The 2-of-3 Recovery Drill With My Kids Failed at Step Four

At 4:22 on a Sunday afternoon, my son Marcus held up a sealed envelope and asked, "Wait, whose signature goes on this line?" That was step four of nine, eleven minutes into the first full rehearsal of our family backup plan, and the honest answer was that I did not know. I had designed a two-of-three recovery scheme for our cold wallet — approximately $61,000 at the time — written a fourteen-page instruction binder, distributed three hardware components across three households, and never once run the whole thing end to end with the actual people who would have to execute it. The binder was beautiful. The binder did not survive contact with my children.

the scheme on paper

The design was standard and, I believed, clever. Three hardware wallet shares for a multisig-style arrangement: mine at home in the fire safe, Marcus's at his apartment in Denver, and my daughter Priya's at her place in Sacramento. Any two shares recover the funds. No single break-in, fire, or dishonest heir can touch the money; no single death or lost device can strand it. I spent a weekend in January reading forum posts and building the instruction binder, laminating pages like a woman preparing for a NASA launch.

What I never did was ask the two people holding two-thirds of the plan whether the plan made sense to them. That omission has a cost, and the cost has a Sunday afternoon attached to it.

steps one through three went fine

To be fair to my binder, the opening moved smoothly. Marcus retrieved his share from his go-bag, Priya produced hers from a lockbox whose combination she knew without checking her phone, and both devices powered on with charged batteries because the binder's step one — quarterly charge check — had actually been followed. I felt the warm glow of a project manager watching milestones land. Then Marcus turned the envelope over and asked about the signature line, and the glow went out.

the gap in step four

The gap was this: the recovery instructions required each share holder to sign a verification log, and the log form I had designed had a signature line for "owner" and a line for "witness" — but I had never specified who counted as a witness, whether the two guardians could witness each other, or what should happen if a share holder was traveling and the recovery was urgent. Priya, who is a hospital pharmacist and thinks in protocols for a living, asked the lethal follow-up: "If I'm on shift and Marcus needs this tonight, what's the actual procedure? Call you? You'd be the one person who might be unreachable." She was right. My scheme assumed I would be available to supervise my own absence.

rewriting the plan with everyone in the room

We stopped the drill, pushed the devices aside, and spent the next ninety minutes redesigning the human parts. The witness problem went away by deleting it — signatures removed entirely, replaced by a group photo requirement after each successful test, timestamped, stored with the binder. The urgency problem got a real answer: a standing video-call protocol where any two holders can execute without me, with a recorded walkthrough video I made that evening in one take, my voice slightly too loud because the microphone surprised me. Priya rewrote my step four in her own handwriting, which is now the canonical version, cuz a plan edited by its executors is worth three drafted by its author.

the second attempt

With the revised binder, the full recovery took twenty-six minutes and produced exactly zero questions. Marcus entered his share, Priya entered hers, the test wallet opened, the balance matched a printed verification figure, and we all signed — sorry, photographed — the result. Then we ordered too much Thai food and Marcus, poking at his container, said the thing I have kept in my notes since: "This was your plan's first birthday, Mom. Everything before today was a draft." He is twenty-six and occasionally wise and I resent both.

what the solo test never would have caught

I had tested my own share twice before, alone, at my own desk, and it worked perfectly. Both times. That proves almost nothing, which took me embarrassingly long to understand. A solo test validates the device and the words. It cannot validate whether another person can find their share, understands the sequence, or knows what a witness line means. Every failed system I have ever heard about in this space failed at the human interface — the spouse who never knew the envelope existed, the son who never charged the device, the guardian who moved apartments and left the backup in a closet belonging to a stranger. Hardware fails loudly. People fail silently.

The rehearsal is on the family calendar every spring now, and it has rules the original binder lacked: it happens in one room, it uses the real shares, it runs against a modest live test wallet, and whoever finds a flaw gets to fix the binder page themselves. Last year that was Priya, for the signature mess. Next year Marcus wants to test the "Denver share is unreachable" branch, which means flying me through the two-of-three recovery with Priya only, from my dining room. The plan keeps accreting branches, like a tree that grows exactly where it has been bent.

closing the loop

By 6:30 that Sunday, the envelope question that stopped us at step four had become a deleted line in a rewritten page, and the wallet had been verified twice over. The full cost of finding the flaw was an afternoon, some Thai food, and my pride in a laminated binder. The cost of not finding it would have landed on Marcus and Priya, in the worst week of their lives, holding instructions with a blank where an answer should have been. Your backup is not the steel plate or the twelve words. It is the rehearsal, out loud, with the people who will actually be standing there — and the date it failed at step four is the date it began working.