Separate loss, theft and custody failure

A recovery plan should address a missing device, a lost secret and an unavailable owner. These are distinct from fraud at an exchange or an attacker obtaining a key. A backup can help with some failures while increasing exposure if stored carelessly. Avoid using a headline loss estimate as a substitute for understanding your own custody arrangement.

The Ontario Securities Commission’s Quadriga review attributes the collapse to fraud by Gerald Cotten. It should not be presented as a case where all customer funds simply remained locked behind a deceased owner’s password.

Document the wallet before the recovery steps

List the wallet product, networks, account types and official documentation. Record where the backup is held without placing the secret in a general inventory. Note any separate wallet passphrase, imported account, hardware connection or multisignature configuration. A single recovery phrase may not restore every account visible in a wallet application.

Use the manufacturer’s current recovery instructions for the exact model and backup format. Do not improvise word splitting, enter hardware-wallet seeds into a website or assume a PIN and a seed are interchangeable. Identify a trusted technical adviser if the recipient cannot safely follow the official procedure.

Practise without putting live funds at risk

Start with a separate test wallet that holds no meaningful value. Ask your intended person to follow the written sequence and explain what each step does. For checks involving a live backup, use the manufacturer’s supported verification procedure and a secure device. Do not reset the only working device just to see whether an unverified backup works.

Record what was tested, the device and documentation version, and any missing information. A successful test is evidence about that arrangement on that date. Recheck after a device replacement, account import, wallet migration or change in who will help.

Connect recovery to your broader plan

ZeroLatch can deliver a scoped inventory and instructions after a missed check-in and safety period. It does not transfer assets, establish legal authority or confirm death. Simple permits authorised service-managed key recovery; Private requires a separate password or ZeroLatch recovery phrase. Neither option replaces an independent backup or a real recipient rehearsal. Start with harmless information and read the security model and backup checklist.

For exchange accounts, use the provider’s official estate or account-recovery process. For self-custody assets, ask a qualified adviser about the intended recipient’s authority and any reporting obligations before a transfer. Preserve transaction and ownership records so that technical access can be matched with lawful administration.