My friend's mistake; a lesson for everyone!

[apogio]

TL;DR My best friend lost 0.1BTC yesterday. I'll explain what happened and I'll leave it here as a lesson for everybody.

The story
In August 2019, my friend created an electrum wallet, using an offline linux laptop. He stored the seedphrase in a .txt file. Then, he used 2 brand new USB sticks that he encrypted with a 10-word passphrase, using words from the EFF wordlist. He put the file in both USB sticks and he copied the first address from the wallet.
He bought 0.1BTC (approx. worth 1000€ at the time), from a centralized exchange.
He sent the coins to the copied address.
Earlier this week, he wanted to cash out his ~10x earnings.
He went to the bank, visited his vault, got the paper where the passphrase was written.
Then, he visited their parents' house, where one of the USB sticks was stored.
He plugged it in the computer and tried to decrypt it.
But the USB was not responsive at all.
He went to his cottage near the city, got the other USB stick.
He plugged it in the computer and tried to decrypt it.
But the USB was not responsive at all.
He paid 100€ to a company that's specialized in data retrieval.
They couldn't do anything at all. The flash storage was damaged in both the USB sticks after 6.5 years.

Mistakes
As far as I'm concerned, my friend made the following mistakes:
1. USBs aren't durable.
2. Digital backups require more backups and more occasional health-checks.
3. Digital backups require (in my opinion) more storage types, especially if the backup setup includes flash storage as well.

Lessons learned
This thread is basically an effort to note, once more, that:
1. self-custody is a serious matter. We don't need to reinvent the wheel, but we need to be cautious.
2. we need to follow the most common best practices. If cryptographers and engineers have reached a concensus about a security pattern, it's most likely a better one than the "ultra-secure setup" that we've just thought up.

[TheNextBigThinger0x0]

TL;DR My best friend lost 0.1BTC yesterday. I'll explain what happened and I'll leave it here as a lesson for everybody.

The story
In August 2019, my friend created an electrum wallet, using an offline linux laptop. He stored the seedphrase in a .txt file. Then, he used 2 brand new USB sticks that he encrypted with a 10-word passphrase, using words from the EFF wordlist. He put the file in both USB sticks and he copied the first address from the wallet.
He bought 0.1BTC (approx. worth 1000€ at the time), from a centralized exchange.
He sent the coins to the copied address.
Earlier this week, he wanted to cash out his ~10x earnings.
He went to the bank, visited his vault, got the paper where the passphrase was written.
Then, he visited their parents' house, where one of the USB sticks was stored.
He plugged it in the computer and tried to decrypt it.
But the USB was not responsive at all.
He went to his cottage near the city, got the other USB stick.
He plugged it in the computer and tried to decrypt it.
But the USB was not responsive at all.
He paid 100€ to a company that's specialized in data retrieval.
They couldn't do anything at all. The flash storage was damaged in both the USB sticks after 6.5 years.

Mistakes
As far as I'm concerned, my friend made the following mistakes:
1. USBs aren't durable.
2. Digital backups require more backups and more occasional health-checks.
3. Digital backups require (in my opinion) more storage types, especially if the backup setup includes flash storage as well.

Lessons learned
This thread is basically an effort to note, once more, that:
1. self-custody is a serious matter. We don't need to reinvent the wheel, but we need to be cautious.
2. we need to follow the most common best practices. If cryptographers and engineers have reached a concensus about a security pattern, it's most likely a better one than the "ultra-secure setup" that we've just thought up.

Flash memory rots with no charge after a while. Sadly some people learn it the hard way.

Next time use a HDD and online encrypted storage backups.

[Somegory]

I will rather write down my recovery seed on a clean steel than use USB sticks, they are unreliable, I know that some strong ones exits from the best companies but you want to bet your Bitcoin on that? I don't like it when things are getting more complicated, people makes Bitcoin safety a more complicating thing by doing extra stuffs that's not really needed.

Self custody shouldn't be this complicated, people need to stop making things harder for themselves, all he needed is a offline way of keeping the recovery seed, a steel would do just fine and that's it, all the encryption and copying pasting is already a red flag for me, getting a hardware wallet and keeping the recovery seed offline is the simplest.

