Back Up the Number, Not the Words: The Bitcoin Backup Approach, Explained and Stress Tested

The problem he is solving

His starting point is the lost coin problem. In the talk he cites the Chainalysis estimate of roughly 3.7 million bitcoin lost to poor key management, and River’s 2025 research putting bitcoin made inaccessible by self-custody mistakes at about 1.66 million, ahead of the roughly 1.2 million lost to exchange hacks and failures. Whether or not you take the exact figures, the direction is right and it matches NLB’s own Custody Anxiety Index findings: the dominant risk to a self-custody holder is not a hacker, it is their own backup failing on the day they need it.

His diagnosis: paper burns, fades, and gets thrown away. Words on a plate announce themselves as a seed phrase to anyone who finds them. Letter tile metal systems have moving parts that can fall out. His answer is to stop backing up the words at all, and back up the numbers underneath them instead.

The core idea: a seed phrase is a rendering, not the secret

BIP39 works in layers, and every layer can be the backup:

1. A wallet generates random entropy: 128 bits for a 12 word seed, 256 bits for a 24 word seed.
2. It hashes that entropy and appends the first few bits as a checksum (4 bits for 12 words, 8 bits for 24).
3. The combined bitstream is chopped into 11 bit groups. Each group is a number from 0 to 2047, which selects a word from the 2048 word list.

The words are just the friendliest rendering of that number stream. Quentin’s whole approach is to back up one of the deeper layers, on metal, and treat the words as something you regenerate at recovery time.

The method stack, layer by layer

Metal first. Whatever representation you choose goes on a punched or stamped solid plate, never tiles with moving parts. He demos the OneKey KeyTag (a titanium plate with a punch grid for binary dots) and ColdTi titanium plates. Plates are stored in separate locations.

Layer 1: first four letters. Every BIP39 word is uniquely identified by its first four letters. Stamping “aban, abil, able” instead of the full words saves space and makes the plate slightly less obvious, at zero information loss.

Layer 2: word index numbers. Each word becomes its four digit list position, 0001 to 2048. Numbers are language independent, which matters for heirs: a word list exists in many languages, an index always points at the same word.

Layer 3: binary. Each index is 11 bits, so a 12 word seed becomes 132 binary digits and a 24 word seed 264. This is what the KeyTag punch grid stores. A plate of dots or a string of ones and zeroes does not read as a seed phrase, even to most Bitcoiners.

Layer 4: octal. Convert each decimal index to base 8. His example: word index 2032 becomes 3760 in octal. The point is camouflage: a stamped number that is not in the familiar 1 to 2048 index shape looks like random data.

Layer 5: raw entropy in hex. The deepest layer. Skip the words and indices entirely and store the entropy itself as a hexadecimal number: 32 characters for a 12 word seed, 64 for a 24 word seed. At recovery, you paste the hex into a BIP39 tool (he uses the Ian Coleman converter, downloaded and run offline) and it deterministically regenerates the exact seed phrase. He extends this further: the hex can go into a QR code, and the hex can be encrypted under a password before it is stored anywhere.

Around the stack: a BIP39 passphrase as a genuine second factor (he suggests storing the passphrase in an encrypted password manager such as Proton Pass or Bitwarden, or encoded in hex or base 64), Shamir sharing through Superbacked (seed split into encrypted QR shares, for example 2 of 3 or 3 of 5, printed on waterproof paper and distributed), geographic distribution of every copy, and a full recovery rehearsal with a family member, which he calls the dead drill, plus an annual review.

What the approach gets right

• Metal over paper, and punched or stamped over letter tiles. That is settled best practice and he teaches it well.
• The passphrase is treated as the real security layer, which it is. An encoded backup plus a separately stored passphrase is a two factor system.
• Distribution and rehearsal are in the method, not an afterthought. Most backup guides never tell you to hand the backup to your spouse, lie on the floor, and watch them try to restore a test wallet. His does.
• The numbers are genuinely more compact and easier to stamp accurately than 24 words. 64 hex characters is a small plate.
• He repeatedly warns against his own complexity: “complexity is the enemy of security, but so is oversimplification” is his line, and it is the right instinct.

