Hardware Wallet Inheritance: Ledger, Trezor, Coldcard, BitBox & KeepKey for Cross-Border Expat Families (2026)
In brief:
- Hardware wallets are the most secure way to hold crypto self-custody — and the hardest to inherit. The same security that protects you from thieves protects your heirs from access.
- Ledger, Trezor, Coldcard, BitBox and KeepKey each handle inheritance differently. Trezor's SLIP-0039 Shamir Backup is the only native multi-share inheritance system available on a major device today.
- For cross-border expat families, the right setup combines metal seed storage (Cryptosteel, Billfodl, Cobo), share distribution across 2–3 jurisdictions, and a clear retrieval protocol in a non-blockchain format your heirs can actually read.
- The hardware wallet protects the asset. Your inheritance plan protects the access. Sucesio complements both by giving your heirs a single, lawyer-friendly entry point — never the seed phrase itself.
This article is for informational purposes only and does not constitute legal, tax, financial or operational security advice. For your specific situation, consult a notary, a lawyer specialised in cross-border succession and a qualified security practitioner. Last updated: June 2026.
When Hans, a 58-year-old German entrepreneur living in Barcelona, set up his Trezor Safe 3 with a 2-of-3 Shamir Backup — share 1 with his wife in Barcelona, share 2 with his brother in Munich, share 3 in a Madrid notarial deposit — he was solving a problem most expats don't even know they have. His hardware wallet held a six-figure portfolio in BTC and ETH, accumulated over a decade, distributed across multiple derivation paths. His Spanish will recognised the existence of "digital assets" in generic terms. His wife knew the device existed. His heirs, on paper, were covered.
In practice, none of that would have mattered without the share distribution. A traditional Spanish will, even one drafted in front of a senior notario público, cannot transmit access to a self-custodied hardware wallet. The blockchain does not read deeds, and a notario cannot compel the recovery of a Trezor whose seed phrase nobody possesses. For cross-border expat families holding crypto in self-custody, hardware wallet inheritance is not a legal problem. It is an operational architecture problem with legal consequences.
This guide compares how the five most widely held hardware wallets in Europe — Ledger, Trezor, Coldcard, BitBox and KeepKey — handle inheritance natively, what to do when they don't, how to combine metal seed storage, Shamir Secret Sharing (SLIP-0039) and multi-signature setups across jurisdictions, and how to anchor all of it in a plan your heirs can follow without ever touching a command line.
The Hardware Wallet Inheritance Paradox
Every security feature that protects your crypto from theft also protects it from your heirs. This is the defining tension of self-custody.
There are three dimensions to the paradox:
PIN protection. Your hardware wallet's PIN code keeps a stolen device useless to the thief. The same PIN keeps the device useless to your widow or your adult son arriving from another country, unless you have transmitted it — and even then, after 3 to 16 wrong attempts (depending on the device), the wallet bricks itself and forces full seed-phrase recovery.
Seed phrase secrecy. The 12 or 24 words protecting your seed phrase are designed to be cryptographically unguessable. The discipline required to keep them secret during your lifetime — never digitised, never photographed, never spoken aloud — makes single-point-of-failure storage tempting, which in turn makes inheritance fragile.
Self-custody pride. The very reason you bought a hardware wallet — to remove third parties from the chain of trust — makes you reluctant to share access, even with a future heir. Many expat hardware wallet holders confess, in private, that no one alive knows where the seed phrase is stored. That is not a security best practice. That is a guaranteed loss at death.
Expats face this paradox more sharply than residents who never moved. Their trusted contacts are geographically scattered across two, three or sometimes four jurisdictions. Their notarial tradition — if it exists at all in their country of origin — does not translate cleanly into Spanish, Portuguese or German succession practice. And no jurisdiction currently treats a private key as a title in the way it treats a deed or a share certificate. The paradox compounds with every border.
The path out of the paradox is not to weaken security. It is to engineer a recovery architecture in which security and inheritability coexist by design. The rest of this guide is about how to do that, device by device.
For the broader context of crypto inheritance for European expats, see our companion guide on crypto inheritance for expats in Europe.
