{ "meta": { "title": "D-Central — Bitcoin Inheritance & Collaborative-Custody Options", "description": "15 Bitcoin inheritance schemes scored vendor-neutrally: trust model, ON-CHAIN vs OFF-CHAIN enforcement (does the handover survive the vendor?), heir skill required, revisability, privacy/KYC, cost (2026), open-source reproducibility, Canadian availability and realistic failure modes.", "generated": "2026-07-18T06:06:04+00:00", "version": "1.0", "license": "https://creativecommons.org/licenses/by/4.0/", "license_name": "CC BY 4.0", "source": "https://d-central.tech/bitcoin-inheritance-planner/", "record_count": 15, "method": "Self-sovereign-first editorial stance; providers scored honestly as trade-offs. The load-bearing dimension is enforcement: ON-CHAIN (Miniscript/OP_CSV timelocks — Bitcoin executes the handover even if the vendor dies) vs OFF-CHAIN (a company procedure that dies with the company). Pricing verified from vendor sites July 2026 where possible; unverifiable figures say unverified. Evidence grade: A = primary/vendor source, B = corroborated secondary, C = single source.", "provenance": "Vendor documentation and pricing pages (Casa, Nunchuk, Unchained, Bitkey, AnchorWatch, Wizardsardine/Liana, Theya, Onramp, Swan), protocol specs (SLIP-39, BIP-39, BIP-48, Miniscript, OP_CSV/CLTV), wallet documentation.", "disclaimer": "Not legal, tax or financial advice. Bitcoin estate planning intersects provincial succession law — align any scheme with a valid will and executor instructions through a Canadian estate lawyer. Pricing and availability change; verify with the vendor before committing funds." }, "rows": [ { "id": "metal-letter", "name": "Metal backup + instructions letter", "group": "self-sovereign", "trust_model": "You alone. One seed on a metal plate plus a letter telling the heir what it is and how to restore it.", "enforcement": "off-chain (physical access)", "heir_action": "Find the plate and letter, restore into any BIP-39 wallet, sweep. The lowest skill bar of any scheme.", "revisability": "Free to re-stamp; rotating the seed means moving coins.", "privacy": "No third party learns anything.", "cost": "~CAD 30–165 one-time (plate).", "open_source": "BIP-39 — universal.", "canada": "yes", "failure_modes": "Whoever finds plate+letter owns the coins (no threshold, no timelock); plate lost with no copy; letter found by the wrong person first.", "evidence_grade": "A", "heir_skill_needed": "low", "company_key": "none", "onchain": "no", "survives_vendor": "yes", "refresh": "no", "kyc": "none", "amount_fit": "small", "multi_heir": "no", "notes": "The honest default for small stacks and non-technical heirs: maximum usability, minimum theft resistance. Pair with a passphrase or graduate to SLIP-39 as the stack grows." }, { "id": "seed-passphrase", "name": "Seed + passphrase split (BIP-39 25th word)", "group": "self-sovereign", "trust_model": "You alone. Seed in one place, passphrase in another; neither alone spends.", "enforcement": "off-chain (two-factor storage)", "heir_action": "Locate BOTH parts and enter them in any BIP-39 wallet. The passphrase is exact and case-sensitive with no checksum — one wrong character silently opens an empty wallet.", "revisability": "New passphrase = new wallet = move UTXOs (on-chain fee).", "privacy": "No third party.", "cost": "Free with existing hardware.", "open_source": "BIP-39 standard — universal.", "canada": "yes", "failure_modes": "Passphrase lost or mistyped = unrecoverable even WITH the seed; heir doesn't know a passphrase exists and finds only a decoy balance; both parts stored together.", "evidence_grade": "A", "heir_skill_needed": "medium", "company_key": "none", "onchain": "no", "survives_vendor": "yes", "refresh": "no", "kyc": "none", "amount_fit": "any", "multi_heir": "no", "notes": "Cheapest real 2-factor split — and the highest silent-failure risk here. The heir must be TOLD the passphrase exists." }, { "id": "slip39", "name": "SLIP-39 Shamir shares (Trezor)", "group": "self-sovereign", "trust_model": "You alone. An m-of-n threshold of share cards reconstructs the seed on-device; no company can move, block or see funds.", "enforcement": "off-chain (threshold storage)", "heir_action": "Gather the threshold number of shares, restore into a Trezor (or