Seed Phrase Storage Threat Model

A seed phrase threat model is a decision framework for choosing which failures deserve protection first. It does not begin with a product, safe, bank box, or number of copies. It begins with the recovery assets, the people involved, and the events that could expose or defeat the system.

Core question: Which realistic event could let an unauthorized person recover the wallet, or prevent every authorized person from recovering it?

The five questions that define the model

1. What must remain secret? The seed phrase, any required passphrase, and enough context to use them.
2. What must remain available? At least one accurate, readable, authorized recovery path.
3. Who may access each part? The owner, household members, trusted people, institutions, and future heirs.
4. Which events are realistic? Theft, copying, fire, water, loss, relocation, incapacity, and setup error.
5. Which control creates a new dependency? Every safe, extra copy, split, passphrase, institution, and trusted person changes the risk model.

Inventory the recovery system

List the components without writing the seed phrase itself:

• hardware wallet or signing device;
• each seed phrase backup and its medium;
• optional passphrase dependency;
• storage locations;
• locks, safes, seals, or institutional controls;
• authorized people and continuity instructions;
• verification process;
• temporary, duplicate, and retired records.

The model protects the recovery capability created by these components, not merely the most durable object.

Classify threats into five groups

Threat class	Typical failure	Primary design objective
Exposure	Someone reads, copies, photographs, or receives the secret.	Limit knowledge and physical access.
Destruction	Fire, water, corrosion, impact, fading, or disposal destroys readability.	Use an appropriate medium and environment.
Unavailability	The authorized person cannot find or reach any usable copy.	Preserve controlled access and independence.
Data failure	The words, order, wallet identity, or passphrase dependency are wrong.	Verify the complete recovery path.
Continuity failure	The plan depends on one person's memory, health, or undocumented knowledge.	Make authorized recovery understandable over time.

Score threats by four factors

Do not rank threats by fear alone. Score each scenario using:

• Consequence: What happens if the event succeeds?
• Plausibility: How realistically could it happen in this environment?
• Common-mode reach: How many recovery layers fail at once?
• Detectability: Would you know the system was exposed or unavailable before recovery is needed?

A moderate event that defeats every layer may deserve more attention than an extreme event with very low plausibility.

Find the common-mode failure

Multiple objects do not create resilience when they share one failure event.

Examples:

• the wallet and seed phrase are stored in the same safe;
• two backups are in the same building;
• every location depends on one person's memory;
• every recovery path requires the same unavailable passphrase;
• one trusted person controls all off-site access;
• all copies were created from the same unverified source record.

The highest-value improvement is often removing one common-mode dependency, not adding another copy.

Choose controls and record their new risks

Control	Risk reduced	New dependency created
Metal backup	Physical degradation	Setup accuracy, location fit, and unauthorized reading still matter
Second location	Local disaster concentration	Another exposure point and access process
Safe or vault	Casual access and some physical hazards	Key, code, institution, removal, and continuity risk
Optional passphrase	Seed-only compromise	Loss, memory, documentation, and inheritance risk
Tamper evidence	Undetected access	False confidence if treated as prevention
Split arrangement	Single-fragment compromise in a supported design	Coordination, ordering, availability, and reconstruction risk

A control is useful only when the risk it removes is larger than the dependency it introduces.

Build the model in eight steps

1. Define the wallet and value protected.
2. Inventory every recovery component and authorized person.
3. Name the two most plausible exposure paths.
4. Name the two most plausible loss or destruction paths.
5. Identify the data or passphrase error that would defeat recovery.
6. Find the event that reaches every layer.
7. Select one proportionate control for each priority threat.
8. Verify the complete recovery path after the controls are in place.

Keep the model at the level of roles, locations, and dependencies. Do not write the seed phrase in the worksheet.

Three model patterns

Single-person home setup

Likely priorities are household access, burglary, local fire or water, accidental disposal, and the wallet sharing a location with the only backup. The implementation belongs in Seed phrase storage at home.

Home plus off-site recovery

Likely priorities are location independence, transport, trusted-person or institutional access, jurisdiction, and the ability to recover when the primary property is unavailable. Use Seed phrase storage outside the home.

Continuity-sensitive setup

Likely priorities are owner incapacity, unclear passphrase handling, obsolete wallet records, and instructions that reveal too much or too little. Use Bitcoin inheritance basics and Family recovery instructions.

When to revisit the model

Rebuild or review it after a move, wallet migration, change in household access, new passphrase, new copy, retired copy, trusted-person change, suspected exposure, physical damage, or a meaningful change in the amount protected.

Turn the model into an implementation plan

The threat model decides what the system must survive. It does not choose the exact residential location, off-site counterparty, or backup product.

Continue with How to store a seed phrase safely to convert the priorities into a complete recovery architecture.

Choose by the dominant physical threat

No metal product solves exposure, loss, an unknown passphrase, an unverified seed, or a continuity plan that nobody can follow. Buy only after those risks are addressed.

When destruction and degradation are the dominant threats, Coinplate Alpha is the permanent-plate winner on this page. When irreversible setup error and future reuse are the dominant concerns, Billfodl is the better alternative.

Official Coinplate and Billfodl store affiliate links. We may earn a commission at no extra cost to you.

Check the broader ranking and each product's failure mode in Best metal seed phrase backups.

Seed phrase threat model FAQ

What is a seed phrase threat model?

It is a structured way to identify exposure, destruction, unavailability, data, and continuity risks before choosing storage controls.

What is the most important threat-model question?

Ask which realistic event could expose the wallet to an unauthorized person or remove every authorized recovery path.

Is theft always the biggest threat?

No. Wrong transcription, lost passphrases, shared-location failure, accidental disposal, and unclear continuity can be equally decisive.

Should the threat model start with a metal backup?

No. Start with the recovery assets, people, locations, and failure events. Choose a product only after physical degradation is identified as a priority threat.

Does a second copy automatically improve the model?

No. It helps only when it removes a defined common-mode failure and its new exposure and maintenance risks remain controlled.

How often should the threat model be reviewed?

Review it after material changes to the wallet, location, passphrase, household, trusted people, copy count, or physical condition.