Backups and inheritance without new vulnerabilities
Singapore Police said on 28 October 2026 that, since 10 September, at least two reported cases involving tampered Ledger hardware wallets purchased from some retail stores had caused about S$3.5 million in total losses. Preliminary investigations found malicious hardware components capable of capturing recovery phrases or private keys; police investigations remain ongoing and Ledger is reviewing the cases. If a device may be affected, do not enter a recovery phrase or conduct further transactions on it, and contact the provider through an independently verified official support channel. If a recovery phrase or private key may already be compromised, the police advisory says to consider moving remaining assets using an uncompromised device to a new trusted wallet with a newly generated recovery phrase. These are preliminary findings concerning reported devices, not evidence that all retail hardware wallets are affected.
See evidence →A recovery arrangement must survive loss and incapacity without creating an easy route for theft. The right design depends on the wallet and legal structure; do not mix incompatible recovery methods.
Handle recovery material correctly
For conventional seed based wallets, keep recovery words offline in a form protected against loss, theft and damage. Do not photograph them, email them, store them in cloud notes, paste them into a support chat or enter them into a website. Trezor's manufacturer guidance specifically warns against digital copies and sharing a backup. Follow the exact recovery instructions for your device. [S13]
A passphrase can derive a different wallet. Losing or mistyping it can leave you unable to access the intended funds. It is not merely a password that customer support can reset, and it is not evidence that a hidden wallet will protect you from physical coercion. [S14]
Do not invent your own scheme by cutting a word list into pieces, rearranging words or relying on memory. Supported threshold backups, multisignature and MPC are different systems. Have an expert explain the failure and recovery cases before adopting one.
Plan for real life
- Separate failures: a single fire, burglary, flood or travel bag loss should not destroy every required recovery component.
- Check access: a bank box or professional vault may have opening hours, access restrictions, jurisdictional issues or delayed estate access.
- Protect the index: a detailed map to every backup can itself enable theft. Separate general instructions from the secrets and exact access details.
- Verify recoverability with a manufacturer supported check or a controlled drill using small values. Do not expose live words on an ordinary computer to test them.
Make inheritance understandable
Work with an estate lawyer and custody specialist on incapacity, death, authorised decision makers and the legal ability to act. A technically usable key does not itself grant lawful ownership or authority.
Give the designated person a plain language explanation of whom to contact and what the process is. Avoid putting recovery words into a will that may become public. Plan ongoing living expenses so the family does not need to unlock reserves during the first hours of a crisis.
Review after changes: a new wallet, provider, signer, marriage, separation, move, illness or death of a participant. Recheck that instructions and actual configuration agree.
Acceptance question: can the intended people recover access lawfully when needed, while one lost device or compromised helper cannot take control alone?