The stress test: where the stack breaks

1. Error detection disappears as you go deeper. The words carry a checksum, and that checksum is a tripwire: mistype a word at recovery and the wallet usually refuses the phrase instead of silently opening the wrong wallet. Move to raw entropy and the tripwire is gone. The checksum is derived from the entropy at regeneration time, so a single wrong hex digit produces a perfectly valid seed phrase for a different, empty wallet, with no warning anywhere. He says it himself in the talk: “One digit off and your seed phrase is gone.” It is worse than gone. It is silently replaced, and you find out at the worst possible moment. Word indices keep partial protection (a wrong index usually breaks the checksum), binary and octal keep it too if decoded correctly, but every manual conversion step you add between the plate and the wallet is another place for an undetectable human error.

2. Obscurity is not a security model. The pitch for binary and octal is that a finder will not recognize the data. But the data sits on a titanium plate that was manufactured and sold as a seed phrase backup. A Bitcoin aware thief who finds a punched plate will try the obvious decodings, and the decodings are published in a public YouTube talk. What actually protects the funds in his system is the passphrase and the distribution, not the encoding. The encoding is at best a speed bump against a casual finder, and it should never be counted as a security layer.

3. The camouflage cuts your heirs too. A backup nobody can identify is also a backup an executor can throw in the trash as random numbers. Every encoded backup creates a documentation dependency: somewhere, separate from the backup, your heirs need instructions that say what the numbers are, which encoding was used, in which order, and which tool converts them back. If that document sits with the backup, the camouflage is pointless. If it sits elsewhere, you have built a two part system where losing either part loses the bitcoin. His Self-Inheritance-Protocol repo is, to his credit, an attempt at exactly that documentation layer.

4. Recovery depends on nonstandard tooling. Every wallet on earth accepts seed words. Almost none accept raw entropy. Recovery from a hex backup runs through a converter tool, which means an offline computer, a trusted copy of the tool, and a user who knows what “show entropy details” means, possibly decades from now, possibly a grieving family member. The BIP39 words are not just a format, they are the interoperability standard. An encoded backup trades that away.

5. The passphrase storage advice is the weakest link he ships. Recommending a cloud password manager for the passphrase reintroduces exactly the digital attack surface the metal plate exists to avoid, and a passphrase stored as hex or base 64 is the same obscurity play as the seed encoding. The passphrase deserves the same treatment as the seed: offline, durable, separate.

6. None of it covers the rest of the wallet. Entropy regenerates the seed, and nothing else. A passphrase still needs its own backup. A multisig wallet still needs its descriptor and the other keys. This is true of a plain word backup too, but the “your entire wallet in 64 characters” framing invites people to forget it.

Who should use which layer

• Beginners: words on a stamped or punched metal plate, two locations. The four letter truncation is a harmless space saver. Skip every other layer.
• Intermediate: add a passphrase stored offline and separately, and rehearse a recovery. That is where the real security gain lives.
• Advanced, technical, and only as a second backup: a raw entropy hex plate is a legitimately compact redundant copy, provided the decoding method is documented in your inheritance instructions and stored apart from the plate. Test the full round trip: plate to hex to regenerated seed to the same wallet fingerprint, before trusting it.
• Skip: octal and binary as your only encoding. They add conversion steps and recovery ambiguity (a stamped 3760: decimal index, octal, or something else?) in exchange for camouflage that does not survive contact with a Bitcoin aware finder.

Bottom line

Quentin is a credible teacher on the physical layer: metal, no moving parts, distribution, rehearsal. His encoding stack is clever, and the entropy backup is a real technique that belongs in an advanced holder’s toolkit as a redundant copy. But the approach inverts one priority. A backup’s job is to be recoverable by a stressed non expert on the worst day, and every layer between the plate and the words spends recoverability to buy camouflage. Words on metal, a passphrase kept apart, copies in more than one place, and a rehearsed recovery will save more bitcoin than any encoding. Use his physical discipline. Be much more careful with his numbers.

Sources

• Talk transcript: “4 Million Bitcoin Lost Forever: Why Your Backup Will Fail”, The Bitcoin Backup, YouTube (video DxL-YZDbziU), including the entropy, octal, binary, passphrase, and Superbacked walkthroughs and the River and Chainalysis figures he cites.
• GitHub: github.com/TheBitcoinBackup (Quentin), Self-Inheritance-Protocol repo, MIT license, created November 2024, GitHub Pages documentation site.
• X: @thebtcbackup.
• Method references: BIP39 (entropy, checksum, and word index mechanics), Ian Coleman BIP39 converter (entropy details view), Superbacked (encrypted Shamir QR shares).