SLIP-39-aware wallet), sweep. Cross-wallet signing support is still thin in 2026 — leave explicit restore instructions.", "revisability": "Regenerate shares free anytime; coins don't move for a re-share.", "privacy": "No third party.", "cost": "~CAD 110–230 one-time (Trezor Safe).", "open_source": "Open SatoshiLabs spec, reference implementation public.", "canada": "yes", "failure_modes": "Heir finds fewer than m shares; heir tries restoring into an incompatible wallet and assumes loss; shares co-located defeats the split.", "evidence_grade": "A", "heir_skill_needed": "high", "company_key": "none", "onchain": "no", "survives_vendor": "yes", "refresh": "no", "kyc": "none", "amount_fit": "any", "multi_heir": "yes", "notes": "Best pure-DIY threshold backup. The m-of-n redundancy is exactly what N-of-N SeedXOR lacks." }, { "id": "seedxor", "name": "SeedXOR (Coldcard)", "group": "self-sovereign", "trust_model": "You alone. XOR splits the seed into N parts, each itself a valid decoy-capable seed.", "enforcement": "off-chain (N-of-N storage)", "heir_action": "Gather ALL parts (no threshold) and XOR them back on a Coldcard. Decoy funds on parts can confuse an uninformed heir.", "revisability": "Re-split free on-device.", "privacy": "No third party.", "cost": "~CAD 205–235 one-time (Coldcard).", "open_source": "Documented open method; reproducible by hand.", "canada": "yes", "failure_modes": "Losing even ONE part = total loss; heir mistakes a decoy for the real wallet; heir stops after finding some parts.", "evidence_grade": "A", "heir_skill_needed": "high", "company_key": "none", "onchain": "no", "survives_vendor": "yes", "refresh": "no", "kyc": "none", "amount_fit": "any", "multi_heir": "no", "notes": "Elegant and vendor-free, but N-of-N fragility makes it a poor PRIMARY inheritance scheme — SLIP-39's threshold is kinder to heirs." }, { "id": "diy-multisig", "name": "Geographic 2-of-3 self-run multisig", "group": "self-sovereign", "trust_model": "You alone (optionally + a trusted co-signer). Three keys, three locations, any 2 sign. Rug-proof; run your own node for full privacy.", "enforcement": "off-chain (key distribution)", "heir_action": "Locate 2 of 3 devices/seeds AND the wallet descriptor (without the descriptor the keys are useless — the #1 loss vector), assemble in Sparrow/Nunchuk, sign a PSBT. The highest heir skill bar here.", "revisability": "Key rotation = new quorum + move every UTXO (on-chain fees).", "privacy": "None leaked if self-noded; a public Electrum server would see balances.", "cost": "~CAD 275–620 one-time (3 mixed-brand signers). Software free.", "open_source": "BIP-48/descriptors/Sparrow/Nunchuk — fully reproducible.", "canada": "yes", "failure_modes": "Heir has keys but no descriptor → stranded funds; heir can't assemble a multisig; locations too dispersed to physically reach.", "evidence_grade": "A", "heir_skill_needed": "expert", "company_key": "none", "onchain": "no", "survives_vendor": "yes", "refresh": "no", "kyc": "none", "amount_fit": "large", "multi_heir": "yes", "notes": "The gold standard for a technically strong holder. Store a copy of the descriptor WITH EACH key and write the heir a step-by-step letter — or it fails ordinary heirs." }, { "id": "liana-ce", "name": "Liana Community Edition (Miniscript timelock decay)", "group": "self-sovereign", "trust_model": "You alone. Spending policy lives in Bitcoin script: your key spends anytime; recovery key(s) become valid only after a relative timelock (OP_CSV) elapses. Free, open-source, runs on your own node.", "enforcement": "ON-CHAIN — works even if Wizardsardine disappears", "heir_action": "Wait out the timelock (the dead-man switch), then sign with the recovery key in the free Liana app. Needs the recovery key + descriptor and basic Liana literacy.", "revisability": "Policy change = new descriptor + move coins. The recurring cost is REFRESH: re-spend UTXOs before each timelock matures or the recovery path goes live while you're alive.", "privacy": "Self-hosted, no third party.", "cost": "Free software; hardware signers extra.", "open_source": "Fully open (wallet + Miniscript standard); vendor-independent recovery.", "canada": "yes", "failure_modes": "Missed refresh discipline opens the recovery path early; heir doesn't understand the