This one is not a single event. It is the most common amateur backup scheme in crypto: cut the seed phrase in two, store the halves apart, and reason that neither half is any use on its own.
Each half is a great deal of use. Security does not fall away smoothly as words leak. It falls off a cliff.
The decision point is that the holder reasoned about it socially, as two people each holding half a story, rather than arithmetically. The arithmetic takes two minutes and reverses the conclusion.
Shamir Secret Sharing has a forbidding name. It sounds like a graduate course you forgot you enrolled in. The idea is old and elegant and you can use it without ever seeing the mathematics.
But we are going to do one piece of arithmetic first, because it is the reason the whole technique exists.
Why splitting in half is worse than not splitting
A BIP-39 wordlist has exactly 2,048 entries, which is 2 to the power of 11. So each word carries 11 bits.
A 12-word phrase carries 128 bits of entropy (12 words is 132 bits of encoding, of which 4 bits are a checksum).
Suppose you split it in half and an attacker obtains 6 words, in known positions.
Remaining search space = 6 words x 11 bits = 66 bits.
Now compare the two numbers directly.
Full phrase: 2 to the power of 128, roughly 3.4 x 10^38. Half leaked: 2 to the power of 66, roughly 7.4 x 10^19.
The reduction factor is 2 to the power of 62, or about 4.6 quintillion times easier.
66 bits is not trivially breakable by an amateur today. That is not the point. The point is that 128 bits is in the class of things nobody breaks, and 66 bits is in the class of things a well-resourced and motivated attacker can put real money against. You did not halve your security. You moved it into a different category.
Two honest footnotes. A 24-word phrase carries 256 bits, so half of it leaves around 132 bits, which remains out of reach. And an attacker who does not know which positions they hold has more work to do. Neither footnote rescues the method for a 12-word seed, and neither is a reason to design around it.
Two halves means an attacker needs both, like a nuclear launch key.
That intuition is where the method comes from and it is wrong. A launch key is designed so that one half authorises nothing. A seed phrase is not designed that way at all. Half of it is a partial answer, and partial answers are what brute force is for.
The property that fixes it
Shamir's idea, from the late 1970s, splits a secret into pieces with a very specific behaviour.
- Pick a total number of pieces. Call it five.
- Pick a threshold below the total. Call it three.
- Any three pieces, in any combination, rebuild the secret exactly.
- Any two pieces reveal nothing. Not part of it. Not most of it. Nothing.
Point four is the whole thing. Two pieces is not sixty percent of the secret. It is mathematically zero information about the secret. Three pieces is all of it. The transition is a cliff edge in the direction that helps you, which is precisely the opposite of what naive splitting gives you.
What that does to the trade-off
Recall the dial from F110-01. Splitting properly bends it.
Premature disclosure gets harder, because no single person ever holds anything meaningful. A share falling into the wrong hands is not a partial breach; it is a non-event.
Posthumous unrecoverability also gets easier to solve, because you can distribute pieces across several people and places and stay recoverable as long as enough of them survive and can be brought together.
Pick parameters that match the trust map you actually have:
- Three of five. Five holders, any three recover, any two losses are survivable.
- Two of three. Spouse, sibling, attorney. Simpler to coordinate for a smaller circle.
- Two of four with geography. Two pieces in your home country, two abroad, so a single-jurisdiction event does not reach the threshold.
Working through the scenarios
Say the secret is a 24-word phrase and you choose three of five. Share 1 in a home safe. Share 2 in a bank deposit box. Share 3 with your spouse. Share 4 with a sibling in another state. Share 5 sealed with your attorney.
- House fire destroys the safe. Share 1 gone, four remain, three needed. Fine.
- You die. The family opens the attorney's envelope, the deposit box, and calls the sibling. Shares 5, 2 and 4. Threshold met. Recovered.
- A burglar takes the safe. They have one share. One share is nothing.
- The spouse and sibling are not speaking to the attorney. They hold two, and need one more. The sibling travels to the bank. Recovered.
The plan absorbs a lot of single-point failures. It does not absorb everything: three shares stolen in a coordinated way still defeats it. What has changed is how much damage is required.
Your seed is split into 5 shards. Any 3 reconstruct it. Any 1 or 2 reveal nothing. Pick which holders the attacker (or the disaster) reaches and watch what happens.
Nothing reached. Seed intact. The whole point of the split is that the seed never sits in one place an attacker or a fire can reach.
Toggle holders to model real scenarios. House fire = shards 1 and 2. Family-knowing attacker = shards 1, 2, 3. Etc.
Four things it does not do
It does not encrypt anything. The shares are not encrypted copies. The protection is structural.
It does not need ongoing infrastructure. Once generated the shares are static text, like the seed. No server, no service, no subscription that can lapse.
It does not solve the knowledge problem. Your family still has to know Shamir was used, where the shares are, and how to combine them. F110-06 is that document. The mathematics is sound and the social procedure around it is still yours to build.
It does not authenticate anyone. Whoever assembles the threshold reconstructs the secret. If the wrong people coordinate, the protection is gone. The trust map is the actual security model, not the algorithm.
Shamir is sensitive to implementation detail and the cost of a buggy one is total. Use a reviewed standard. SLIP-39 is the most widely supported in this space and produces shares that are themselves word lists, so you can back them up exactly the way you back up a seed. Several hardware wallets generate SLIP-39 shares natively at setup, and standalone open tools exist for doing it yourself. Do not roll your own, and do not follow splitting instructions from a forum post.
The decision it asks of you
Using this well requires answering a real question: who do you trust, and in which combinations?
Five family members is strong if the family bonds hold. Five institutions is strong if they outlive you and stay honest. Five near-strangers is strong if no three of them ever coordinate against you. There is no abstract right answer. You draw the trust map by looking honestly at the relationships and locations you actually have, and then you pick N and K to match it.
Cutting a seed in half does not halve its security, it collapses it, and the arithmetic to prove that takes two minutes. Shamir splits a secret so that any K of N pieces rebuild it and any fewer reveal nothing at all. Pick the parameters to fit your real trust map, use a reviewed implementation such as SLIP-39, and remember that the mathematics protects the secret while only your documentation protects your family's ability to use it.