Key Takeaways
- Somewhere between 2.3 and 3.7 million BTC — roughly 11% to 18% of the 21 million that will ever exist — is estimated to be permanently lost, largely to forgotten passwords and backups that never actually worked.
- A BIP39 passphrase has no "wrong password" error. Typing "Vault" instead of "vault" opens a different, valid, empty wallet with no warning.
- The only way to know a backup works is to restore from it on a wiped or spare device and confirm the addresses match your original wallet.
- Adding a passphrase or multisig before verifying your basic seed backup multiplies the ways things can fail rather than reducing them.
The Part of the Coldcard Story People Skipped
On July 31, 2026, Coinkite disclosed that a firmware bug had been weakening the randomness behind Coldcard seed phrases since March 2021. Attackers drained roughly 594 BTC — about $38 million — from around 500 wallets in the first wave, and reporting over the following days put the total above 1,800 BTC and north of $116 million across more than 5,200 addresses.
The detail worth sitting with: those victims did nothing wrong operationally. Many had steel-stamped backups in safes. As our breakdown of the Coldcard flaw explains, the failure happened during seed generation, before those words ever hit the screen.
Let me be straight: a test restore would not have caught that particular bug — a weak seed restores perfectly. But the incident forced an uncomfortable question into the open. How many people hold a backup they've never once exercised? An untested backup isn't a safety net. It's a belief about a safety net.
An Untested Backup Is a Guess, Not a Plan
Theft gets the headlines — TRM Labs counted $2.1 billion stolen through crypto attacks in the first half of 2025, with roughly $1.71 billion from 34 wallet-related incidents. But quiet, self-inflicted loss is the bigger bucket over time, and it involves no attacker at all.
The failure modes are mundane. A handwritten "d" that reads as "cl." Two words from the 2,048-word BIP39 list that look alike at a glance. Word 14 and word 15 swapped during transcription. None of these announce themselves. Your hardware wallet keeps working, and the error surfaces only on the day the device is gone and the paper is all you have.
Here's the tell that this is common: an entire cottage industry exists to repair typo'd, reordered, or incomplete seed phrases after the fact. Businesses don't survive on rare problems. If you're still fuzzy on why those words carry so much weight, what a private key actually is is worth ten minutes first.
How to Run a Test Restore
The drill takes about thirty minutes and validates the one thing you can't validate by looking at it.
- Use a second device rather than wiping your current one. Wiping only makes sense if you already trust the backup you're about to test, which is circular. A spare hardware wallet kept aside as a dedicated restore-testing unit lets you run this without touching your working setup. An old device you have already replaced works fine for this.
- Restore using only the written backup. Not your memory. Not a photo. Type exactly what's on the paper or steel, word for word. If you have to squint or guess, you just found your problem.
- Compare receive addresses. Generate the first receive address on the restored device and compare it, character for character, against the same address on your original wallet. Identical means your backup is real. Different means something is wrong — and you've learned that while you still have both.
- Wipe the test device afterward. Don't leave a second live copy of your wallet in a drawer.
Only after that address matches should you consider adding anything on top.
The 13th Word: What a Passphrase Really Does
A BIP39 passphrase — often called the "13th word" for a 12-word seed or the "25th word" for a 24-word seed — is a string you choose yourself. It isn't drawn from the BIP39 wordlist, and it can be any length or character set. Combined with your seed, it produces an entirely separate wallet.
That's genuinely useful: someone who finds your seed phrase gets nothing without it. But it carries a property most guides gloss over — there is no validation. Enter the wrong passphrase and nothing fails. You get a different wallet, empty, looking perfectly healthy. Enter no passphrase and you get yet another wallet, also empty, also normal-looking.
So the common belief that "if I forget the passphrase I can still get in with just my seed" is exactly backwards. No manufacturer stores it, and there is no reset. Seed-recovery services regularly field cases where the words were preserved perfectly and the passphrase was not. If you add one, it needs its own tested backup, with capitalization and spacing recorded precisely.
Multisig Adds Keys — and New Ways to Fall Short
Multisig splits signing authority across several keys, typically 2-of-3, so no single seed phrase can lose or leak everything. Collaborative custody services like Casa and Unchained have pushed this to retail holders through 2025 and 2026, often alongside estate planning — a theme we cover in what happens to your crypto when you die.
The trade-off is that you've replaced one point of failure with a threshold. Lose two of three keys and the remaining one is worthless. Back up the keys but not the wallet descriptor — the configuration file describing the quorum and derivation paths — and you can hold enough keys without being able to reassemble the wallet.
The equivalent drill: before funding the vault meaningfully, set one device aside as if it were lost and confirm the remaining two can still sign to a fresh address. Store the descriptor alongside every key.
Make It a Habit, and Count the Cost
Test restores aren't a one-time ritual. Paper fades, safes get moved, households change. Once a year is a reasonable cadence, and it's worth repeating after any event that relocates your backup — a house move, a new safe deposit box, an inheritance conversation.
None of this is free. A spare device costs money, and the drill takes an afternoon. There's also a real security consideration: every restore is a moment your seed exists somewhere new, so do it alone, offline, away from cameras and phones — the same instinct that helps you spot a crypto scam applies at your own kitchen table.
But the alternative isn't "no risk." It's unmeasured risk. Self-custody moves responsibility to you completely, and the honest version of that responsibility includes verification, not just storage. A backup you've restored is a fact. A backup you've only written down is a hope.