Human Dependencies in Custody Systems

People as Single Points of Failure in Custody

This memo is published by CustodyStress, an independent Bitcoin custody stress test that produces reference documents for individuals, families, and professionals.

Why People Involve Helpers

This memo describes how Bitcoin custody systems behave when recovery depends on people whose availability, memory, cooperation, or circumstances change over time. It examines custody arrangements where human actors hold critical pieces of information or authority—and what happens when those actors cannot or will not perform their expected roles.

---

Why People Involve Helpers

Custody arrangements often involve helpers for practical reasons. A holder wants someone else to have access if they die. They want a check on their own ability to act impulsively. They want geographic distribution of critical information so no single location holds everything. They want someone who can guide heirs through recovery.

The logic is straightforward. If you are the only person who knows how to access your Bitcoin, your death means permanent loss. Involving others creates paths for recovery that do not depend entirely on you. A wife who knows the PIN to the hardware wallet. A son who knows which safe deposit box contains the seed phrase backup. A trusted friend who holds a key in a multisig arrangement.

These arrangements make sense when designed. The helper is available. The relationship is stable. The helper understands their role. The holder can check in periodically to confirm everything still works. Under calm conditions, the human dependencies feel like features, not risks.

---

How Helpers Become Single Points of Failure

A helper who holds critical custody information becomes necessary for recovery. If that helper cannot or will not act, the Bitcoin may be stuck. The holder designed redundancy into their system, but they concentrated a different kind of risk—dependence on a specific person.

A man gave his brother a hardware wallet containing one of three keys needed for a multisig setup. Ten years pass. The man dies. His wife finds the other two keys. She contacts the brother. The brother moved twice since receiving the wallet. He thinks it might be in a box in the garage, or maybe storage, or maybe it was thrown out during the last move. He is not sure. The wife has two of three keys. The third may no longer exist. The Bitcoin cannot move.

A woman wrote half her seed phrase on one card and gave it to her daughter. She kept the other half in her safe. She dies. Her son opens the safe and finds twelve words. He does not know about the other twelve words. The daughter lives in another state and has not spoken to the family in years. She does not know she holds anything important. She may have discarded the card. The son has half a seed phrase. Half a seed phrase recovers nothing.

---

When Relationships Change

Custody arrangements often assume relationships will remain stable. A spouse will still be a spouse. A business partner will still be cooperative. A friend will still be friendly. These assumptions hold until they do not.

A holder gave his wife access to his exchange account as part of estate planning. They divorce. The account credentials were never changed. The ex-wife still has access to his Bitcoin. He forgot about the arrangement. Years later, he dies. His new wife discovers the exchange account but cannot access it because two-factor authentication goes to a phone number belonging to his first wife.

A holder set up a multisig with two business partners. They each hold one key. Any two of three keys can move funds. The business dissolves acrimoniously. One partner refuses further communication. The holder still controls one key. The cooperative partner controls another. But "any two of three" now means the holder cannot move his own Bitcoin without involving someone who will not respond to his messages.

A holder asked her best friend to be a recovery contact for her Coinbase account. Years pass. They grow apart. The friend moves and changes phone numbers. The holder becomes incapacitated. Her husband tries to recover the account. Coinbase's process requires verification from the recovery contact. The friend cannot be located. The Bitcoin sits in an account no one can access.

---

Helpers With Their Own Problems

Helpers are people. They have their own lives, their own challenges, and their own constraints. A helper who was capable and available when first designated may not remain so.

An elderly mother was given a safety deposit box key that accesses a seed phrase backup. She develops dementia. She no longer remembers what the key is for. She may have moved it. She cannot say where. Her son, the Bitcoin holder, still has his own copy of the seed phrase—but when he dies, the backup his heirs were supposed to use is behind a key held by someone who cannot help them find it.

A holder designated her brother as the person who would help her children recover Bitcoin if she died. The brother has financial problems. Debts. Legal issues. By the time she dies, he is in prison. The children need to contact him to complete recovery. Prison communication is slow. He may not remember details. His situation creates complications no one anticipated when the arrangement was made.

A financial advisor holds custody credentials for several clients as part of his practice. He retires. He hands his practice to a successor. The successor does not know which clients have Bitcoin or where the credentials are stored. A client dies. The family contacts the new advisor. The new advisor has no record of Bitcoin holdings. The original advisor is traveling and unreachable. Information exists somewhere in the practice files, but no one knows where to look.