Comparative Inheritance Features: Ledger, Trezor, Coldcard, BitBox, KeepKey
Each major hardware wallet handles the inheritance problem differently. The table below summarises the inheritance-relevant features of the five most widely held devices in Europe in 2026.
| Device | Native multi-share backup | Recommended seed length | Passphrase | Inheritance tooling | EU manufacturer | Open source | Cross-border maintenance |
|---|---|---|---|---|---|---|---|
| Ledger (Nano S Plus / Nano X / Stax) | None (Ledger Recover is paid third-party) | 24 words BIP-39 | Optional 25th word | Ledger Live + xpub watch-only | Yes (France) | Firmware partially closed | Easy in EU |
| Trezor (Model One / Safe 3 / Safe 5) | SLIP-0039 Shamir Backup (Safe 3, Safe 5) | 12 / 18 / 20 / 24 / 33 words | Optional 25th word | Trezor Suite + Shamir wizard | Yes (Czech Republic) | Fully open source | Easy in EU |
| Coldcard (Mk4 / Q) | Seed XOR + duress / Brick Me PIN | 12 or 24 words BIP-39 | Full passphrase + duress passphrase | SD card export, CLI-style | No (Canada) | Open source firmware | Moderate (import) |
| BitBox02 (Bitcoin-only / Multi) | None native, encrypted MicroSD backup | 24 words BIP-39 | Optional | BitBoxApp + MicroSD backup | Yes (Switzerland) | Open source | Easy in EU/CH |
| KeepKey | None native | 12 / 18 / 24 words | Optional | Limited tooling | No (US) | Firmware open | Hard (shrinking ecosystem) |
Ledger Nano S Plus, Nano X and Stax
Ledger is the most-held hardware wallet in the European expat community by a wide margin. Its inheritance story is also the most controversial. There is no native multi-share backup on the device. The seed phrase is a standard 24-word BIP-39 sequence, optionally extended by a 25th-word passphrase that adds substantial complexity and is often disastrous if not transmitted alongside the seed.
Ledger Recover, launched in 2023 via Coincover, is a paid third-party service that splits an encrypted backup of your seed phrase across three custodians. It is not a native multi-share backup and it is not designed as an inheritance mechanism: recovery is keyed to the original holder's KYC, not the heirs'. For inheritance use, external Shamir on paper or in metal remains the safer route.
Ledger Live offers xpub watch-only exports, which lets your heir confirm balance and address history without holding the seed. For an EU-resident expat with French-headquartered hardware, day-to-day maintenance is straightforward — but inheritance planning must happen entirely outside the Ledger ecosystem.
Trezor Model One, Safe 3 and Safe 5
Trezor is the only major hardware wallet that ships with a native multi-share backup standard: SLIP-0039 Shamir Backup, available on the Safe 3 and Safe 5 (and previously on the Model T). This is the most inheritance-friendly hardware on the market in 2026, and the reason most cross-border crypto inheritance practitioners we observe in the European space favour it.
Trezor Suite includes a Shamir Backup wizard that walks you through generating N shares with a threshold of T required to recover (for example 3 shares, 2 required). Each share is meaningless alone. Recovery can happen on any compatible Trezor — not just the original device. The firmware is fully open source, manufactured in Czech Republic, which simplifies the EU customs and warranty path.
For an expat family wanting a 2-of-3 share distribution across, say, Barcelona, Munich and Madrid, the Trezor Safe 3 with SLIP-0039 is the closest to a turnkey solution available today.
Coldcard Mk4 and Q
Coldcard is the air-gapped specialist. Its inheritance feature is Seed XOR: the seed is split into multiple parts, each useless alone, all required to reconstruct. Coldcard also supports a duress PIN (decoys to a different wallet), a Brick Me PIN (destroys the device on entry) and full BIP-39 passphrase including duress passphrase.
Coldcard is Canadian-manufactured, which adds a small import friction for EU residents. The tooling is intentionally minimal — SD card exports, no graphical wallet manager — which makes recovery practical only for technically advanced heirs. For a surviving non-technical spouse facing a Coldcard cold-start, the experience is forbidding. Coldcard is the right choice for high-skill self-custody operators. It is rarely the right choice if the inheritance path runs through a non-technical family member.
BitBox02
BitBox02 (Bitcoin-only and Multi variants) is Swiss-manufactured, open source and ships with an encrypted MicroSD backup of the seed. There is no native multi-share standard, but the MicroSD backup paired with a metal seed in two physical locations gives reasonable cross-border redundancy.
For Swiss residents and Swiss-adjacent expat families (Liechtenstein, southern Germany, Austria), BitBox is the most natural device choice. For Spain-resident expats, it is a competent second choice behind Trezor.
KeepKey
KeepKey is a legacy device. The ecosystem has shrunk substantially since the ShapeShift transition, support is intermittent and inheritance tooling is essentially nonexistent. If you hold a KeepKey today, the right inheritance step is planning a migration to a Trezor Safe 3 or a BitBox02, not building an inheritance architecture around the existing device.