WAIT; descriptor lost.", "evidence_grade": "A", "heir_skill_needed": "medium", "company_key": "none", "onchain": "yes", "survives_vendor": "yes", "refresh": "yes", "kyc": "none", "amount_fit": "any", "multi_heir": "yes", "notes": "The strongest self-sovereign inheritance primitive shipping in 2026: Bitcoin itself enforces the handover. The price is refresh discipline — a calendar habit, not a product." }, { "id": "raw-csv", "name": "Hand-rolled OP_CSV / OP_CLTV dead-man switch", "group": "self-sovereign", "trust_model": "You alone. Raw timelock script where an heir key activates after a threshold.", "enforcement": "ON-CHAIN", "heir_action": "Wait for the lock, then spend with tooling that understands the custom script. Essentially building Liana by hand.", "revisability": "Any change = new script + move UTXOs; absolute locks must be re-locked before the date passes.", "privacy": "No third party.", "cost": "Free (Bitcoin Core + your own competence).", "open_source": "Consensus opcodes.", "canada": "yes", "failure_modes": "Script authoring error locks funds forever; heir can't reproduce the witness; forgotten re-lock opens the heir path early.", "evidence_grade": "B", "heir_skill_needed": "expert", "company_key": "none", "onchain": "yes", "survives_vendor": "yes", "refresh": "yes", "kyc": "none", "amount_fit": "any", "multi_heir": "no", "notes": "Documented for completeness. For 99% of users Liana or Nunchuk deliver the same on-chain guarantee without DIY-scripting risk." }, { "id": "nunchuk", "name": "Nunchuk (free DIY / Iron Hand / Honey Badger)", "group": "provider", "trust_model": "Collaborative custody with a self-sovereign spine: Honey Badger is 2-of-4 where YOU hold 3 keys (including a time-locked inheritance key) and Nunchuk holds 1. You can choose an ON-CHAIN timelock for the inheritance key — enforced by Bitcoin even if Nunchuk dies. Free tier is pure DIY multisig with no company key.", "enforcement": "hybrid — on-chain timelock OPTION (choose it) or assisted off-chain claim", "heir_action": "On-chain path: wait out the timelock, claim with the inheritance key. Assisted path: procedural claim via Nunchuk. Guided materials; moderate skill.", "revisability": "Rotate keys/plan in-app; coin-moving changes cost network fees.", "privacy": "KYC-lite on paid plans; the platform key sees plan balances. Free tier can run fully privately.", "cost": "Free tier CAD 0; Iron Hand ~CAD 165/yr; Honey Badger ~CAD 660/yr (July 2026).", "open_source": "Apps open-source, standard descriptors, vendor-independent recovery — the strongest open posture of the paid providers.", "canada": "yes", "failure_modes": "Heir confuses the two claim paths; free-tier DIY loses descriptor with no backstop; missed refresh if using a decaying on-chain setup.", "evidence_grade": "A", "heir_skill_needed": "medium", "company_key": "minority", "onchain": "option", "survives_vendor": "yes", "refresh": "yes", "kyc": "lite", "amount_fit": "any", "multi_heir": "yes", "notes": "For a self-sovereign-first Canadian, the standout provider: open-source, Canada-available, and the inheritance trigger can live in Bitcoin script rather than in a company's uptime. Choose the on-chain option." }, { "id": "bitkey", "name": "Bitkey (Block)", "group": "provider", "trust_model": "2-of-3: your phone key + your Bitkey hardware + a Block server key. Block alone can't move funds but sees balances. Inheritance = pre-invited beneficiary + 6-month security period, run by Block's infrastructure.", "enforcement": "off-chain (Block's procedure)", "heir_action": "Beneficiary needs their OWN Bitkey, accepts the invite IN ADVANCE, starts a claim, waits 6 months (you're pinged and can cancel). Consumer-app easy.", "revisability": "Change beneficiary free, in-app, instantly.", "privacy": "Block sees balances via the server key; KYC-lite app.", "cost": "~CAD 205 one-time hardware; inheritance included, no subscription — the cheapest provider option.", "open_source": "Firmware/app substantially open, but the server coordination and inheritance depend on Block; independent recovery without the server is the hard case.", "canada": "yes", "failure_modes": "Block sunsets the product or server → the switch and easy recovery are impaired; beneficiary never sets up their device; claim never