Part of the CustodyStress archive of observed Bitcoin custody incidents

Browse archive Archive statistics Scenarios Dependencies About

CS-00833

Deceased Son's Bitcoin Wallet: Found Backup, Lost Passphrase

Indeterminate

Bitcoin held by a deceased owner — whether heirs recovered access is not known.

Case description

A family member discovered a hard drive among their deceased son's belongings containing a file named BACKUP.dat, believed to be a backup of a Bitcoin Core wallet.dat file. The family had no prior knowledge of whether the wallet held significant funds, and critically, possessed no record of any passphrase used to encrypt it.

The recovery effort began cautiously. The family researched public address visibility and attempted to develop a safe recovery procedure before accessing the drive via a USB-to-SATA cable on an isolated laptop. However, the drive contained only the backup file itself—no Bitcoin Core installation, no seed phrase documentation, no recovery instructions, and no other cryptographic material that might permit access.

Following community advice from r/Bitcoin, the family considered installing Bitcoin Core on a fresh, isolated machine to import the wallet. This approach presented a fundamental limitation: if the wallet was passphrase-encrypted (a standard security measure in Bitcoin Core), importing the file would not reveal private keys without the passphrase. If unencrypted, the import would only expose the wallet structure, not provide access without additional recovery material.

The core problem was knowledge concentration. Only the deceased son had possessed operational knowledge of the wallet—whether a passphrase existed, what it might be, or whether any seed phrase had been recorded elsewhere. No estate documentation existed to guide the family or designate a recovery contact.

After attempting recovery methods suggested online, the family abandoned further pursuit. Professional recovery services were mentioned in community responses but not engaged. Instead, the family sold the hard drive to someone claiming expertise in DeFi and decentralized applications. The final disposition of any Bitcoin remains unknown: the wallet may have been empty, funds may remain permanently locked, or they may have been accessed by the buyer.

Custody context

Stress condition	Owner death
Custody system	Software wallet
Outcome	Indeterminate
Documentation	Partial

Structural dependencies observed

What this illustrates

Only one person knew how the setup worked — and that person wasn't available. A software wallet stores keys on the device — whether a phone or computer. When the device is lost or the application is uninstalled, access depends entirely on whether a seed phrase was recorded and stored independently. Bitcoin custody systems are typically designed for use by their owner. Very few are designed to be operated by someone who was not involved in setting them up. The wallet needed a passphrase that nobody could produce. An indeterminate outcome reflects the limits of available information. Whether anyone eventually gained access is not documented in the sources reviewed.

Why this matters

The gap between legal ownership and operational access

Owner death cases expose a structural gap that has no equivalent in traditional asset inheritance: the gap between legal ownership and technical access. Heirs may have clear, undisputed legal entitlement to the Bitcoin. They may have death certificates, probate orders, and estate attorney representation. None of this provides access to a self-custody wallet.

Bitcoin custody was designed for use by its owner. The security model assumes that the person who set up the wallet is the same person who will use it. It does not assume that someone who has never interacted with the wallet will need to operate it months or years later, with no guidance and no one to ask.

The knowledge that dies with the owner includes more than credentials: it includes the understanding of why the setup was built a certain way, which addresses held the Bitcoin, whether a passphrase was set, where the backup was stored and why, and what the heir should do first. Without this knowledge, heirs typically face a search process before they face an access process.

Cases where heirs succeeded consistently share one feature: the owner had communicated the existence of the Bitcoin and left enough information for someone else to find and use the credentials. In most cases, this was informal — a note, a conversation, a letter in the files. Formal estate planning documents rarely contained the operational details needed for actual access.

How this category of failure is typically preventable

The failure that causes heirs to lose Bitcoin is almost never the custody setup itself — it is the assumption that the setup is self-explanatory to someone who has never used it. Communicating the existence of the Bitcoin, its approximate location, and who knows how to access it adds almost no security risk while dramatically changing the inheritance outcome.

Frequently asked questions

What happens to Bitcoin when the owner dies?

Bitcoin held in self-custody does not automatically transfer to heirs. Unlike bank accounts, there is no institution to notify, no next-of-kin process, and no account transfer mechanism. Access requires the same credentials the owner used — the seed phrase, any passphrase, and knowledge of which wallet held the Bitcoin. Heirs who cannot locate these credentials cannot move the funds, regardless of their legal entitlement.

Can an executor access Bitcoin held in a hardware wallet?

Only if they have the necessary credentials. A hardware wallet requires the device, the PIN, and — if a passphrase was set — the passphrase. An executor with legal authority but no credentials faces the same barrier as anyone else: the blockchain does not recognize probate orders. Legal authority and technical access are separate systems that do not automatically connect.

Does a will give heirs access to Bitcoin?

