SLIP39 Estate Planning: Secure Seed Keys
SLIP39 Estate Planning:
Secure Seed Keys
Protect hardware wallets. SLIP39 estate planning ensures secure seed phrase succession and optimal tax strategies for crypto heirs.
GROUP B — FIDUCIARY · 2of4
GLOBAL RULE · both groups must concur
Highlighted slots = shares in active ceremony
TL;DR — the seed that outlives its owner
Every crypto fortune begins as twenty-four words, and most of them end the same way: one plate, one drawer, one point of failure. A house fire in one intake file, a flooded safe in another, a password manager buried with its owner in a third. SLIP39 — the Shamir-based standard that splits a seed into threshold shares — is the engineering answer, but engineering without law is just a prettier puzzle. Done properly, SLIP39 estate planning lets a family secure seed phrase succession safely, because no single disaster and no single person can defeat the threshold; it lets you distribute hardware wallet access legally, because each share sits inside a deed, an escrow or a custody agreement that tells a court exactly who may touch it and when; and it creates the room to optimize crypto inheritance tax strategies, because assets that can actually be recovered can actually be planned — stepped-up, rolled over, or trust-wrapped instead of lost. The whole argument, in three lines:
Verbatim · retain as written
- Secure seed phrase succession safely.
- Distribute hardware wallet access legally.
- Optimize crypto inheritance tax strategies.
One seed, one funeral, zero heirs
The single-seed model asks one physical object to survive fire, flood, divorce, theft, bank closures and memory loss for decades. Our intake patterns — consistent with the 2026 Executive Digital Asset Risk Index — show the same failure loop repeating: the backup was next to the original, or the backup was a photograph, or nobody knew the backup existed.
“The seed plate did not survive the house fire. Neither did the only backup — it was in the same house.”Composite intake pattern · fiduciary interviews
What SLIP39 actually is — and is not
SLIP39 applies Shamir’s Secret Sharing to BIP39 seeds: the seed is mathematically split into mnemonic shares, and only the threshold number of shares can reconstruct it. Below threshold, shares reveal nothing. Crucially, it operates at a different layer than the trust architecture that holds the assets — and a different layer than multisig.
| Layer | What it protects | Single point of failure? | Inheritance behaviour | Proper role |
|---|---|---|---|---|
| Single BIP39 seed | Whole wallet, via one secret | Yes — catastrophically | All-or-nothing; whoever finds it owns everything | Retired at the ceremony, never kept |
| SLIP39 shares This dossier | The seed, via threshold math | No — tolerates lost shares | Shares can be distributed to heirs & fiduciaries safely | Human-layer succession & durability |
| Multisig wallet | On-chain spending authority | Depends on key layout | Keys still need their own succession plan | Blockchain-layer control |
| Trust deed № 17 | Legal title & distribution | No, if fiduciaries cascaded | Bypasses probate; defines who benefits | Legal-layer ownership & tax design |
The mature stack uses all four layers: a multisig wallet whose keys are each guarded by SLIP39 share sets, all of it titled inside the trust. Confusing the layers — “we have multisig, so the seed doesn’t matter” — is the most common design error we correct.
The five-layer share architecture
Generation
The Ceremony Itself
Shares are generated offline on trusted hardware, checksums verified on a second device, and the original single-seed record destroyed under witness. The ceremony is minuteed like a key ceremony: who attended, which firmware, which entropy source. The minute travels with the legal file, not with the shares.
- Air-gapped generation; no networked device in the room
- Each share’s checksum read aloud and verified independently
- Single-seed paper/plate destroyed under witness at the end
Medium
Steel, Titanium, Laminate — Never Pixels
A share photographed is a share published: cloud sync, email drafts and phone backups convert a physical secret into a global one. Shares are stamped onto corrosion-rated steel or titanium and sealed; the medium is specified in the deed rider so a court knows what “the share” physically is.
- Stamped metal, geographically separated, fire-rated storage
- Explicit deed prohibition on digital copies of shares
- Serial-numbered plates matched to the ceremony minute
Distribution
Geography & Fiduciaries
Shares are placed so that no coalition below threshold is geographically or legally possible: family shares at home vaults, fiduciary shares with the corporate trustee, one in attorney escrow, one in a bank box on another continent. Physical storage is insured — the same discipline as any other valuables, which is where high-value insurance bundling enters the plan.
