Mellon did the security part well. He held his XRP in cold storage, distributed across multiple locations, registered under other people's names. That is a serious defence against theft and it worked. Nobody stole anything.
He died in April 2018. The holdings were never located.
The decision point was not a technical one. The map of where the pieces were and how they fitted together existed in exactly one head, was never written down, and was never rehearsed with anyone.
The blockchain does not have an estate department.
When a bank account holder dies there is a procedure. Death certificates, executors, court orders, frozen accounts that eventually unfreeze in the right hands. It is slow and expensive and imperfect, and it works. Wealth survives.
When a self-custodied holder dies, none of that applies. The chain has never heard of probate. No court can order a private key to produce itself. There is no next-of-kin field in a wallet. The funds sit at the address forever, visible to anyone, recoverable by no one, while the family stands on the other side of a wall whose only door was in the deceased person's head.
This is not an edge case. Estimates put permanently lost Bitcoin somewhere between 3 and 4 million coins, and a large and growing share of that is people who held, told nobody, and died.
The five places it fails
Crypto inheritance fails at almost every stage where a normal estate succeeds.
- The keys are not where the family looks. Estate documents reference accounts at known institutions. They do not reference the metal plate in the basement, or the hardware device in a deposit box the family does not know exists.
- The family does not know what they are holding. Even when they find the device or the words, they may not know it represents anything, or how to turn it into something they can use.
- Telling someone creates a different problem. The instinct is to write the seed into the will and be done. That seed now travels through lawyers, executors, court filings and family hands, years before anyone is meant to claim anything. One careless copy anywhere on that path and the funds belong to somebody else.
- Arrangements time out. Hardware fails. Passphrases get forgotten. Cloud accounts get deleted by inactivity policy. A backup that lives only in one trusted person's memory dies when they do.
- Nobody rehearses. Even good plans fail when the first test is the real one. The family has never restored a wallet, never opened a block explorer, never sent a transaction. The plan is a map of a city they have never visited.
Every one of these is solvable. None of them solve themselves.
The trade-off that never goes away
Two failure modes pull against each other, and you cannot minimise both by trying harder.
Premature disclosure. The secret leaks while you are alive and the funds are active. The relative who learned it tells someone. The lawyer's office is compromised. The envelope is opened by the wrong person at the wrong time.
Posthumous unrecoverability. You die before anyone knows enough. The keys are intact, the assets are intact, and the bridge from the family standing there to the wallet in front of them was never built.
Tell more people and the first risk rises. Tell fewer and the second rises. This is the entire design space of this course.
A really careful person can avoid both risks.
No. They are two ends of one dial. What a careful person does is choose the setting deliberately and then use tools that bend the curve: secret splitting, which lowers disclosure risk without lowering recoverability, and staged time-based release, which does the same at the cost of depending on a system. Both are covered later in this course. Neither removes the trade-off; they improve its terms.
What a plan has to have
Regardless of which tools you use, five properties separate a plan from an intention.
- The location of the keys is documented. Not the keys. The location, the form (paper, metal, device, software), and the order of access. That document is itself somewhere the family will actually find.
- The recovery procedure is written down and has been rehearsed at least once. Step by step, for a non-expert, on real hardware, with a small test amount.
- The disclosure timing is a decision. Maybe the spouse knows now. Maybe the children learn at a defined age. Maybe a third party releases information after a verified event. Whatever you pick, pick it.
- The plan survives partial failure. A sealed deposit box, a destroyed plate, a dead device. More than one path to the same outcome, and no path that depends on every component working.
- The plan gets updated. Marriages, divorces, births, deaths, moving countries, large balance changes. A static plan becomes a wrong plan.
Most plans fail one or more of these. The point is not perfection. The point is a document a real person can execute on the worst day of their life, tested before that day arrives.
The highest-leverage thing most holders can do this week is not better hardware or a different chain. It is one specific message to one specific person about where to look and who to call, with the rest sealed somewhere separate. That message can be fifty words. It will outlive almost every technical decision you make.
Why this course sits in Freshman year
You might expect inheritance to be an advanced topic. It is not. It belongs next to the wipe drill in F104 for the same reason: both are about whether value survives an event you do not control.
The difference is that the wipe drill tests whether you can recover. This course tests whether someone else can, without you, using only what you left behind. That is a harder problem and it takes longer to build, which is why starting it late is worse than starting it badly.
Most crypto is not lost in dramatic hacks. It is lost in silence, when holders die and nobody left behind can reach the keys. The chain has no estate department, so you build one yourself. Every plan trades premature disclosure against posthumous unrecoverability, and the rest of this course is about tools that improve the terms of that trade rather than pretending it away.