Bitcoin Recovery Path Gaps

Gaps Between Recovery Instructions and Actual Access

This memo is published by CustodyStress, an independent Bitcoin custody stress test that produces reference documents for individuals, families, and professionals.

Single Point of Failure Gaps

Recovery plans address anticipated scenarios. The device fails, use the backup. The primary location is inaccessible, retrieve from the secondary. These plans work when reality matches anticipation. Bitcoin recovery path gaps appear when scenarios arise that existing plans do not cover—situations where the planned path fails and no alternative exists.

Gaps differ from total absence of planning. A holder may have extensive recovery procedures that simply do not address certain situations. The plan exists; coverage does not. Identifying gaps requires examining what scenarios could occur and comparing them against what scenarios the current plan actually handles.

---

Single Point of Failure Gaps

Recovery plans often have single points of failure that holders do not recognize. One backup location, one person who knows the procedure, one device that can perform recovery—if that single point fails, the entire recovery path fails with it.

Geographic concentration creates disaster vulnerability. All backups in one city face simultaneous loss from regional disaster. The holder who stored backups in multiple places within the same area has redundancy against local events but not against events affecting the entire area.

Knowledge concentration poses similar risks. If only one person understands the recovery procedure, their incapacity or death eliminates that knowledge. No backup of knowledge exists, even if backups of keys exist.

Hardware dependency can be a single point. Recovery requiring a specific device type, software version, or operating system fails if that requirement cannot be met. What seems like a minor dependency becomes critical when the dependent resource is unavailable.

---

Scenario Coverage Gaps

Recovery plans address imagined scenarios. The holder considers what might go wrong and creates procedures for those situations. But imagination is limited. Scenarios the holder did not consider remain unaddressed regardless of how thorough the planning seems.

Correlated failures challenge plans designed for independent failures. A fire that destroys both the device and the local backup. An estate dispute that makes family members adversarial when cooperation was expected. Events affecting multiple components simultaneously exceed single-failure planning.

Timing complications create gaps. Plans assume recovery can happen when convenient. Emergency situations—evacuation, hospitalization, arrest—may require recovery under constraints the plan did not anticipate. Time-sensitive scenarios differ from leisurely recovery.

Emotional and cognitive state during recovery often goes unconsidered. The holder imagines executing procedures calmly. Reality may involve grief, panic, confusion, or impairment. Procedures that work under optimal conditions may fail under stress conditions.

---

Access Chain Gaps

Recovery often requires a sequence of accesses: get the backup, find the PIN, locate the device, access the software. Gaps appear when links in this chain cannot be completed, even if other links remain functional.

Information stored with the backup may not be enough. A seed phrase without derivation path information may not produce the expected addresses. The passphrase that was supposed to be memorized may be forgotten. Components stored together may still be incomplete together.

Instructions require interpretation. Even detailed documentation assumes certain reader capabilities. A gap exists when the documentation's assumed capability exceeds the reader's actual capability. The instructions are there; the ability to follow them is not.

Authentication requirements can create chain breaks. A backup in a safe deposit box requires bank access. Bank access requires ID. If ID is unavailable—lost, stolen, or held by someone else—the chain breaks despite the backup being secure.

---

Temporal Gaps

Recovery plans are created at a point in time. They reflect conditions that existed then. As time passes, conditions change while plans remain static. Temporal gaps emerge from this divergence between plan-time and recovery-time reality.

Contact information decays. Phone numbers change. Addresses become outdated. Email accounts are abandoned. People who could help become unreachable. The plan that assumed reachable contacts may find contacts unreachable.

Technology evolves away from what the plan assumed. Software becomes unavailable. Hardware becomes obsolete. Formats become unreadable. What was standard when the plan was made becomes legacy by the time recovery is needed.

Relationships that existed during planning may not exist during recovery. A trusted friend who moved away. A family member who became estranged. A service provider who went out of business. Plans built on relationships fail when those relationships end.

---

Inheritance-Specific Gaps

Recovery by heirs introduces gaps that do not exist for the holder. The holder can improvise, remember unstated details, and adapt to unexpected situations. Heirs cannot. What the holder would figure out may completely stump their successors.

Discovery gaps precede recovery gaps. Before heirs can recover anything, they must know there is something to recover. If discovery fails—if heirs do not realize bitcoin exists or do not find recovery materials—the recovery path is never entered.