- No two shares in the same building, ever
- Escrow agreements define release triggers (death, incapacity, order)
- Insurance schedules list plates by serial, not by contents
Legal wrapping
Deed, Consent & Letter of Wishes
Shares are property; the deed says who holds them, in what capacity, and what happens at each trigger. RUFADAA-style consent language authorizes fiduciary access; the letter of wishes records the threshold philosophy without ever recording the shares themselves. This layer is what turns cryptography into estate planning — see the master digital asset trust structure dossier.
- Share-holder schedule: capacity, location class, trigger set
- Protector veto over any re-share ceremony
- Disclosure carve-outs where trusts law demands beneficiary information
Continuity
Drill & Re-share Calendar
Once a year the family reconstructs a test seed from the live share map — never the production seed — and confirms every vault, escrow and holder still performs. After divorce, death, trustee change or cross-border move, a full re-share ceremony retires the old set. Stale maps kill more estates than fires do.
- Annual test-seed drill, minuteed and filed
- Mandatory re-share triggers written into the deed
- Holder confirmations in writing, every twelve months
Matching schemes to families
| Family profile | Recommended scheme | Distribution sketch | Watch-out |
|---|---|---|---|
| Married, adult children, self-custody | 3of5 single group | 2 family vaults · trustee · attorney escrow · offshore bank box | Spouses must not hold 3 shares between them |
| Founder + corporate trustee | 2 groups: family 2of3 + fiduciary 2of3, global 2of2 | Family shares domestic; fiduciary shares with trustee & protector | Neither faction can act alone — by design |
| Blended or contentious family | Fiduciary-heavy: family 1of2 + fiduciary 2of3 | Family holds influence, not control; trustee executes the deed | Prevents share-holder standoffs at death |
| Multi-jurisdiction family | Geographic groups per residence | One group per tax residence; global threshold spans groups | Align with the regulatory navigation map first |
Five rulebooks for the same steel
The mathematics travels; the law does not. Where shares may sit, who may hold them, and what death does to the assets they unlock — all local questions.
For UK readers — inheritance tax meets the bank’s strongroom
IHTA 1984 · Property (Digital Assets etc.) Act 2025 · Trustee Act 2000 · relevant property regime
For UK readers, shares in a SLIP39 set are themselves property, and the assets they unlock sit inside the 40% inheritance-tax net above the frozen £325,000 nil-rate band. The practical UK questions are custodial: whose strongroom holds the plates, and what does the trustee’s duty of care demand? A discretionary trust holding crypto needs express powers over digital assets, and plates left in a sole-name bank box will still march through the estate regardless of the cryptography.
How the structure adapts
- Place fiduciary shares with the trustee company, not in personal boxes; document the custody chain for HMRC.
- Spousal exemption first: assets passing between spouses waste no nil-rate band — align share triggers with that flow.
- Consider whole-of-life cover written in trust to fund the IHT bill without forcing a fire-sale of recovered coins.
In Canada — the deemed disposition waits at the door
ITA s.70(5) · Estate Administration Tax · alter ego trusts s.73 · dual wills (ON)
In Canada, this works differently: death is a deemed sale. Recovered crypto is taxed on its accrued gain before the children see it, and Ontario’s 1.5% probate levy applies to whatever passes through the estate — which is exactly why the shares’ legal placement matters as much as their physical one. Shares titled to an alter ego trust (65+) roll over tax-free at creation and skip probate at death; shares left “in the house” do neither.
How the structure adapts
- Map fiduciary shares into the alter ego / joint spousal trust schedule, not the personal estate.
- Use dual wills in Ontario so the share-map document never enters the public probate file.
- Remember registered wrappers beside the vault: TFSA flows tax-free to a spouse; RRSP does not.
Australia — super, SMSFs and the bank-box paper trail
SIS Act · BDBN rules · ATO record-keeping · CGT event K3
Australia’s angle is the regulator’s eye: if any slice of the portfolio sits in an SMSF, the ATO expects the fund’s digital-asset records to be fund-owned and auditable — a private SLIP39 set guarding SMSF keys must be documented in the fund’s minutes, not hidden from them. Meanwhile super death benefits still bypass the estate entirely, so the share architecture and the binding death benefit nomination must point at the same people or the family inherits a dispute.
How the structure adapts
- SMSF-held keys: record the share scheme in fund minutes; keep personal and fund shares in separate groups.
- Preserve cost bases at every re-share for CGT purposes; K3 applies when assets leave to non-residents.
- Bank boxes: Australian institutions vary on third-party access — escrow agreements must be signed before deposit.
