Bitcoin cold storage plan revealed by David Schwartz

David Schwartz, an XRP Ledger co creator and current Ripple board member, proposed a Bitcoin inheritance setup on Aug. 3 that separates access to duplicate hardware wallets from the PIN needed to unlock them.
Summary

• David Schwartz proposed giving two duplicate Bitcoin wallets and their shared PIN to separate people.
• The setup uses one seed across devices, so it remains a single signature wallet structure.
• Four suspected Coldcard waves moved about 1815 BTC from more than five thousand addresses overall.
• Coinkite says fixed firmware protects new seeds but cannot repair phrases generated on affected devices.
• Multisignature inheritance systems require separate keys, unlike duplicate devices sharing one recovery phrase between them.

His post followed a renewed debate over paper backups after the Coldcard firmware failure. Ripple identifies Schwartz as an original XRP Ledger architect, while its current leadership page lists him as a board member.

Schwartz described the idea as "one way" to handle inheritance, not as a finished product or guaranteed security model. He suggested loading the same 24 word recovery phrase onto two additional cold wallets, setting the same PIN on both, giving one device to each of two relatives, and sharing the PIN with two trusted friends who would disclose it after the owner's death. The post did not name a wallet model or use the "nuclear briefcase" label.

How the Bitcoin inheritance plan would work
The proposed setup creates two physical copies of the same wallet. Each relative would hold a signing device but lack the PIN. Each friend would know the PIN but hold no device. Under normal conditions, neither group could access the Bitcoin without cooperating with someone from the other group.

Schwartz's argument came during a discussion about whether paper backups are simpler than hardware wallets. Paper avoids firmware exposure, but it remains vulnerable to theft, fire and accidental destruction. Bitcoin Design notes that metal backups offer greater physical durability, while hardware wallets isolate recovery phrases and private keys from connected devices.

Meanwhile, the arrangement does not create a multisignature wallet. Both devices contain the same recovery phrase, so each represents the same signing authority. One relative and one friend could therefore gain full control together. A leaked PIN paired with a stolen device could create the same result.

True multisignature systems use separate keys and require more than one signature before funds move. Unchained describes a common two of three structure where one compromised key cannot spend the Bitcoin alone. Schwartz's proposal instead divides one complete credential into a physical component and a knowledge component.

Coldcard losses make seed quality the central risk
The debate follows a Coldcard flaw that weakened randomness during seed generation on affected firmware. Coinkite has released corrected versions, but updating firmware cannot repair an earlier recovery phrase. Affected users must create a new seed and move their Bitcoin. Coinkite says sufficient private dice entropy or a strong passphrase may provide additional protection in some cases.

Block's security team traced the issue to a deterministic software fallback and limited reseeding process. It cautioned that it had "not done full empirical testing to confirm exploitability," while reporting that active theft was underway. The findings show why copying a wallet is safe only when the original seed was generated securely.

As crypto.news reported, a fourth suspected attack wave moved 448.7 BTC from 709 possible victim addresses. Four observed waves may total about 1,815.75 BTC across 5,294 addresses if there is no overlap. Those figures remain onchain estimates rather than losses confirmed by every wallet owner, Coinkite or law enforcement.

A complete inheritance plan needs legal steps
Schwartz's outline addresses access, but inheritance also requires clear instructions, legal ownership records and a process that heirs can execute under stress. Unchained advises documenting the security model and ensuring an executor or trustee understands how to use the relevant keys. In related coverage, crypto.news noted that self custody can leave assets permanently inaccessible when owners fail to prepare heirs.

The setup also depends on relatives and friends remaining reachable, trustworthy and capable of coordinating. Device failure, forgotten PINs, disputes or premature disclosure could still disrupt the transfer. The claim that heirs are "guaranteed" to receive the funds would therefore be too strong.

Schwartz's post did not announce a commercial service, audit or formal technical specification. Independent review would need to compare the approach with multisignature wallets, time based controls and professional estate planning. Any recovery process should also be tested with a small balance before it is trusted with long term Bitcoin savings.