Wallet Backup

What Is a Wallet Backup?

A wallet backup is a copy of the critical data required to restore access to cryptocurrency holdings. Unlike a bank account, where a forgotten password can be reset through identity verification, a self-custodial cryptocurrency wallet has no central authority that can recover lost credentials. If the private keys controlling a wallet are lost, the funds become permanently inaccessible. A wallet backup is the safety net that prevents this.

The concept of wallet backup evolved alongside Bitcoin's wallet architecture. Early Bitcoin wallets required backing up individual private keys, which was error-prone and easy to get wrong. The introduction of hierarchical deterministic (HD) wallets via BIP-32 simplified this dramatically: a single master seed can regenerate an entire tree of keys. BIP-39 then standardized encoding that seed as a human-readable mnemonic phrase, making backup as simple as writing down 12 or 24 words.

How It Works

There are several wallet backup methods, each with different security properties and usability tradeoffs.

Seed Phrase (BIP-39 Mnemonic)

The BIP-39 standard is the most widely used backup method. A wallet generates 128 bits (12 words) or 256 bits (24 words) of random entropy, appends a checksum derived from SHA-256, then maps each 11-bit segment to one of 2,048 predefined words. The result is a human-readable mnemonic that encodes the wallet's master secret.

To derive the actual cryptographic seed, BIP-39 runs the mnemonic through PBKDF2 with HMAC-SHA512 for 2,048 iterations, using the string "mnemonic" plus an optional passphrase as the salt. The output is a 512-bit seed that feeds into BIP-32 key derivation:

# BIP-39 seed derivation
entropy (128 or 256 bits)
  → append checksum (first ENT/32 bits of SHA-256)
  → split into 11-bit groups
  → map each group to wordlist[index]
  → mnemonic phrase

PBKDF2(mnemonic, "mnemonic" + passphrase, 2048, HMAC-SHA512)
  → 512-bit seed
  → BIP-32 master key derivation

The optional passphrase adds a layer of protection: without it, the seed derives a different set of keys, which can be used to create a duress wallet with a small balance as a decoy.

Encrypted File Backup

Some wallets store keys in encrypted files rather than (or in addition to) mnemonic phrases. Bitcoin Core's wallet.dat encrypts private keys with AES-256-CBC, where the encryption key is derived from a user-supplied passphrase. Ethereum JSON keystore files (v3) use AES-128-CTR with a key derived via scrypt (N=262144, r=8, p=1) and verify integrity with a keccak-256 MAC.

Encrypted file backups are more portable than seed phrases for wallets with metadata (labels, transaction notes, address books) but depend entirely on passphrase strength. A weak passphrase can be brute-forced, especially if the backup file is stored on a cloud service that gets breached.

Shamir's Secret Sharing (SLIP-39)

Shamir's Secret Sharing splits a master secret into multiple shares, where any threshold number of shares can reconstruct the original but fewer shares reveal nothing. SatoshiLabs standardized this for wallet backup as SLIP-39, which uses a 1,024-word list, operates over GF(256), and supports a two-level group structure with up to 16 groups.

A typical configuration might split a seed into 3-of-5 shares: any three shares can recover the wallet, but an attacker who steals one or two shares learns nothing about the secret. The master secret is encrypted via a four-round Feistel network using PBKDF2/HMAC-SHA256, and each share includes a Reed-Solomon error-detecting checksum. For a deeper look at implementation, see Shamir backup strategies for Bitcoin.

Social Recovery

Social recovery wallets designate a set of trusted contacts (guardians) who can collectively authorize a new signing key if the owner loses access. A typical setup requires a majority threshold (for example, 3-of-5 guardians) to approve recovery, so no single guardian can steal funds.

On Ethereum, this pattern is implemented through account abstraction (ERC-4337) smart contract wallets. Guardians can be friends, family members, hardware devices, or institutional services. The tradeoff is that social recovery requires an on-chain smart contract layer, making it more complex on UTXO-based chains like Bitcoin.

Descriptor Wallets and Complex Scripts

For simple single-signature wallets, a BIP-39 seed phrase is sufficient to recover all keys and reconstruct every address. But modern Bitcoin wallets increasingly use complex spending policies: multisig arrangements, timelocks, and Taproot script trees. Descriptor wallets (standardized in BIP-380 through BIP-386) encode these policies as output descriptors that specify not just which keys are involved but how they can be combined to spend.