Capability gaps affect execution. Even with complete materials and clear instructions, heirs may lack the capability to execute recovery. Technical procedures that the holder found simple may overwhelm a non-technical heir.

Legal and institutional gaps emerge in inheritance contexts. Probate requirements, tax obligations, and institutional access procedures create obstacles that do not exist for living holders managing their own assets. Heirs face barriers the holder never encountered.

---

Partial Loss Scenarios

Recovery plans often assume complete component availability or complete component loss. Partial loss scenarios—some information available, some missing—may fall through gaps in planning that addresses only the extremes.

Damaged but readable backups present challenges. A seed phrase with one word illegible. A metal backup with some letters corroded away. Recovery may still be possible but requires expertise and effort the plan does not address.

Mixed component availability complicates multisig recovery. Perhaps one key is fully available, another is partially corrupted, and a third's holder is unreachable. The plan for "two of three" may not specify what to do when one is certain, one is uncertain, and one is unavailable.

Memory fragments create partial information situations. The holder remembers part of a passphrase but not all of it. They recall the general location of a backup but not the specific spot. Partial memory is neither the full information the plan assumed nor the complete absence it addressed.

---

Adversarial Scenarios

Most recovery plans assume cooperative circumstances. But recovery sometimes occurs in adversarial contexts—disputed inheritance, divorce proceedings, or theft situations. Gaps emerge when plans assume cooperation that does not exist.

Contested access can block recovery paths. A family member who refuses to provide their component. A storage location controlled by someone hostile. Legal processes that freeze access pending resolution. Adversaries can obstruct even well-designed recovery procedures.

Information asymmetry favors adversaries who know the plan. An estranged spouse who knows where backups are stored. A disgruntled family member who understands the recovery procedure. Knowledge shared in cooperative times becomes vulnerability in adversarial times.

Speed advantages go to prepared adversaries. The holder's death may trigger a race between cooperative heirs and adversarial actors who were prepared. Recovery plans focused on deliberate, careful execution may lose to adversaries who move quickly and ruthlessly.

---

Environmental Condition Gaps

Recovery plans assume certain environmental conditions. Power is available. Internet works. Banks are open. Stable social order exists. These assumptions fail during crisis conditions when recovery may be most urgently needed.

Infrastructure failures compound custody challenges. A natural disaster destroys the device and disrupts power, internet, and transportation simultaneously. The backup that was accessible in normal times becomes unreachable during the crisis.

Social disruption creates unusual obstacles. Political instability, civil unrest, or breakdown of normal services can make ordinary actions impossible. What would be a simple recovery procedure in stable times becomes impossible when stability disappears.

Emergency evacuations test geographic distribution plans. If the holder flees without backup materials, can they still recover? If backups are distributed across a region being evacuated, can any be reached? Emergency conditions may prevent accessing any component.

---

Identifying Gaps

Finding gaps requires imagining failures the plan does not address. What if this goes wrong? What if that is unavailable? What if both happen together? Systematic questioning surfaces scenarios that initial planning overlooked.

Stress testing through thought experiments helps. Walk through recovery mentally, introducing obstacles at each step. What if access is denied? What if the person is unavailable? What if the information is wrong? Each obstacle reveals whether the plan has an alternative.

External review provides perspectives the planner lacks. Others imagine different scenarios. Their questions reveal assumptions the planner did not know they were making. Fresh eyes see gaps normalized eyes miss.

Actual testing proves or disproves assumptions. Attempting recovery using only what would be available—without the holder's improvisation—reveals gaps definitively. Testing may be the only way to find gaps that thought experiments miss.

---

Conclusion

Bitcoin recovery path gaps represent scenarios where existing backup strategies fail to provide a working recovery path. Single points of failure, scenario coverage limits, access chain breaks, temporal drift, inheritance-specific challenges, partial loss situations, adversarial contexts, and environmental conditions all create gaps that plans may not address.

Gaps differ from absent planning. Extensive procedures may still have uncovered scenarios. The holder who feels well-prepared may have recovery paths that break under conditions they did not anticipate.

Identifying gaps requires systematic questioning, stress testing, external review, and actual recovery testing. Each method surfaces different gaps. Comprehensive gap identification uses multiple approaches to find what single approaches miss.

---

System Context

Bitcoin Custody Failure Modes

Bitcoin Dashboard Implies Safety but Isnt Reflecting Reality

How Do I Know My Bitcoin Custody Works

← Return to CustodyStress