---

The Informal Role Problem

Many helper arrangements are informal. No written agreement. No clear instructions. Just a conversation years ago and a handoff of information. The helper may not even know they are a helper.

A holder mentioned to his nephew over dinner that he keeps his seed phrase in a book on the third shelf of his home office. "If anything ever happens to me, that's where it is." Five years pass. The holder dies. The nephew vaguely remembers something about a book but not which book or which shelf. The home office has hundreds of books across six shelves. The executor does not know the nephew has any relevant information. No one thinks to ask him. The seed phrase sits in plain sight, undiscovered.

A holder gave her sister a USB drive containing an encrypted backup. "The password is our grandmother's maiden name plus the year she was born." The sister put the USB drive in a drawer and forgot about it. The holder dies. The sister finds the USB drive while cleaning. She does not remember the password. Attempts occur several combinations. None work. She does not know who else might know. The backup exists. The information to unlock it is lost.

A holder told his wife the PIN to his hardware wallet once, while cooking dinner. He assumed she would remember. She did not write it down. A year later, he is in the hospital and cannot communicate. She finds the hardware wallet. She does not remember the PIN. Attempts occur what she thinks it might be. After three wrong attempts, the device resets. The PIN conversation was not documented anywhere. The device is wiped.

---

When Helpers Cannot Be Found

Recovery sometimes requires locating people who have drifted away. The custody system does not care about the difficulty. It simply does not work without the missing piece.

A holder set up a two-of-two multisig with a college friend. They were close at the time. Life happened. They lost touch. Thirty years pass. The holder dies. His children find documentation mentioning the multisig and the friend's name. The friend's contact information is decades out of date. They search online, find someone who might be him, send messages. No response. The friend may have died. He may have moved overseas. He may simply not check that email account. The children have their father's key. The Bitcoin cannot move without a second key held by someone they cannot reach.

A holder involved her father in custody planning. The father held a physical backup. The father dies before the holder does. His estate was administered by a professional executor who did not know about the Bitcoin backup. Items were dispersed, donated, or discarded. The holder is still alive but now has a custody system with a missing piece. She knows what her father held. She does not know where it went after he died.

---

Helpers Who Decline to Help

Being designated as a helper does not obligate someone to act. When the time comes, a helper may decline for reasons the holder never anticipated.

A holder gave his attorney a sealed envelope containing recovery instructions. The attorney held it for years. The holder dies. The widow contacts the attorney. The attorney has retired and is dealing with health issues. He does not want the responsibility. He tells the widow to contact his former firm. The firm has no record of the envelope. The attorney thinks he may have shredded it when he closed his practice. He is not certain. The widow cannot compel him to help further.

A holder set up a multisig with family members after explaining the importance of their cooperation. A sibling who holds one key becomes estranged from the family. The holder dies. The estranged sibling declines to participate in recovery. "I want nothing to do with any of you." The other family members have enough keys to move funds only if the estranged sibling cooperates. The sibling will not. The Bitcoin remains frozen.

---

Time and Memory

Custody arrangements often assume helpers will remember their role and retain their information over long periods. Human memory does not work this way.

A holder gave his wife a passphrase fifteen years ago. She wrote it in a notebook. The notebook was lost in a move. She remembers there was a passphrase but not the exact words. "It was something about the dog we had when we first met." Attempts occur variations. None work. The passphrase was twelve random words. Her reconstruction attempts based on partial memory cannot succeed.

A holder told his son the location of a seed phrase backup: "the blue binder in the filing cabinet." The holder reorganized his office years later. The blue binder was replaced with a black binder. The filing cabinet was moved to storage. The son, years later, searches for a blue binder that no longer exists in a filing cabinet that is no longer in the office. The backup exists. The directions to find it no longer match reality.

---

Summary

Involving helpers in Bitcoin custody introduces dependencies on people whose availability, memory, cooperation, and circumstances can change. A helper who was reliable when designated may become unavailable, unreachable, or unwilling when needed. Relationships evolve. Helpers face their own constraints. Informal arrangements lack documentation that would help successors understand what role someone plays.

These human dependencies operate independently of the cryptographic design. A multisig may be mathematically sound but practically inaccessible if key holders cannot be located or refuse to cooperate. A seed phrase split across people may be unrecoverable if one person forgets their portion. Custody systems that involve helpers concentrate a specific kind of risk: the behavior of people under conditions no one fully anticipated when the arrangements were made.

---

System Context

Examining Bitcoin Custody Under Stress

Bitcoin Social Engineering Protection

Bitcoin Knowledge Dies With Owner

← Return to CustodyStress