Seed Phrase Storage: From Paper to Metal
The device protects the wallet. The seed phrase protects the device. The storage of the seed phrase protects everything. Most inheritance failures we observe in cross-border expat families happen at this last layer.
Why paper fails inheritance
Paper has three failure modes that compound badly over the 20–40 year horizon a real inheritance plan must survive: fire, water, and time. Mediterranean coastal humidity destroys laminated paper backups within five to seven years. The Spanish DANA flooding episodes of 2024 reminded property owners across the eastern coast that "safe at home" is a relative term. Bank safe-deposit boxes are safer against floods but raise their own access frictions during cross-border probate, particularly when the surviving family lives in a different country and the local bank closes the account on notification of death.
Stamped metal solutions
Three families of physical metal backups dominate the European expat market:
Cryptosteel Capsule and Cryptosteel Cassette (made in Poland) use letter tiles you assemble manually. The Capsule holds 12 to 24 words, is rated to 1,200 °C and is effectively indestructible by water and EMP. Manual assembly is slow but auditable.
Steelwallet (French manufacturer) uses punching pliers on a stainless plate. Faster than tile assembly, harder to reorder if you make a mistake.
Billfodl (US-made, common EU shipping) uses letter tiles similar to Cryptosteel. Slightly thinner profile, identical durability properties.
Engraved or punched metal (assisted)
For families wanting a one-evening setup rather than a meditative letter-tile session, the Cobo Tablet (304 stainless steel, dot-matrix punch, BIP-39 only) and the Cryptosteel Cassette's tile-based 24-word capacity offer faster paths. The trade-off is reduced auditability — punched seeds are harder to inspect at a glance than assembled letter tiles.
Where to physically store the metal backup
For cross-border expat families, three patterns of physical storage cover most realistic risk profiles:
The simplest is the spouse's safe in the primary residence. It assumes a single trusted heir, no risk of regional disaster, and continuity of residence. It is a single point of failure.
The middle option is a bank safe-deposit box in the country of habitual residence. Access by the heir requires the inheritance act — in Spain, the escritura pública de aceptación de herencia — which can take six to nine months in cross-border cases. The seed phrase remains physically protected but operationally inaccessible during the post-death window when heirs are most vulnerable to fraud and forgetting.
The most resilient option for portfolios above €500,000 is a split-shard distribution across three jurisdictions: share 1 in the Spanish home (spouse's reach), share 2 with a UK family solicitor (cross-Channel jurisdictional separation), share 3 in a Swiss bank vault (further legal isolation). This is the architecture most family offices use for their highest-value crypto clients.
SLIP-0039 Shamir Secret Sharing: The Trezor Advantage
SLIP-0039 is a standard published by SatoshiLabs, Trezor's parent company, for cryptographically secure multi-share seed backups. It differs fundamentally from naive seed-splitting and from Shamir-XOR: each share is mathematically useless on its own, and only the threshold combination reconstructs the original entropy. The standard is open and documented in the public SatoshiLabs SLIPs repository.
The practical setup that works best for expat families with one Trezor and dispersed heirs is the 3 shares, 2 required scheme. Share 1 stays in the primary residence within the surviving spouse's reach. Share 2 sits with a trusted EU adult heir — a sibling or an adult child — in another country. Share 3 is deposited with a notario or a solicitor under an acta de depósito or trust deed.
Two critical points are widely misunderstood. SLIP-0039 shares cannot be combined with BIP-39 seeds from another wallet: Shamir is its own world, and shares from a Trezor Shamir wallet are useless if your other wallet uses a standard BIP-39 mnemonic. Second, recovery does not require the original device. Any compatible Trezor (Safe 3, Safe 5, Model T) with the Shamir-aware firmware can reconstruct the wallet from the threshold shares using Trezor Suite. This matters at the cross-border level because your heir does not need to inherit your physical device, only the shares.
For the legal circulation of supporting documents across EU borders, see the EU Succession Regulation 650/2012 for expats, which governs which national law applies to your succession.
Multi-Signature Setups for Cross-Border Heirs
Multi-signature, or multi-sig, is a different architecture from Shamir. Funds are locked behind N independent keys, with M required to spend (commonly 2-of-3 or 3-of-5). Crucially, each signer holds a complete wallet of their own, not a share of one master seed. There is no equivalent of "the seed phrase" to protect at any single location.
For inheritance, the most practical multi-sig configuration is 2-of-3 between spouse, primary heir and a notary or solicitor. At death, the surviving two co-sign to move funds; no single party — including yourself during your lifetime — can move funds alone, which removes the keys-in-one-place inheritance vulnerability entirely.