[promise444c5]

That’s bad..
He could have used at least one or two other seed  backups that won’t necessarily need to be accessed digitally ..six years is a lot of years. Hence, this thing shouldn’t be about multiple backups of the same type, it should be multiple but different types of backups. I don’t know what might have damaged that flash drive but I still have one that’s almost ten years old and still kicking... It’s a bit rusty but it still works perfectly, even the LED light still works.
Sorry for his loss, it hits hard knowing you have some reserves but can’t access them.

[FirmWars]

I don't see USB as the safest backup device because it is very possible that it can crash after staying for a long time, the best offline backup option is paper and pen backup it is very efficient and secure, after jotting down the private key on the paper, you can laminate the paper so that it will be water and oil proof, then store it in 3 different locations that secure. If he had done that backup on a paper, he would still have his coins safe by now.

[Rikafip]

Jesus.

He really overcomplicated things, instead just buying a hardware wallet and storing the seedphrase (several copies of course) on a piece of paper.

[Hatchy]

~snip

I often tell people that being too careful sometimes leads to more mistakes. While it's understandable that people want to be overprotective of their keys, there's a limit to how complicated you need to make it.

You shouldn't go to excessive trouble just to secure your seed. Use a standard method and avoid unnecessary complications. Physical storage (paper and pen, or metal sheets) is generally safer than digital storage. Digital devices are not always durable, and not all manufacturers prioritize long term data security.

[khaled0111]

When it comes to long-term storage, I would never trust usb sticks because I know they are unreliable (based on long personal experience). It’s fine to use them when you just need to transfer data from one device to another or to use them for short-term storage as long as you have a backup copy on a more reliable device. If you know how these devices work, then you would never trust them as your only storage method and (this applies even if you are going to save your data on more than one usb stick).
Sorry that your friend had to learn this the hard way (I share TheNextBigThinger0x0 opinion on this).

[Amphenomenon]

Lessons learned
This thread is basically an effort to note, once more, that:
1. self-custody is a serious matter. We don't need to reinvent the wheel, but we need to be cautious.
2. we need to follow the most common best practices. If cryptographers and engineers have reached a concensus about a security pattern, it's most likely a better one than the "ultra-secure setup" that we've just thought up.

One thing I have learnt from my cryptography research is that you don't just come up with a said secure system, especially when you are not a pro in that area and even if, it is difficult for a single individual to identify every possible flaw, and nothing better than to stick with what has been tested and trusted for years. This is reliability.

[apogio]

Thank you all for the responses.

the best offline backup option is paper and pen

He really overcomplicated things, instead just buying a hardware wallet and storing the seedphrase (several copies of course) on a piece of paper.

I will rather write down my recovery seed on a clean steel

Yeah, I hear all of you and I sort of agree, but I think messed up because he wanted to make it impossible for someone to find the seedphrase and steal his bitcoin. Essentially, he added an additional layer of security. But, he used the wrong storage medium.

I often tell people that being too careful sometimes leads to more mistakes. While it's understandable that people want to be overprotective of their keys, there's a limit to how complicated you need to make it.

You shouldn't go to excessive trouble just to secure your seed. Use a standard method and avoid unnecessary complications. Physical storage (paper and pen, or metal sheets) is generally safer than digital storage. Digital devices are not always durable, and not all manufacturers prioritize long term data security.

I'm surprised that too few people discuss or suggest BIP38. For cold storage, where there isn't a necessity to spend these funds, I reckon BIP38 is spectacular. It allows you to create encrypted paper backups, which avoid multiple ramifications in the backup setup.

One thing I have learnt from my cryptography research is that you don't just come up with a said secure system, especially when you are not a pro in that area and even if, it is difficult for a single individual to identify every possible flaw, and nothing better than to stick with what has been tested and trusted for years. This is reliability.

That's why Electrum and Trezor are used by the great majority of people who do self-custody. They're established for too many years, battle-tested and their major flaws have already been addressed and solved.

