MASTERING-BITCOIN

The $7,000 BTC Mistake: Avoiding Loss, Backups, Multisig & Inheritance

IKey Concepts & Formulas

Concept	Rule / Formula	Meaning
Multisig	$M\text{-of-}N$	A transaction needs $M$ signatures out of $N$ total keys
Loss risk (M-of-N)	$P_{\text{loss}} = \sum_{k=N-M+1}^{N} \binom{N}{k} p^k (1-p)^{N-k}$	Lose funds if more than $N-M$ keys are lost
Theft risk (M-of-N)	$P_{\text{theft}} = \sum_{k=M}^{N} \binom{N}{k} q^k (1-q)^{N-k}$	Stolen if an attacker obtains at least $M$ keys
Hot wallet rule	$\text{hot} < 5\%$	Keep only "pocket change" connected to the internet
Redundant backups	$P_{\text{loss}} = p^{\,n}$	With $n$ independent copies, all $n$ must fail

Here $p$ = probability a single key/backup is lost, and $q$ = probability a single key is stolen.

IIInteractive Visualizations

Visualization 1: The Multisig Balance — Loss vs. Theft

A multisignature wallet requires $M$ signatures out of $N$ total keys. The choice of the threshold $M$ is a trade-off:

Low $M$ (e.g. 1-of-3): easy to recover if you lose keys, but easy for a thief who grabs just one key.
High $M$ (e.g. 3-of-3): a thief needs every key, but losing a single key locks you out forever.

Explore: For a fixed number of keys $N$ , how does the threshold $M$ shift the risk of self-inflicted loss versus external theft?

⚙ interactive visualization — coming to this page format soon

Reflect: As $M$ increases, the loss curve rises (you need more keys to survive) while the theft curve falls (an attacker needs more keys). The "sweet spot" is where both risks are acceptably low — often 2-of-3 for a single person or small company. Notice how a 3-of-3 setup minimizes theft but can make loss very likely if a single key fails. There is no setting that drives both risks to zero — security is about balance.

Visualization 2: Tiered Storage Allocation

You wouldn't carry your entire net worth as cash. The same logic applies to Bitcoin:

Hot / mobile wallet — pocket change, online and convenient but exposed (keep it $< 5\%$ ).
Desktop wallet — everyday-sized holdings.
Cold storage — the vault: completely offline, immune to remote attacks.

Explore: Adjust the allocation. When does your hot wallet hold more than the safe "pocket change" threshold?

⚙ interactive visualization — coming to this page format soon

Notice: No single failure — a stolen phone, a corrupted desktop, a misplaced hardware wallet — can wipe you out when your holdings are tiered. The dashed line marks the 5% hot-wallet ceiling: cross it and you're keeping too much of your net worth in the most exposed tier.

Visualization 3: The Backup Paradox

In July 2011, an education project lost ~7,000 BTC. They had backups — copies A, B, and C, all intact. But every copy was encrypted with a single key, and that key was lost. One missing key turned every backup into useless noise.

This visualization compares two schemes as you add more redundant copies:

Separate keys per copy: each copy survives on its own → $P_{\text{loss}} = p^{\,n}$ .
One shared encryption key: you also need that single key → a fixed "floor" of risk no amount of copies can remove: $P_{\text{loss}} = 1 - (1 - p^{\,n})(1 - p)$ .

Explore: Does adding more copies actually protect you when they all share one key?

⚙ interactive visualization — coming to this page format soon

Reflect: With separate keys, loss probability plummets toward zero as you add copies. With one shared key, the red curve flattens onto a floor equal to the single-key failure probability — exactly the 2011 disaster. A real backup isn't just redundant copies of data; it's redundant ways to actually open it. Always back up the spending conditions (the script), not just the keys — with multisig or complex wallets, the key alone cannot move your coins.

IIIQuiz Questions

Question 1

A company sets up a 2-of-3 multisignature wallet, with each of three keys held by a different executive in a different location. One executive's key is destroyed in a fire.

Can the company still recover and move its Bitcoin?

✅ Correct! Two of the three keys satisfy the 2-of-3 threshold.

❌ Not quite. In M-of-N you only need M keys — here just 2 of 3.

Show solution

Solution:

A $2\text{-of-}3$ multisig needs any 2 of the 3 keys to authorize a transaction.

Losing one key still leaves two keys — enough to meet the threshold.
This is exactly the redundancy that defeats the single point of failure: "Lose one key, the other two still recover everything."
It also resists theft: an attacker with only one key cannot spend.

So the funds are safe and recoverable.

Question 2

In the July 2011 incident, an education project lost ~7,000 BTC even though they had multiple intact backups (copies A, B, and C).

What was the actual cause of the loss?

✅ Correct! A single lost key made every backup unusable.

❌ Not quite. It wasn't theft or drive failure — the coins were safe but unreachable.

Show solution

Solution:

This is the backup paradox: securing too hard can create a single point of failure.

All three backups (A, B, C) survived intact.
But every copy was encrypted with the same single key, and that key was lost.
One missing key turned every redundant copy into useless noise.

It was loss, not theft — self-inflicted by over-engineered complexity. A good backup needs redundant ways to open it, not just redundant copies of the data.

Question 3

You use a wallet with multisignature spending conditions. You carefully back up your private key (seed phrase), but you do not back up the spending conditions (the script).

True or False: Your private key alone is always enough to spend the funds.

✅ Correct! With multisig/complex scripts, the key alone cannot spend.

❌ Not quite. The network requires the spending conditions too — not just the key.

Show solution

Solution:

False. For a simple single-key wallet, the seed phrase is enough. But modern wallets use spending conditions — small scripts defining the rules to move coins.

When you broadcast a transaction, the network demands both:

the key(s), and
the spending conditions (script).

Provide only the key, and the transaction is rejected. Lose the script, and your funds become unspendable even with the key in hand. So: back up the rules, not just the keys.

Question 4

You follow the advice "never share your keys, trust no one," holding a single key that only you can access. Years later you pass away unexpectedly.

Which problem does this scenario illustrate, and what is the best fix?

✅ Correct! Total secrecy guarantees loss the moment you're gone.

❌ Not quite. The danger here is loss through inaccessibility, not theft or price.

Show solution

Solution:

This is the availability problem: keys only you can access die with you. The coins are secure but unreachable by the heirs who should inherit them — and your family may not even know the Bitcoin exists.

The sophisticated fix combines controlled sharing with multisig:

Distribute keys — e.g. one with you, one with a trusted relative, one with a digital-asset executor / lawyer.
While alive, you hold enough to spend freely; no single party can steal beforehand.
When you're gone, your heirs combine their keys to recover the funds.
Back up the spending conditions alongside the keys so the inheritance actually works.

Controlled sharing through multisig is more secure overall than telling absolutely no one.

IVSummary

The goal isn't paranoia — it's balance: security where neither theft nor loss can wipe you out.

Diversify storage into tiers (hot < 5%, desktop, cold).
Use multisig ( $M\text{-of-}N$ ) for large holdings to kill single points of failure.
Back up conditions + keys, not just keys.
Make a survivability plan so the people you love can find the treasure too.

Solved: 0 / 4