A will can legally assign ownership of Bitcoin but cannot provide access to it. Naming Bitcoin in a will establishes legal entitlement. The heir still needs the operational credentials — seed phrase, passphrase, wallet information — to move the Bitcoin. Without those, legal ownership exists on paper while the Bitcoin remains inaccessible on the blockchain.

Source

Publicly Reported

Evidence link

https://www.reddit.com/r/Bitcoin/comments/10x9yov/help_with_old_walletdat_recovery_second_post_on

Most structurally similar case

Recovering Bitcoin After Owner Death: Paper Wallet and Computer Access

Owner death · Software wallet Indeterminate

Related cases

Structural patterns in this case

Estate and inheritance failures

44 cases involve owner death 455 cases involve software wallet View archive statistics →

This archive documents observed custody survivability failures. It does not attempt to document all Bitcoin losses or security incidents. Submit a case

← All cases

Framework references

Where Bitcoin Custody Intersects Legal and Fiduciary Authority

Where custody creates gaps in estate planning, fiduciary duty, and professional responsibility.

Professional Scope Boundary Matrix

What each professional or product covers, what they do not, and where gaps form between them.

The Independent Assessment Layer in Bitcoin Custody

How independent diagnostic layers emerge when multiple parties depend on shared infrastructure.

This archive documents cases where a legitimate owner, heir, or authorized party encountered barriers accessing or recovering Bitcoin due to a failure in the custody arrangement. The central question for inclusion is: did the custody structure fail a legitimate access or recovery attempt?

A case must satisfy all three of the following to be included:

Legitimate access attempt. The person attempting to access or recover the Bitcoin was the owner, a designated heir, an executor, a legal authority, or another party with a legitimate claim — not a thief, attacker, or unauthorized third party.
Custody structure failure. The failure was caused by a property of the custody arrangement — missing credentials, structural dependencies, documentation gaps, knowledge concentration, legal barriers, or institutional constraints — not market conditions, individual-level fraud or theft, or protocol-level issues. Platform-level failures that block legitimate user access are in scope regardless of their cause.
Documentable outcome or access constraint. The case must have a stated or inferable outcome: access blocked, access constrained, access delayed, or access eventually achieved through a recovery path. Cases with entirely unknown outcomes are included only where the structural failure is documented and the constraint is unambiguous.

Owner death or incapacity — Bitcoin held in self-custody that becomes inaccessible to heirs or designated parties because credentials, documentation, or operational knowledge were not transferred
Passphrase loss — BIP39 passphrase forgotten or unavailable, blocking access to a funded wallet even where the seed phrase is present
Seed phrase or wallet backup unavailable — no independent recovery path existed or the backup was destroyed, lost, or never created
Device loss without independent backup — hardware wallet, phone, or computer lost or destroyed with no recovery path outside the device
Documentation absent or ambiguous — heirs or executors cannot determine that Bitcoin exists, which wallet holds it, or how to access it
Knowledge concentration — only one person knew the procedure, passphrase, or access method; that person is dead, incapacitated, or unreachable
Multisig quorum failure — a threshold signature arrangement cannot be completed because signers are unavailable, uncooperative, incapacitated, or have lost their keys
Legal authority / access mismatch — a court order, probate ruling, or power of attorney establishes legal entitlement but provides no technical path to access
Institutional custody barrier — exchange or platform hacks, insolvency, regulatory seizure, or operational failure that caused a access constraint or failure for legitimate users, whether temporary, prolonged, or permanent. The failure of the custodian to remain available or solvent is itself the in-scope event.
Forced relocation or geographic constraint — physical access to a device or location required for recovery is blocked by displacement, border restrictions, or political circumstances
Coercion — the holder was compelled under threat to transfer Bitcoin or disclose credentials during an access event
Hidden asset discovery — heirs or executors locate a wallet or account but cannot access it due to missing credentials or operational knowledge

Market losses, investment losses, yield scheme losses, or Ponzi scheme losses
Hacks or theft targeting an individual's personal security (phishing, SIM swap, social engineering, malware) where the custody architecture itself did not fail
Unauthorized transfers where the holder's custody system was not the cause of the failure
Ordinary transaction mistakes — wrong-address sends, fee errors, mistaken amounts
Protocol-level failures — cryptographic vulnerabilities, consensus bugs, firmware integrity failures
Deliberate burns or tribute burns
Cases where the stated loss is unverifiable and no structural custody failure is described

Cases are drawn from public sources including forum posts, news reporting, court documents, academic research, and direct submissions. Each case is reviewed against the inclusion criteria above before publication. Source material is retained and available on request for documented cases.

The archive is observational and descriptive. It does not attempt to document all Bitcoin custody failures — only those meeting the criteria above with sufficient documentation to describe the structural failure and its outcome.