Rung 3 · Shamir

SLIP-39 / Shamir backup

Split the backup into shares — any M of N reconstruct it. No single share reveals the seed.

Best for
Holders who want split backups without running multisig
Rough cost
$129+ (Trezor supports it natively)
Typical tier
Tier 1–2 · long-term cold storage

What this is

Instead of one or two complete seed backups, the seed is mathematically split into several shares — for example, five shares where any three can rebuild the seed, but two or fewer reveal nothing at all. You distribute the shares across locations or trusted people.

What it’s good at

What it costs you

The recovery moment is a single point of failure

To recover, the shares must be combined on one device to rebuild the whole seed. At that instant, that device holds everything. If it’s compromised, or the process is watched, the entire point of splitting is undone. This is exactly why Casa and Lopp often prefer multisig — where the keys never have to meet — over Shamir for actively-used funds.

Who should use it

Holders who want their backups geographically distributed but don’t want the operational complexity of multisig, and whose main use is long-term cold storage rather than frequent spending. Shamir-split backup paired with an on-device passphrase is a reasonable middle tier between plain single-sig and full multisig.

Planning for inheritance

Shamir can help inheritance — hand shares to trusted parties with instructions — but it’s fragile if your heirs aren’t coordinated: a share treated as junk, a family fall-out, or a share that ends up in a phone photo can break it. For most people a documented plan (or a collaborative partner, rung 5) is more robust than heirs holding shares.

When to climb

If you find yourself wanting the keys to never have to come together in one place — the weakness above — that’s the case for multisig (rung 4), which solves the same distribution problem without a risky reassembly step.

Compare devices Back to the ladder

Last verified: July 15, 2026