Seed phrase storage: the weak point that decides who keeps your coins The attack on Coldcard devices, running since the end of July, has steered the debate towards manufacturers, firmware and
The attack on Coldcard devices, running since the end of July, has steered the debate towards manufacturers, firmware and supply chains. Where a wallet backup actually sits, and in what condition, has barely come up. For most retail investors, that is the more practical question.
Coinkite, the manufacturer, set out the issue itself in its security advisory of July 30, 2026: funds from affected seeds are at risk unless the seed rests on at least fifty independent dice rolls thrown in private. That is a statement about how a seed comes into being, not about how it is stored. It leads to the same place all the same. A seed is a piece of information whose value depends entirely on who knows it. The scale of the damage remains open; estimates in the first days of August ranged between $86 million and more than $130 million, depending on the survey and the cut-off date. We described the case and the manufacturer question in our assessment of the Coldcard attack.
This article deals with the other half of the problem: how to store those twelve or twenty-four words so that they survive a house fire, a burglary, a house move and fifteen years of time. Which devices even qualify for the job is set out in our hardware wallet comparison.
The words are not passwords, and they are no shorthand for account access either. They are a readable encoding of a random number. Grasp that, and better storage decisions follow almost automatically.
The standard behind it is called BIP-39. It defines a list of 2,048 words, which means every word carries exactly eleven bits. The length of a phrase therefore reveals the underlying entropy directly: 128 bits give twelve words, 160 bits fifteen, 192 bits eighteen, 224 bits twenty-one and 256 bits twenty-four words.
Some of those bits carry no random information at all. They form a checksum, which BIP-39 builds from the first ENT/32 bits of the SHA256 hash of the entropy. In practice that means a phrase with one word copied down wrongly is rejected as invalid by any correctly implemented wallet, instead of quietly opening an empty wallet. A transcription error therefore shows up at the first recovery attempt, and not years later.
The derivation is laid down as well: PBKDF2 with HMAC-SHA512, 2,048 iterations, the string "mnemonic" followed by an optional passphrase as the salt, and 512 bits as the result. Two consequences follow from this that matter considerably for storage.
First, recovery needs no device from any particular manufacturer. Anyone holding the words reconstructs the seed with any software that implements the standard. That is the real insurance against a manufacturer disappearing from the market. Second, there is no confirmation prompt and no undo button. Whoever knows the words is the owner.
Before turning to materials and methods, a sober list of the ways a backup gets lost is worth having. Measures against one of them routinely raise the risk of another.
Almost every hardware wallet ships with a cardboard card on which the words are meant to be noted down. For the first day that is fine. As a permanent solution, paper has a second weakness alongside the familiar physical one, and it is considered far less often: the writing itself. Ballpoint ink fades depending on how much light reaches it, and handwriting turns ambiguous after years, particularly with words that resemble one another. The BIP-39 list is built so that the first four letters are unique, but that only helps as long as they stay legible.
Anyone staying with paper should write in block capitals with an archival pen and number the sequence. The real safeguard, however, is a second copy in a different place, not the material.
Metal backups have been the standard advice for years, and the advice is sound. Yet "steel" says nothing about quality. The differences between designs are considerable, and some products fail at precisely the scenario they are sold against.
The most usable public data on this is the open-source project metal-bitcoin-storage-reviews by Jameson Lopp, which has assessed backup devices to a consistent method for years. The results are condensed into three grades: one for heat, one for corrosion and one for crushing. That split makes sense, because a device can be excellent in one category and useless in another.
Two patterns run through the evaluation. Plate designs that hold the information through holes or punched patterns in solid material score well throughout. Designs that rely on sealing, coating or inserted carriers fail heat and corrosion tests unusually often. What is missing from the metal itself can burn off or come away.
A ranking follows from that for practical purposes. Ahead are the methods that remove or deform material, meaning punching, stamping with letter punches and deep engraving. Behind them come systems with individual letter tiles, which are heat-resistant but can shift when dropped or crushed. At the end sit all the variants where the writing merely rests on the surface.
