How Custody Systems Fail Under Stress

How Functional Systems Fail Under Stress Conditions

This memo is published by CustodyStress, an independent Bitcoin custody stress test that produces reference documents for individuals, families, and professionals.

What Counts as Stress

A Bitcoin custody system that works perfectly during normal operation may fail under the modeled stress conditions when stress is applied. The owner accesses their Bitcoin monthly without issue. Then the owner dies, and the heir cannot access it at all. Nothing broke. The system simply behaves differently when operated by a different person, under different conditions, with different knowledge.

Stress reveals properties of custody systems that remain hidden during routine use. Understanding how custody fails under stress requires examining what changes when the original operator is no longer available.

---

What Counts as Stress

Stress in custody terms refers to any condition that disrupts normal operation. The most common stressors are death and incapacity of the primary keyholder. But stress also includes divorce, business disputes, medical emergencies, natural disasters, legal proceedings, and any situation where the usual operator cannot or will not perform their role.

Stress changes who is attempting to operate the system. The original owner knew the passwords, understood the setup, and had practiced the procedures. The heir, executor, or emergency contact likely has none of these advantages.

Stress changes when operation is attempted. Normal operation happens on the owner's schedule, when they are prepared and focused. Stressed operation happens on an external timeline, often during grief, legal proceedings, or crisis management.

Stress changes what information is available. The owner had context: why certain choices were made, where certain items were stored, what certain instructions meant. Under stress, this context is often missing.

---

The Well-Documented Setup That Failed

A man creates extensive documentation for his Bitcoin custody. He writes down the model of his hardware wallet, the location of his seed phrase, the software he uses, the PIN to his device, and step-by-step recovery instructions. He stores this documentation in a fireproof safe. He tells his spouse where the safe is and gives them the combination.

In this scenario, dies. Recovery opens the safe and finds the documentation. It begins: "My Bitcoin is stored using a Ledger Nano X with a 24-word seed phrase protected by a BIP39 passphrase. The seed is in the Cryptosteel Capsule in safe deposit box 447 at First National. The passphrase is the name of our first apartment building concatenated with my mother's birth year. Restoration assumes Sparrow Wallet compatibility. Set derivation path to m/84'/0'/0'."

Recovery in this scenario stares at this document. They do not know what BIP39 means. They do not know what a derivation path is. They do not know what Sparrow Wallet is or how to download it safely. They do not know whether "Cryptosteel Capsule" is a brand name or a technical term. They do not remember the name of their first apartment building—that was thirty years ago.

Every piece of information in the document is accurate. The documentation is complete by technical standards. But it was written for someone who already understands Bitcoin. Recovery does not. The documentation assumes knowledge the spouse does not have. Under stress, this gap becomes impassable.

---

The Coordinator Who Is Gone

A family's Bitcoin custody involves multiple elements: a hardware wallet in a home safe, a seed phrase in a bank safe deposit box, and a passphrase known only to the father. The custody system depends on a coordinator. He knows how these pieces fit together. He accesses the Bitcoin quarterly to verify everything works.

The custody system's coordinator dies suddenly. The family knows Bitcoin exists. They find the hardware wallet. They find the safe deposit box key. But they do not know these items are related. They do not know a passphrase exists. They do not know the father's system required all three components.

Recovery attempts involve third-party assistance. The friend cannot get past the PIN. The friend suggests they just use the seed phrase. The family retrieves the seed phrase from the safe deposit box. The friend restores it. The wallet shows zero balance.

The friend concludes the Bitcoin was already moved or spent. The family accepts this explanation. They do not know that the zero-balance wallet is a decoy, that a passphrase would reveal the real holdings, that the father's system was specifically designed to show an empty wallet to anyone who did not have all the pieces.

The custody system behaved as designed under its original assumptions. The problem was that the father was the only one who knew the design. When stress removed him, it removed the coordination that made the system function.

---

The Helper Who Made It Worse

An elderly woman dies with Bitcoin on an exchange. Her daughter finds login credentials written in a notebook. The credentials work. Recovery logs into the exchange and sees a balance of approximately $85,000.

Recovery in this scenario does not know what to do next. She asks her cousin, who "knows about crypto," to help. The cousin logs in and suggests moving the Bitcoin to a "safer" wallet. The cousin creates a new wallet, generates an address, and initiates a withdrawal from the exchange.

The exchange requires email confirmation for withdrawals. The confirmation email goes to the deceased mother's email account. Recovery does not have access to that email. She does not know the password. The email provider's account recovery process takes weeks.

During those weeks, the cousin keeps trying things. The cousin resets the exchange password, triggering a security hold. The cousin contacts exchange support, creating a ticket that now shows the account is being accessed by someone other than the account holder. The exchange freezes the account pending identity verification.

What started as a straightforward inheritance—credentials existed, balance was visible—became a months-long process involving lawyers, probate documents, and exchange compliance departments. The helper's confidence exceeded their competence. Each attempt to move faster created new obstacles.

---

The Multisignature Arrangement That Deadlocked

Two business partners establish a multisignature wallet for their company's Bitcoin. Two of two signatures are required. Each partner holds one key. This prevents either partner from acting alone—a protection against theft or unilateral decisions.

The partnership ends badly. One partner feels cheated. The other partner wants to liquidate the Bitcoin and split the proceeds. The aggrieved partner refuses to sign. They do not dispute the other partner's right to half the value. They simply refuse to cooperate out of spite.

