One Missing Word in Our Passphrase Drill Nearly Cost Us $38,000

At 7:15 on a Saturday morning in February, my husband Peter was sitting at the kitchen table with a factory-reset hardware wallet, a printed recovery sheet, and a mug of coffee he would never finish. The rule of our annual drill is that he restores from his copy, I restore from mine, and neither of us helps the other. Around minute six he stopped typing. "This can't be right," he said, and turned the sheet toward me. Word eleven of his passphrase copy read "harbour" with an u. Mine read "harbor" without one.

One letter. British spelling versus American, written down four years ago in a living room, and copied forward ever since without ever being tested. If his copy had been the only one left, that wallet — 0.61 BTC plus some odds and ends, about $38,000 at that morning price — was a sealed vault with the combination engraved on the inside of the door.

why we started doing this

The drill exists cuz of a story I heard at a funeral, of all places. A colleague's brother died abruptly, and his family knew he had crypto, knew there was a seed phrase somewhere, and spent eleven months failing to reckon a passphrase he had never told anyone. Eleven months of guesses against a wallet that would never confirm or deny. That story rearranged how I think about backups. A backup you have never tested is not a backup. It is a hypothesis.

So every year, on a weekend in February, we simulate the worst version of events: one of us gone, one device destroyed, one written copy only.

the rules of the drill

The setup is deliberately harsh. Factory-reset wallet, no hints, no password manager, no "I think it might be." Peter restores using only his laminated card and the recovery sheet in the fire safe. I do the same from my copy, which lives in a location that is itself part of the test: a place he absorbed about the day we signed the paperwork for it, and which I re-verify every year before the drill.

His copy failed at word eleven. Mine passed, start to finish, in nine minutes.

what one letter actually does

Here is the technical cruelty of a passphrase: there is no error message. You enter twenty-four words plus a twenty-fifth, and if any character of that passphrase is wrong, the wallet does not say so. It simply opens a different, empty wallet — mathematically valid, holding nothing, indistinguishable from a fresh device. Peter would have restored "successfully," seen a zero balance, and spent the rest of his life believing the money had vanished somewhere in the transfer history. Most people in that position assume they did something wrong during recovery and keep retrying variations forever. There is no support line for the empty-wallet experience.

We spent that afternoon doing what we should have done in 2022. Both physical copies compared word by word, character by character, with me reading aloud and Peter checking letters, not words. The word "harbour" turned out to be original: I had written the master sheet using the British spelling I grew up with, Peter's copy inherited it faithfully, and at some point I had quietly standardized my own copy to American without telling anyone, cuz I did not know the two copies had ever disagreed. Backup systems fail in exactly this boring way — not through fire or theft but thru unrecorded, well-meaning edits.

fixing it without creating new risk

We re-derived everything from the correct passphrase, rewrote both copies fresh in the same session, initialed and dated em, and added one line to the drill checklist that did not exist before: copies must be compared to each other annually, not just tested independently. Two independent tests can both pass while the underlying assumption — that the copies match — rots silently. We also moved the emergency instructions into the same envelope as the estate documents, so our daughter's executor-in-waiting instructions reference the drill by name. None of this cost money. All of it cost the thing people refuse to spend: an afternoon.

the argument we still have

Peter thinks the passphrase is overkill, and he has a point. It is one more failure mode, and this incident proves his case: the extra security nearly destroyed the assets it protected. My counterargument is that his copy failing in February, at a kitchen table, with coffee and time and a second wallet present, is the exact scenario the drill buys you. The flaw was free to find. The same flaw found during a real emergency, by our daughter, with grief and a probate deadline attached, would have been the $38,000 kind.

the 2027 checklist

Next February's drill has four items now instead of two. Restore from each copy independently. Compare the copies to each other, letter by letter. Verify that the location document matches reality — doors change, safes get replaced. And confirm the value number written on the instruction sheet is approximately current, because an executor who finds "$38,000" attached to a wallet worth $90,000 will assume the sheet is stale and start doubting all of it. Reckoning wrong in that direction destroys trust in the whole document.

the morning it held

By 8:40 that same Saturday, both wallets were restored, balances matched to the sat, the corrected sheets were back in their places, and Peter finished his coffee cold. I keep thinking about how close this came to being the other story — the one where a widow types "harbor" into a wallet and watches it open onto nothing. The security industry sells you devices and steel plates and fireproof bags. What actually saved us was a $0 calendar reminder, two hours, and the willingness to let my husband fail in front of me. Test the backup. All of it. Every year. The vault does not warn you that the combination changed.