initiated.", "evidence_grade": "A", "heir_skill_needed": "low", "company_key": "minority", "onchain": "no", "survives_vendor": "no", "refresh": "no", "kyc": "lite", "amount_fit": "small", "multi_heir": "no", "notes": "Lowest-friction, Canada-available, no-subscription inheritance for small stacks and non-technical heirs — priced honestly against its trade-off: the dead-man switch is Block's procedure, not Bitcoin's." }, { "id": "casa", "name": "Casa (Standard / Premium)", "group": "provider", "trust_model": "You hold the key majority (2-of-3 or 3-of-5), Casa holds one recovery key. Casa can't move funds alone but sees balances (KYC). Inheritance = in-app grant to a recipient with a 6-month waiting period, run by Casa.", "enforcement": "off-chain (Casa's procedure)", "heir_action": "Recipient gets a free membership, requests transfer in-app, 6-month timer runs (you're notified), then vault access unlocks. App-guided, low skill.", "revisability": "Change recipient procedurally; key rotation moves coins.", "privacy": "Casa (US) knows identity, balances, xpubs.", "cost": "Standard ~CAD 340/yr; Premium ~CAD 2,880/yr (July 2026).", "open_source": "Standard multisig with recovery docs — manual self-recovery is possible if Casa dies, but the guided inheritance flow dies with them.", "canada": "likely", "failure_modes": "Casa gone → heir falls back to manual multisig recovery (hard for a novice); recipient never claims; subscription lapses.", "evidence_grade": "A", "heir_skill_needed": "low", "company_key": "minority", "onchain": "no", "survives_vendor": "partial", "refresh": "no", "kyc": "full", "amount_fit": "large", "multi_heir": "yes", "notes": "The slickest heir UX in the industry, and you genuinely keep the key majority. You pay in three currencies: USD, KYC, and dependence on Casa's continued existence for the automatic switch." }, { "id": "unchained", "name": "Unchained (Inheritance Protocol)", "group": "provider", "trust_model": "2-of-3 collaborative: you hold 2 keys, Unchained 1. They can't move funds unilaterally and you can spend without them (open-source Caravan). Inheritance is a legal/concierge overlay (US TOD-style designation).", "enforcement": "hybrid — procedural claim on a self-recoverable multisig", "heir_action": "Beneficiary proves entitlement through Unchained's concierge/legal process; Unchained co-signs. Low heir skill; heavy process.", "revisability": "Beneficiary changes procedural; re-keying moves coins.", "privacy": "Full KYC; US company knows identity, balances, xpubs.", "cost": "Vaults free to hold; concierge onboarding ~US$1,200 one-time (verify current pricing).", "open_source": "Caravan coordinator is open-source — your 2 keys can always recover without Unchained. Legal wrapper proprietary.", "canada": "us-only", "failure_modes": "US-only onboarding blocks Canadians; heir can't complete the legal claim; provider bankruptcy (mitigated by your 2-key self-recovery).", "evidence_grade": "B", "heir_skill_needed": "low", "company_key": "minority", "onchain": "no", "survives_vendor": "partial", "refresh": "no", "kyc": "full", "amount_fit": "large", "multi_heir": "yes", "notes": "Structurally sound (you keep 2 of 3 and can leave any time via Caravan) — but US-centric and KYC'd. Not confirmed for Canada; treat as US-only." }, { "id": "anchorwatch", "name": "AnchorWatch Trident (insured, Miniscript)", "group": "provider", "trust_model": "Miniscript vault with AnchorWatch as a required co-signer while insured (Lloyd's of London coverage); time-locked recovery paths return control over time.", "enforcement": "hybrid — on-chain Miniscript recovery under an insured procedure", "heir_action": "Recovery via time-locked Miniscript paths coordinated through the insured process; the company hand-holds. On-chain paths survive the company; the insurance does not.", "revisability": "Policy changes are on-chain spends under insurance constraints.", "privacy": "Full KYC + insurance underwriting.", "cost": "Insurance-priced, quote-based; targeted at US$250K–100M holders.", "open_source": "Proprietary vault on open Miniscript — recovery paths are Bitcoin-native, product is not DIY-reproducible.", "canada": "us-only", "failure_modes": "US-only insured product; minimums exclude ordinary holders; insurer/provider dependency