A descriptor like wsh(multi(2,xpub1...,xpub2...,xpub3...)) defines a 2-of-3 multisig. Without this descriptor, knowing one seed phrase is not enough to reconstruct the wallet: you also need the other participants' extended public keys and the exact script template. Backing up the descriptor alongside the seed is essential for any wallet using Miniscript or complex Taproot policies. For more on descriptor portability, see output descriptor wallet portability.

Storage Best Practices

Metal Seed Plates

Paper backups are vulnerable to fire, water, and general degradation. Metal seed plates made from 304-grade stainless steel withstand temperatures above 1,200°C and resist corrosion, making them far more durable. Products like Cryptosteel Capsule (letter-tile insertion system), Billfodl (slide-in tiles), and Blockplate (center-punch dot encoding of BIP-39 word indices) each offer different ergonomics for recording a mnemonic in steel.

Geographic Distribution

Storing all backup copies in one location creates a single point of failure. Best practice is to distribute backups across 2 to 3 physically separate locations in different cities or regions. Common storage sites include bank safe deposit boxes, fireproof home safes, and trusted contacts' secure locations.

SLIP-39 shares pair naturally with geographic distribution: place each share in a different location so that no single site holds enough information to reconstruct the wallet. This combines the physical resilience of distributed storage with the cryptographic guarantee that partial theft is useless. For long-term planning, see Bitcoin inheritance planning.

The Security and Accessibility Tradeoff

Every backup decision involves a tension between security (how hard it is for an attacker to access the backup) and accessibility (how easy it is for the legitimate owner to recover). A seed phrase engraved on titanium and buried in a remote location is extremely secure but impractical to access quickly. A plaintext note in a cloud drive is instantly accessible but trivially compromised.

The right balance depends on the amount at stake and the owner's threat model. Small amounts may warrant simpler backup schemes, while significant holdings justify multi-location SLIP-39 splits, hardware wallet integration, and professional key management practices.

Use Cases

• Device loss or failure: a phone is stolen, a laptop's drive fails, or a hardware wallet is damaged. A seed phrase backup lets the owner import the mnemonic into a new wallet and regain full access.
• Inheritance and estate planning: wallet backups stored with legal instructions ensure heirs can access funds. SLIP-39 shares can be distributed among family members and an attorney so that no single party has unilateral access.
• Migration between wallet software: when switching from one wallet application to another, a BIP-39 seed phrase provides a universal import format. Descriptor backups enable migration for wallets with complex policies.
• Institutional custody: organizations use multisig or MPC wallets where each key-holder maintains independent backups. Redundancy at the backup layer ensures the organization survives individual key-holder departures.

Why It Matters

The shift toward self-custody makes wallet backup a foundational skill for anyone holding cryptocurrency. Self-custodial wallets give users full control over their funds, but that control comes with full responsibility for backup and recovery.

Layer 2 protocols like Spark and the Lightning Network introduce additional backup considerations: channel state must be preserved alongside key material, and stale backups can lead to penalty transactions if an outdated state is broadcast. Modern wallet infrastructure increasingly handles these complexities behind the scenes, but understanding backup fundamentals remains critical for anyone managing their own keys. For a comprehensive overview of recovery strategies, see Bitcoin wallet recovery methods.

Risks and Considerations

Single Point of Failure

A single backup in a single location means one theft, fire, or flood can wipe out access permanently. This is the most common cause of lost cryptocurrency. Splitting backups across locations or using SLIP-39 shares eliminates this risk.

Physical Coercion

The "$5 wrench attack" describes a scenario where an attacker physically forces the owner to reveal their backup. Mitigations include BIP-39 passphrase-protected decoy wallets, SLIP-39 threshold schemes (the owner genuinely cannot produce all shares alone), and multisig setups where no single party holds enough keys.

Backup Staleness

HD wallets with standard derivation paths remain valid indefinitely: the seed phrase recovers all past and future addresses. But wallets using non-standard derivation paths, imported keys, or complex descriptors can become out of sync with their backups. Regularly verifying that a backup can fully restore the wallet's current state is essential.

Digital Storage Risks

Storing seed phrases or encrypted backup files digitally (screenshots, notes apps, cloud storage, email drafts) exposes them to malware, phishing, cloud breaches, and device compromise. Cold storage backups kept offline on metal plates or air-gapped media provide stronger guarantees against remote attacks.

This glossary entry is for informational purposes only and does not constitute financial or investment advice. Always do your own research before using any protocol or technology.