Tooling in 2026 is maturing fast. Sparrow Wallet is the most popular self-managed multi-sig coordinator for Bitcoin, runs against your own Bitcoin node and gives you complete control of the multi-sig setup. Specter Desktop offers a similar open-source alternative. Liana wallet (developed by Wizardsardine, a European team) builds time-locked recovery paths directly into the multi-sig logic, which makes it particularly well suited for inheritance designs. Casa, Unchained Capital and Nunchuk offer managed multi-sig with a custodial collaborative key — convenient, but all three are US-headquartered, which adds cross-border friction for European customers at recovery time.
The cross-border legal angle of multi-sig is rarely discussed but matters at the death of one signer. Each signer's jurisdiction matters: a 2-of-3 in which one signer sits in a non-cooperative jurisdiction, or in a country where the local probate process freezes the signer's access for years, can become operationally unrecoverable. Multi-sig is robust against many failure modes; it is vulnerable to jurisdictional ones.
PIN vs Seed: What Your Heirs Actually Need
A common confusion among expat families is the assumption that transmitting the PIN to a trusted heir solves the inheritance problem. It does not.
The PIN protects only the physical device. After 3 to 16 wrong attempts (depending on manufacturer and firmware), the device bricks itself and the only path forward is seed-phrase recovery. The PIN also does not survive a lost, damaged or stolen device. If the device disappears, the PIN becomes meaningless.
The seed phrase, by contrast, is the inheritance. With the seed phrase alone — or with a threshold of Shamir shares, or with M of N multi-sig keys — your heirs can rebuild the wallet on any compatible device anywhere in the world. The blockchain accepts any compatible reconstruction. It does not care about the original physical device.
The practical consequence: your inheritance plan must transmit the seed phrase (or its Shamir shares, or its multi-sig participation) and not the PIN. The PIN is operational security for the living holder. The seed phrase is succession.
Cross-Border Considerations: GDPR and Self-Custody Legal Status
Is a seed phrase "personal data" under GDPR?
The seed phrase itself is not personal data under GDPR Article 4(1). It is a cryptographic secret with no identifying content. What is personal data, and frequently sensitive, is the inventory linking your identity to your wallet addresses. The names of exchanges you use, the addresses you control, the amounts you hold and the locations of your physical backups all qualify as personal data that any storage service must handle under GDPR.
This distinction matters for inheritance planning. Any service — including Sucesio — that stores metadata about your crypto positions is GDPR-relevant on the metadata layer, while the cryptographic layer follows separate operational security rules. A well-designed inheritance plan treats the two layers with different security disciplines.
Self-custody legal status across major EU jurisdictions
Spain. The Agencia Tributaria treats crypto assets as movable property forming part of the taxable estate. Modelo 721 (Orden HFP/886/2023) covers crypto held with foreign service providers. Self-custody assets held only on paper or metal, with no service provider involved, remain a grey area in 2026 — your notario will document them in the escritura if you declare them, but no third-party verification path exists. The Inheritance and Donation Tax (Impuesto sobre Sucesiones y Donaciones, ISD) applies, with rates and allowances varying by autonomous community.
France. Crypto assets are treated as movable property under the PACTE law (2019). Inheritance follows standard succession law, with the additional reporting requirements introduced by recent finance acts for residents holding crypto with foreign platforms.
Germany. Crypto assets are private assets (Privatvermögen) for individuals. Original holders benefit from Steuerfreiheit after a 12-month holding period; heirs restart the holding period at the date-of-death valuation, which means rapid post-inheritance sales can trigger taxable events.
Portugal. The favorable personal income regime that drew many crypto holders to Lisbon and Porto in the early 2020s has been partially tightened since 2023. Inheritance between spouses and direct descendants is generally exempt under Imposto do Selo Group A/B.
In all four jurisdictions, the operational truth is the same: legal succession of the asset and operational recovery of the device or seed are governed by different bodies of rules. Your inheritance plan must address both layers.
How Sucesio Complements Hardware Wallet Inheritance
Sucesio does not replace a hardware wallet, a notario, a solicitor, a multi-sig coordinator or a Trezor Shamir setup. It complements them. Specifically for hardware wallet inheritance, Sucesio centralises the non-cryptographic layer that no device, wallet app or notarial deed can natively cover.
What Sucesio centralises:
- Inventory. Which device or devices you own, which firmware version, which derivation paths, which xpub watch-only links — so your heirs know what they are recovering for, before they touch a single share.
