court dismissed his appeal in 2018 (BBC, BAILII).
- Know the US rules. CBP says travellers must present devices in a condition that allows examination. A device that cannot be inspected because of a passcode or encryption may be detained, although US citizens will not be refused entry for that reason (CBP).
- If you need keys at the destination, consider a stateless signer and restore only if necessary.
Don't
- Don't carry seed words, passphrases, or photos or notes of them, on paper, your phone or in the cloud.
- Don't lie to or obstruct border officers.
- Don't rely on decoy wallets to mislead officials; that carries legal risk. Decoys are meant for criminals, not lawful checks.
Sources: Terrorism Act 2000 Sch. 7, BBC: Rabbani, CBP: border search of electronic devices
Moving between the UK and US: "Lena" and "Marcus" Expert
Lena, a UK resident, is moving to Boston for five years. Marcus, a US citizen, is moving to London.
Do
- Take tax advice in both countries before the move. HMRC treats exchange tokens as located where their beneficial owner is resident (CRYPTO22600).
- UK leavers: under the temporary non-residence rules, if you return within five years, some gains made while abroad can be taxed in the year you come back (HMRC HS278).
- US citizens: you remain taxable on worldwide income wherever you live (IRS). FinCEN Notice 2020-2 said that a foreign account holding only virtual currency is not currently reportable on the FBAR, but FinCEN intends to change this, so check each year. When this site re-checked on 24 October 2026, FinCEN's FBAR page still listed that December 2020 notice as its latest item on virtual currency (FinCEN FBAR page). An account that also holds reportable assets, such as cash, is a different matter (FinCEN).
- Before you go, export transaction histories and cost records from every exchange, decide which backup sites stay and which move, and update the letter of instruction with new sites and advisers.
- Check whether your will and powers of attorney work in the new country (see cross-border pitfalls).
Don't
- Don't carry backups across the border; move them separately or create new ones after you arrive (see border checks).
- Don't leave a key in a safe deposit box you can no longer reach quickly (see deposit boxes).
- Don't assume leaving the UK ends UK tax on gains, or that leaving the US ends US tax for a citizen.
Sources: HMRC CRYPTO22600, HMRC HS278 (2026), IRS: citizens abroad, FinCEN Notice 2020-2
Burglary at home: "Nadia" (UK) Beginner
Illustrative: Nadia is invented. Nadia returns home to find a break-in. Her hardware wallet is gone from a drawer. Her recovery words were on a card in a home safe, which is unopened. A steel copy is at her brother's house.
What goes right
- The device is PIN-protected, so the thief cannot simply use it
- The words were not with the device, and a second copy is elsewhere
- She reports the burglary to the police and keeps the crime reference for her insurer
What could go wrong
- If the safe had been opened, or the card was in the drawer, the words must be treated as exposed: set up a new phrase on a new device and move everything (Ledger's change-your-phrase steps)
- The FDIC notes that a burglar can more easily break into a home safe than into a bank's safe deposit box (FDIC)
- Talking about the loss online can attract "recovery" scammers (see recovery scams)
Even if the backup seems untouched, some people choose to move to a new phrase anyway once a stranger has been in the house. That is a judgement call, not a rule.
Moving house: "Owen" (UK) and "Maya" (US) Beginner
Illustrative: both are invented. Owen is moving within England; Maya is moving from Ohio to Arizona. Each has a hardware wallet, a metal backup and a paper inventory.
Do
- Carry the device and backups yourself; do not pack them in removal boxes
- Redirect post. Royal Mail offers redirection for 3, 6 or 12 months and says it reduces the risk of ID fraud (Royal Mail). USPS says financial institutions generally do not allow forwarding of sensitive documents, so you must tell them your new address yourself (USPS)
- Update the letter of instruction and inventory with the new storage locations
- Change the delivery address on accounts with the wallet maker or exchange, so any genuine notices reach you
Don't
- Don't leave a backup hidden in the old house "for now"
- Don't write "crypto backup" on any box or label
- Don't move the off-site copy at the same time as the home copy; move one, check it, then the other
Royal Mail prices and periods as shown on its page on 24 October 2026.
A convincing call after a data leak: "Sam" (US) Beginner
Illustrative: Sam is invented; the leaks are real. Sam gets a call from "Coinbase security". The caller knows his name, address and roughly what he holds, and says his account is under attack and he must move his coins to a "safe wallet".
Do
- Hang up, then open the exchange's official app or site yourself and check for messages
- Remember that leaked data makes scammers sound genuine: Coinbase disclosed in May 2025 that bribed contractors had copied customer data used in impersonation calls (Coinbase SEC filing); Ledger's 2020 leak exposed names, addresses and phone numbers (Ledger)
- Report the call: in the US to the FTC or IC3; in the UK to Report Fraud (see reporting)
Don't
- Don't move coins to an address someone gives you
- Don't read out codes, passwords or recovery words
- Don't install remote-access software at a caller's request
Hurricane or flood: "Rosa" (US) Beginner
Illustrative: Rosa is invented. Rosa lives on the Gulf Coast. Her metal backup is in her bank's safe deposit box and a paper copy is in a home safe. A storm floods both the town centre and her street.
What goes right
- Metal survives water far better than paper (see stress tests)
- The hardware wallet, if lost, can be replaced from either copy
What goes wrong
- Both copies were in the same town, so one storm reached both
- The FDIC says no safe deposit box or home safe is completely protected from theft, fire or flood, suggests resealable waterproof bags, and notes that money outside a deposit account is not protected by FDIC insurance (FDIC)
- Bank branches may be closed for some time after a disaster
Lesson: geographic separation means far enough apart that one regional event cannot reach every copy (see single-location vs geo-distributed).
Partner loses capacity: "Priya and Tom" (UK) and "Lee" (US) Intermediate
Illustrative: all are invented. Tom has a stroke and cannot manage his affairs. Priya knows he has a hardware wallet but not where the backup is. In the US, Lee's wife is in the same position.
- UK legal authority. A property and financial affairs lasting power of attorney lets an attorney manage money and property. It must be registered with the Office of the Public Guardian, which GOV.UK says takes 8 to 10 weeks if there are no mistakes, and costs £92 unless a reduction applies. An LPA made this way is legally binding only in England and Wales; Scotland and Northern Ireland have their own systems (GOV.UK). If Tom never made one, it is too late: GOV.UK says the donor must have mental capacity when making an LPA, so another legal route is needed: in England and Wales usually an application to the Court of Protection to become a property and financial affairs deputy, in Scotland a guardianship or intervention order, and in Northern Ireland a controller (GOV.UK; fees and steps in the UK guide's deputyship section). Take legal advice.
- US legal authority. A durable power of attorney survives incapacity; see the US guide.
- Technical access. Legal authority does not reveal where the backup is. Without Tom's inventory or letter of instruction, Priya may hold the power but not the keys.
- Post. Royal Mail and USPS both handle redirection for someone else through special procedures that require proof such as a power of attorney (Royal Mail, USPS).
What goes right when planned
- A registered LPA or durable POA, plus an inventory that says where backups are in general terms
- A multisig set-up where a trusted second keyholder can help without a single secret
What goes wrong when not
- Guessing a PIN until the device wipes
- Using someone's words without legal authority, which can cause legal problems even with good intentions
Sources for the new scenarios: GOV.UK: lasting power of attorney · Royal Mail: redirection · USPS: forwarding mail · FDIC: safe deposit boxes and home safes · Coinbase SEC filing · Ledger breach FAQ.
See also sources: core guides and the core guides FAQ.
Last reviewed: · Educational information only — verify current details with official sources.