New Zealand — the disclosure tension
Trusts Act 2019 · ITA 2007 s.CB 4 · no estate duty
New Zealand offers no estate duty and a clean trusts statute — and one sharp thorn: the Trusts Act 2019 presumes beneficiaries receive trust information. A SLIP39 map is precisely the information a settlor may wish to withhold from a twenty-year-old. The deed must therefore engineer disclosure deliberately: what is disclosed (existence, trustee identity), what is withheld (locations, thresholds), and the justified reasons, recorded before anyone asks.
How the structure adapts
- Draft disclosure carve-outs with reasons contemporaneous to the share map.
- KiwiSaver nominations aligned to the same succession logic as the share groups.
- Document acquisition intent at purchase — s.CB 4 audits reconstruct intent badly.
United States — step-up, escrow and the directed trust
IRC §1014 step-up · RUFADAA · SD/WY/NH directed-trust statutes · state bank-box law
For US families the prize is the step-up in basis: recovered assets held until death escape capital gains entirely, which makes recoverability a tax strategy, not just a safety one. Directed-trust states let the share-map sit with an independent “digital assets director” while the corporate trustee handles distributions — and attorney escrow agreements solve the bank-box access problem that state statutes otherwise leave to probate.
How the structure adapts
- Hold appreciating cold storage to death; gift growth assets into SLATs instead — the share map serves both.
- Name the digital assets director in the directed trust; RUFADAA consent in every deed.
- If death is sudden and accidental, the estate may also hold injury claims — a reason families keep our executive car accident brief in the same file.
The registered-sleeve library
Canada · Passive coreBest index funds in Canada: XEQT & VGROThe traditional core that balances a threshold-protected digital sleeve.
UK · Tax wrappersISA investing for beginnersSheltering sterling while the crypto sits behind steel and deed.
UK · Household systemsBest UK budgeting appsBuilding the complete inventory that a share ceremony starts from.
Australia · SequencingSuperannuation vs ETF investingTwo buckets, two succession paths — drafted in harmony.
Australia · LiquidityHigh-interest savings accounts AUProbate liquidity while the share drill runs its course.
New Zealand · RetirementKiwiSaver vs index fundsAligning the nomination with the share groups under the 2019 Act.
Method · SeriesThe shard-and-deed methodHow SLIP39 engineering and trust law combine into one plan.
Tax strategies that require a recoverable asset
Every optimization below is worthless if the seed is lost — tax planning is the dividend of recoverability. This is the ledger we run once the share architecture holds.
| Jurisdiction | Death-time treatment | The planning move | SLIP39 interaction |
|---|---|---|---|
| United States | Step-up in basis (§1014); estate tax above exemption | Hold appreciating coins to death; gift growth into SLATs | Share map must serve both holding and gifting vehicles |
| Canada | Deemed disposition at FMV | Spousal rollover; alter ego trust; insurance for the tax bill | Fiduciary shares titled to the trust, never the personal estate |
| United Kingdom | IHT 40% above frozen bands | Spousal exemption; trusts; whole-of-life cover in trust | Trigger set aligned with the exemption flow |
| Australia | CGT deferred to estate/beneficiary; K3 for non-residents | Preserve cost bases; 50% discount planning; super outside estate | Re-share events documented for cost-base continuity |
| New Zealand | No estate duty; gains taxed on purpose-of-disposal | Intent documentation; trust distribution timing | Disclosure carve-outs keep the map private lawfully |
Four ways share plans still die
The cloud photograph
A share plate, photographed “just in case”, synced to a cloud account whose recovery email died with its owner. The threshold math was perfect; the operational discipline was not. When disputes over tokenized holdings turn litigious, patterns like this surface in discovery — see our brief on smart-contract disputes over RWA.
The fix: deed-level prohibition on digital copies; ceremony includes a phone-and-cloud sweep.
The single strongroom
All five shares, five “separate” envelopes, one bank box. A frozen branch, a sealed probate box, and the threshold became unreachable precisely when it was needed. Physical redundancy is legal design, not logistics.
The fix: geographic separation rule written into the deed rider; no two shares in one building.
The unlabeled envelope
Shares existed, but nothing in the legal file said which envelopes they were, what threshold governed, or who the holders were in law. The trustees reconstructed the map from memory — expensively, and late. Where recovery becomes contested, litigation funding sometimes enters the story; documentation keeps it out.
The fix: serial-numbered plates matched to a holder schedule in the deed; minute filed with counsel.