The Bitcoin sits frozen. Lawyers send letters. The responding letters demand things unrelated to the Bitcoin. The dispute escalates to other business matters. Years pass. Legal fees accumulate. Neither partner can access funds that both legally own.

The multisignature arrangement that protected the company from theft now prevents the company from operating. The security feature became a deadlock mechanism. Under normal conditions—when both partners cooperated—the system worked perfectly. Under stress—when cooperation ended—the system became a prison for the assets it protected.

---

The Time-Delayed Discovery

A man dies. His family handles the funeral, the immediate paperwork, the condolences. Bitcoin is not on their minds. Weeks pass before they begin sorting through his belongings.

During those weeks, the family discards items they do not recognize. A small device that looks like a USB drive goes into a donation box. A notebook with random words written on one page goes into recycling. An old laptop is wiped and given to a grandchild.

Two months later, a family friend mentions the deceased was enthusiastic about Bitcoin. The family begins searching. The hardware wallet is gone—donated to a thrift store, sold for two dollars, untraceable. The seed phrase is gone—recycled with old papers. The laptop that might have contained wallet software or recovery information has been wiped clean.

Every item that could have enabled recovery was destroyed by routine post-death cleanup. The family did not know what they were looking for. They did not know these objects had value. The delay between death and discovery allowed normal processes to eliminate the custody materials.

---

The Professional Who Applied Wrong Assumptions

A lawyer serves as executor for an estate that includes Bitcoin. The lawyer has handled many estates but never one with cryptocurrency. They apply familiar procedures.

The lawyer takes custody of the deceased's assets, including a hardware wallet and documents. These go into the law firm's safe while probate proceeds. The safe is climate-controlled and secure. This is standard practice for valuable estate items.

Eight months later, probate concludes. The lawyer retrieves the hardware wallet to transfer it to the heir. The device does not turn on. Eight months in a safe—even a good safe—allowed the battery to drain completely. Or humidity affected the electronics. Or something else went wrong.

The lawyer searches for the seed phrase backup. It was in the documents they collected. But the documents were organized into legal categories: tax returns here, property deeds there, miscellaneous papers in storage. A sheet with 24 random words did not fit any category. It went into a box that went into offsite storage. No one can locate which box.

The lawyer treated Bitcoin custody materials like any other estate asset. This was wrong. Seed phrases are not documents—they are the asset itself. Hardware wallets are not like jewelry—they require power and specific handling. Professional competence in estate administration did not translate to competence in Bitcoin custody.

---

The Emotional State That Prevented Action

A woman loses her husband unexpectedly. She is overwhelmed with grief. She knows he had Bitcoin. She knows, vaguely, that there are devices and papers involved. She cannot bring herself to deal with it.

Months pass. Family members offer to help. She declines. The thought of going through his things is too painful. The Bitcoin feels abstract compared to the concrete reality of loss.

A year passes. She finally begins sorting through his office. By now, her memory of conversations they had about the Bitcoin has faded. Did he mention a passphrase? She cannot remember. Did he say the seed phrase was in the safe or the filing cabinet? She is not sure.

She finds a hardware wallet. She finds what might be a seed phrase. She attempts recovery but the wallet shows zero. Is this because there is no Bitcoin? Because there is a passphrase she does not know? Because she is doing something wrong? She cannot tell.

Two years after his death, she hires a professional to help. They eventually recover the Bitcoin—it required a passphrase that was written on a separate card she had overlooked. But the two-year delay created uncertainty and confusion that would not have existed with immediate action. Grief is a form of stress that custody systems do not account for.

---

Why Normal Operation Masks These Problems

During normal operation, the owner compensates for system weaknesses without noticing them. The documentation is incomplete, but the owner remembers what it does not say. The seed phrase location is obscure, but the owner knows where to look. The passphrase is unwritten, but the owner has it memorized.

The owner is a single point of knowledge that makes the entire system coherent. Remove that point, and the system fragments into disconnected pieces. The pieces may all exist. They may all function individually. But without the coordinator who knew how they fit together, assembly becomes guesswork.

Normal operation also happens in normal circumstances. The owner is calm, focused, and familiar with the procedures. Stressed operation happens in crisis circumstances. The operator is grieving, confused, time-pressured, and encountering the system for the first time. Procedures that seem simple when practiced become difficult when performed under duress by someone who has never done them before.

---

Conclusion

Custody systems fail under stress because stress changes who operates the system, when operation occurs, and what information is available. Systems that function perfectly for their original owner may fail under the modeled stress conditions for an heir, executor, or emergency contact.

Common failure patterns include documentation that assumes knowledge the reader lacks, coordination that depends on a person who is no longer available, helpers whose confidence exceeds their competence, time delays that allow critical materials to be lost or destroyed, professionals who apply wrong assumptions, and emotional states that prevent timely action.

These failures do not require anything to break. They emerge from the gap between how the system was designed to operate and how it must actually be operated when stress occurs. The system works—for the original owner, under normal conditions, with full context. It fails when any of these factors change.

---

System Context

Examining Bitcoin Custody Under Stress

Bitcoin Setup Only I Understand as Knowledge Concentration Risk

When Bitcoin Wallet Software Deprecated

← Return to CustodyStress