After this week, that strikes us as the more important criterion: what decides the matter is not whether a backup is made of metal, but whether the information sits in the metal or only on it. Anyone who already owns a plate can check that in two minutes by running a fingernail across the characters.
One note on practice: never stamp your only copy. Letter punches slip, and a character set wrongly cannot be corrected. Transfer the sequence from paper first, and destroy that paper once the plate has been checked.
The optional passphrase from BIP-39 is the most powerful and at the same time the most dangerous tool in this field. It enters the derivation as part of the salt, and so turns the same twelve words into an entirely different wallet.
A backup found on its own is therefore of no use to a thief any more. The standard describes the property explicitly: every passphrase produces a valid seed and with it a working wallet, but only the right one opens the intended wallet. That creates the option of running a second, lightly funded wallet alongside the actual holdings, which can be shown under duress.
The price for this often goes unmentioned. If the passphrase is lost, the seed is gone beyond recovery, and the standard puts it in exactly those terms. There is no checksum that flags a misremembered passphrase. The wallet simply opens empty, which regularly leads those affected to assume their device is broken.
Our own view on this is cautious. A passphrase is worth having if it is written down and kept separately from the word backup. Anyone who insists on holding it in their head alone trades a theft risk for a markedly higher risk of forgetting. For sums that matter in everyday life, we rarely consider that a sensible trade.
Anyone holding more than a small amount eventually runs into the limits of a single backup. One location is always either too accessible or too inaccessible. Two established methods resolve this in very different ways.
In a multisignature wallet the authority to sign is divided up, rather than the backup. Spending then requires two of three keys, for example, and those keys can sit on devices from different manufacturers. A single compromised device no longer suffices, and that was precisely the lesson of the Coldcard case. The drawback is the effort involved: alongside the keys you have to back up the wallet descriptor, otherwise the construction cannot be reconstructed later on.
The Shamir standard from SatoshiLabs splits the secret itself into several shares; reconstruction happens only once enough shares are brought together. SLIP-0039 works on two levels: a group threshold across up to sixteen groups, and a member threshold of up to sixteen shares per group. Rules such as two of your own four shares, or three of five friends together with two of six family members, can be modelled that way. Technically the standard uses a word list of its own with 1,024 words. One share runs to twenty words for a 128-bit secret and thirty-three words at 256 bits; tampered shares are detected through a digest check.
The drawback is obvious. The method is far from supported by every device, and at the moment of reconstruction the complete seed sits on a single device once again. Anyone whose main concern is redundancy against destruction is still better served by it than by three identical copies. Where the goal is protection against one faulty device, multisig is the more suitable tool. Which software handles both methods is set out in our overview of software wallets.
In practice the question of location decides more than the material does. A brief orientation:
A backup that has never been checked is an assumption. The test takes little effort and should be carried out once a year, ideally on a fixed date.
Reset a second, inexpensive device or a wallet application on a clean computer, and restore exclusively from the backup, never from memory. Then compare the first receiving address with the one from your production wallet. If the two match, the backup is complete, passphrase included. Afterwards you wipe the test device again.
Anyone working with a passphrase checks the exact spelling in the same pass. An extra space or a capital first letter leads to a different wallet, and deviations of that kind otherwise surface only when it counts.
The following list comes from reader correspondence and forum cases of recent months. It is not representative, though the patterns repeat strikingly often.
Point four deserves a note, because it resembles a Shamir split without being one. Halving twelve words substantially lowers the effort for an attacker who finds one half. At the same time the risk of loss rises, because two locations now have to work where one did before.
Transparency: the linked comparison pages contain partner links. If you sign up through such a link, we may receive a commission. This has no influence on our assessment of the methods described here; the technical details come from the linked standards.
The technical parameters in this article come from the original specifications: BIP-39 and SLIP-0039.
(As of August 7, 2026. This article is not investment advice. Prices and fee structures change; check the terms with the provider before you buy.)
Transparency note: This article was produced with the assistance of artificial intelligence and reviewed by our editorial team before publication. All figures and claims were checked against the primary sources linked in the text. The feature image was generated with AI.