The stale ceremony
A perfect 2019 ceremony, untouched through a divorce, a trustee resignation and two relocations. Two of five shares sat with people who were now adversaries. The math tolerated it; the family did not.
The fix: mandatory re-share triggers (divorce, death, trustee change, move) written into the deed.
The 60-day ceremony
-
Exposure audit
Every seed, backup and photograph of a backup, mapped and assumed leaked until proven otherwise.
Days 1–7
-
Threshold design
Groups and thresholds set against the family map: who must never act alone, who must never act at all.
Days 8–14
-
Generation ceremony
Offline generation, dual-device verification, witnessed destruction of the single-seed record, minute signed.
Day 21
-
Medium & distribution
Plates stamped, vaults contracted, escrow agreements signed, physical layer insured and scheduled.
Days 22–40
-
Legal wrapping
Deed rider, holder schedule, RUFADAA consent, letter of wishes, per-jurisdiction tax positioning.
Days 40–55
-
Drill & calendar
First test-seed drill executed; annual drill and re-share triggers entered into the governance calendar — the same calendar a family AI-governance framework can police without ever seeing a share.
Day 60 · then annually
What the ceremony costs
| Component | Typical range (USD) | Driver of variance |
|---|---|---|
| Threshold design & legal wrapping | $8,000 – $35,000 | Groups, jurisdictions, deed complexity |
| Generation ceremony & plate stamping | $2,000 – $9,000 | Share count, witness & notary requirements |
| Vaults, bank boxes & escrow agreements | $1,500 – $8,000 / yr | Geography, institution tiers |
| Insurance scheduling for physical layer | $800 – $5,000 / yr | Declared values, bundling with existing policies |
| Annual drill & re-share governance | $3,000 – $12,000 / yr | Holder count, cross-border logistics |
Asked at the ceremony table
No. Multisig protects the wallet at the blockchain level; SLIP39 protects the seed at the human level. They are complementary layers: a SLIP39 share set can guard each multisig key, and a single-seed wallet can be protected by SLIP39 shares. Confusing the two layers is the most common design error in crypto succession.
The workable default for most families is five shares with a threshold of three, distributed across family members, fiduciaries and geographic vaults. Families with a corporate trustee often use two groups — a family group and a fiduciary group — so that no single faction can reconstruct alone.
Only if you design it that way. The deed and the letter of wishes define the exact trigger set — death certificate, incapacity certification, or court order — and the share distribution makes unauthorized reconstruction mathematically impossible below threshold.
Stamped steel or titanium plates, or sealed laminates, kept in separate geographic vaults. Paper degrades and burns; photos and cloud storage convert a physical secret into a global one. The medium is part of the legal design, not an afterthought.
Native support is strongest in the Trezor ecosystem; other setups can still use SLIP39 by generating shares offline from an existing BIP39 seed during a ceremony and then retiring the original single-seed record. The ceremony, not the device, is the standard.
Nothing catastrophic, provided the threshold still meets — that is the entire point of the scheme. At the next annual drill the family can run a re-share ceremony, retiring the old share set and issuing a fresh one aligned with the current family and fiduciary map.
Who stands behind this dossier
Methodology & standards
- Human-drafted, practitioner-reviewed line by line before publication.
- Statutory references checked against primary instruments at review date.
- Share-scheme examples are educational patterns, not individual advice.
- Material regulatory change triggers an out-of-cycle update.
The series · internal reading order
№ 17 · Digital Asset Trust Structure
№ 18 · SLIP39 Estate Planning (this dossier)
№ 19 · Digital Asset Regulatory Navigation
№ 20 · AI Governance Board Framework
№ 21 · High-Value Condo Insurance Bundling
№ 22 · Digital Asset Litigation Funding
№ 23 · Smart Contract Dispute · RWA
№ 24 · Executive Car Accident Lawyer
Data · 2026 Executive Digital Asset Risk Index
Hub · All Insights
Educational commentary, not legal, tax or investment advice. Engage qualified counsel in each relevant jurisdiction before acting. Full disclaimer applies.
Design the ceremony before the seed becomes a secret no one can use.
Family offices and trustees can request the Shard Ceremony Playbook — threshold worksheets, ceremony minute templates, escrow agreement checklists and the jurisdiction ledger.
Response within 48 hours · NDA on request · No custody offered through this publication
/slip39-estate-planning
© 2026 DeWealthy · Disclaimer · Privacy