for the coverage itself.", "evidence_grade": "B", "heir_skill_needed": "low", "company_key": "required", "onchain": "option", "survives_vendor": "partial", "refresh": "no", "kyc": "full", "amount_fit": "large", "multi_heir": "yes", "notes": "The only real insurance + on-chain-recovery combination — and a US high-net-worth niche, not a pleb tool. Noted, not recommended, for a Canadian audience." }, { "id": "liana-business", "name": "Liana Business + Safety Net key agents", "group": "provider", "trust_model": "Same on-chain Miniscript decay as Liana CE — you hold your keys — plus hosted infrastructure and optional professional key agents who can act ONLY after a long timelock expires. Agents can't move funds early and can't block you.", "enforcement": "ON-CHAIN — survives Wizardsardine entirely", "heir_action": "Identical to Liana CE: wait out the timelock, recover with the designated key. Agents are an optional fallback, not a gate.", "revisability": "New policy = new descriptor + move coins; refresh discipline required.", "privacy": "Hosted tier is known-customer; the free CE remains the private path.", "cost": "~0.19%/yr of holdings for the hosted tier (July 2026); agent fees quote-based.", "open_source": "Fully open wallet + standard; vendor-independent recovery guaranteed.", "canada": "yes", "failure_modes": "Missed refresh; descriptor/key loss; agent-jurisdiction changes (mitigated: the on-chain path works without them).", "evidence_grade": "A", "heir_skill_needed": "medium", "company_key": "minority", "onchain": "yes", "survives_vendor": "yes", "refresh": "yes", "kyc": "lite", "amount_fit": "large", "multi_heir": "yes", "notes": "The strongest 'the company can die and you're fine' story among paid options — because the product IS the open-source wallet. Most users should simply run the free CE." }, { "id": "theya", "name": "Theya", "group": "provider", "trust_model": "You hold the key majority (2-of-3), Theya one recovery key. Inheritance = voluntary shared vault access with a family member/advisor, coordinated in-app.", "enforcement": "off-chain (shared-access procedure)", "heir_action": "Heir uses the pre-arranged shared vault access with Theya's coordination. Low-moderate skill.", "revisability": "Adjust sharing in-app; key rotation moves coins.", "privacy": "KYC-lite; Theya sees balances/xpubs.", "cost": "Free single-key tier; paid multisig tiers — pricing not cleanly published (unverified).", "open_source": "Standard multisig, recoverable descriptors; app proprietary.", "canada": "likely", "failure_modes": "Procedural sharing depends on Theya operating; a pre-added heir could act early (trust assumption); pricing opacity.", "evidence_grade": "C", "heir_skill_needed": "low", "company_key": "minority", "onchain": "no", "survives_vendor": "partial", "refresh": "no", "kyc": "lite", "amount_fit": "any", "multi_heir": "yes", "notes": "Reasonable collaborative custody, but its inheritance is vault-sharing, not an enforced switch — Nunchuk gives you the on-chain guarantee at a similar posture." }, { "id": "onramp", "name": "Onramp Multi-Institution Custody", "group": "provider", "trust_model": "2-of-3 across three institutions (Onramp, BitGo, Coincover) — YOU HOLD NO KEY. The client directs; institutions sign. Lloyd's insured; full KYC everywhere.", "enforcement": "off-chain (institutional procedure)", "heir_action": "Zero self-custody skill — succession is architected up front and Onramp coordinates the transfer to heirs.", "revisability": "Institutional/procedural.", "privacy": "Zero — three institutions know everything.", "cost": "AUM-based institutional fees (quote).", "open_source": "No; the client cannot self-recover — they hold no key.", "canada": "us-only", "failure_modes": "Fully dependent on institutional solvency and cooperation; regulatory freezes; not self-sovereign at all.", "evidence_grade": "B", "heir_skill_needed": "low", "company_key": "required", "onchain": "no", "survives_vendor": "no", "refresh": "no", "kyc": "full", "amount_fit": "large", "multi_heir": "yes", "notes": "Included for completeness: this is the least self-sovereign option on the list — closest to classic custody. A last resort for someone who explicitly refuses to hold any key, not an equivalent to key-holding custody." } ] }