- Geographic map. Where each Shamir share or metal backup physically sits, in which country, in which safe, with which contact responsible for retrieval.
- Retrieval protocol. A step-by-step instruction your non-technical heir can follow without ever needing to open a terminal or interpret a hexadecimal string.
- Contacts. The EU notario, the UK solicitor, the family member holding share 2 or share 3 — all in one ordered inventory rather than fragmented across phone contacts and old emails.
- Time-released access. Sucesio releases the inventory after an automated life check, not the seed phrase itself.
Two structural commitments:
Sucesio never stores a complete seed phrase. This is structural, not optional. The platform stores the map, not the treasure. Your seed phrase, your Shamir shares, your multi-sig keys remain where you put them — paper, metal, acta de depósito, multi-sig coordinator. Sucesio is the directions your heirs follow to reach them.
Sucesio is the translation layer. Hardware wallet manufacturers, notarios, banks, solicitors and exchanges each speak their own dialect. Your heirs, in the days and weeks after your death, need one entry point that translates between all of them. That is the gap Sucesio is built to fill.
For the broader picture of digital legacy planning for expats living in Spain — including passwords, online accounts, cloud storage and personal messages — see our full guide on digital legacy for expats in Spain.
Frequently Asked Questions
My Ledger Nano S Plus is in Spain and my seed phrase is stamped on Cryptosteel in my UK family safe. Is that a good inheritance plan?
It is a starting point, not a complete plan. Two issues remain. First, your UK heirs need to know precisely which device they are recovering for — the Ledger model, the Ledger Live setup, the derivation paths, the accounts. Without that context, they hold the seed but not the road map. Second, post-Brexit cross-border probate runs slower than EU-internal succession. Your spouse in Spain may wait months for the UK side to release the Cryptosteel from a family safe attached to a UK estate. Consider splitting via Shamir or moving the backup to an EU jurisdiction where your primary heirs already hold residency.
Should I use Trezor's Shamir Backup or a multi-sig setup for inheritance?
Shamir is simpler operationally — one device, one wallet, multiple shares. Multi-sig is more robust legally — different signers, different jurisdictions, no single seed-phrase-equivalent to protect at any one place. For most expat families with €100,000 to €500,000 in crypto, Shamir on a Trezor Safe 3 or Safe 5 with 2-of-3 shares is sufficient and pragmatic. For portfolios above €500,000 or for family-office contexts, multi-sig with Liana, Sparrow or Nunchuk becomes worth the additional operational complexity.
Is Ledger Recover a substitute for an inheritance plan?
No. Ledger Recover is a paid third-party recovery service tied to the original holder's KYC, not an inheritance mechanism. At your death, your heirs cannot impersonate your KYC to trigger recovery. Use external Shamir on metal, or a multi-sig setup, instead.
My heir lives in the US. Will my Spanish-resident self-custody crypto be hard to inherit?
The crypto itself is jurisdiction-neutral — the blockchain does not care where your heir lives. The legal layer is harder. Spain has no inheritance tax treaty with the United States, so US heirs may face dual taxation with only unilateral relief mechanisms. Operationally, your Spanish notario will require apostilled US documents (death certificate, US estate documents, proof of heirship) to formalise the escritura pública de aceptación de herencia. Plan for four to eight weeks of cross-border legal coordination on top of the technical recovery itself.
Can a notario in Spain hold one of my Shamir shares?
Some notarías in Madrid, Barcelona and Málaga accept acta de depósito of sealed envelopes since 2023. The practice is not standardised across the Spanish notarial profession — confirm in writing with your specific notario before relying on this path. Critically, the acta documents the deposit. It does not transmit ownership of the underlying BTC, ETH or other asset, nor does it create any obligation on the notario to verify the contents.
Does Sucesio store my seed phrase?
No, and this is structural rather than optional. Sucesio centralises the inventory, the geographic map and the retrieval protocol. We never see, hold or process a complete seed phrase. The cryptographic layer — paper, metal, Shamir share, multi-sig key — stays exactly where you put it. Sucesio provides your heirs with the directions to reach it.
This article is informational and does not constitute legal, tax, financial or operational security advice. Hardware wallet inheritance combines technical, legal and physical security questions that depend on your specific device, your jurisdiction of residence, the locations of your heirs and the structure of your portfolio. For your specific situation, consult a notary or lawyer specialised in cross-border succession and a qualified security practitioner. Last updated: June 2026.
Author: The Sucesio Team. For questions about cross-border digital estate planning, visit sucesio.io.