[Karl_3000]

This is the reason memorizing the passphrase can be very good. It is not good to depend on only the memory but also have two backup like he did. I have my passphrase also written on a paper but I make sure that I also memorize it which is my forth passphrase backup. I am not saying people should depend on memorizing seed phrase or passphrase but it can be of a help for them in some situations.

[sokani]

I know that some strong ones exits from the best companies but you want to bet your Bitcoin on that? I don't like it when things are getting more complicated, people makes Bitcoin safety a more complicating thing by doing extra stuffs that's not really needed.

That was how I bought a SanDisk USB drive to store some digital files. I got assurances from the seller that it would last long, but just after two years, it stopped working and I couldn't recover the files. So, when it comes to backup up a crypto wallet, just stick with the generally accepted method, as op advised. Trying to do it in a way you think might be better may leave you in pains, like in this case.

[Knight Hider]

What did your friend do with his offline linux laptop?

[noorman0]

The quality of FDs and other newer storage devices is truly poor. Even online stores in my area typically only last less than 4 months before becoming corrupted and undetectable. Furthermore, the storage environment also affects the device's durability.

I suddenly remembered my old FD, purchased 2nd hand around 2010. I recently tried it again after probably being unplugged for over 2  years, and fortunately, it still worked fine.

[hd49728]

In August 2019
But the USB was not responsive at all.

From 2019 to 2025, there are already six years which are long time enough, and your friends made double mistakes.
Firstly, he used only one backup method with USB stick and even he made two backups with two USB sticks, it's not enough.
Secondly, he did not check these USB sticks too regularly to see whether they are responsive or broken so that he can make new wallet backups. By waiting for six years to check two USB sticks, he wasted a lot of time to fix any one of two USB backups if one of them is broken and is no longer usable.

Your friend and other Bitcoin users need to make multiple wallet backups and should use different backup methods for one wallet.
How to back up a seed phrase?

[Stormys1]

At least he was not scammed and lost funds by his own mistake

Also i think the simple DVD-RW discs are more durable than USB sticks. Otherwise they would not be readable after so many years

[Helena Yu]

This is why I said making thing complicated might cost you something expensive, I've seen many people want to split their seed phrase, save their seed phrase in other format and the most mind blown I ever read was split seed phrase across different country.

I also ever had a bad experience with USB, although it happened on low quality USB.

I would say it's not only limited to USB, but it could happen to any other components e.g. SSD, HDD, memory card, so beware if someone want to save their seed phrase in digital.

What did your friend do with his offline linux laptop?

I also think the same, he can just access his wallet using his laptop.

[Proty]

what happened to your friend can happen to anyone. It is not that he was wrong, the only mistake was to have stored the file on USB stick only without considering other alternative incase of the USB stick break down. Why securing data we should always consider possible way we can easily retrieve it or storing it in a place that it won't get damaged. For your friend I don't think there is remedy to his mistake. There are ways to secure seed phrase without going through this kind of stress of looking for how to access it.

[Outhue]

This is the reason memorizing the passphrase can be very good. It is not good to depend on only the memory but also have two backup like he did. I have my passphrase also written on a paper but I make sure that I also memorize it which is my forth passphrase backup. I am not saying people should depend on memorizing seed phrase or passphrase but it can be of a help for them in some situations.

Write your phrase down somewhere, it is better than memorising it, but if you like to memorise words it can be a plus but make sure it's not your only way of backing up your phrases. I have lost good files through USB sticks going bad after several months of not using them, the only thing is store on USB now is windows os and Linux os, even if you feel like you can recover files from the USB, this is only in the case of lost files not a dead usb stick.

[noorman0]

Also i think the simple DVD-RW discs are more durable than USB sticks. Otherwise they would not be readable after so many years

I hope you're not joking. I have a bunch of unused DVD-RW discs that I keep in a DVD sleeve, and they're all moldy now. DVD-RW discs aren't ideal for this; they're generally very susceptible to moisture and oxidation, especially after they're 5yrs old from the date of manufacture.