How to find a deceased person's crypto

People who owned crypto left traces: a device, a document, a statement, an email, or a single entry in a password manager. This page is a complete search workbook, where to look, what each trace can and cannot prove, and when the search is properly finished. It is about finding and documenting indications of crypto. Technical access is a separate question; whether someone is authorised to use that access is, in addition, a legal question.

How to use this workbook

• Work through the sections in order and write down only what you found, never the contents of anything secret.
• Do not touch, photograph, scan, type or share any words, keys or passwords you encounter. See what did you find? for how to handle items.
• When a trace is found, note it in your search log (below) and continue. The checklist is complete only when the last section is done.

The legal frame comes first

Searching for information about an estate is lawful and ordinary. Accessing accounts or unlocking devices is a different matter: it requires lawful authority, which comes from the estate process, not from finding a device or knowing a password. See legal authority vs technical access.

Two rules protect everyone involved:

• Possession is not authority. Holding a phone or a notebook does not make you the owner of what is inside.
• Do not automatically access the deceased person’s email, accounts or private messages just because you have the device or credentials. Follow the provider’s official procedure for deceased users and the applicable privacy rules; in complex cases, ask a professional.

If you are a family member without an official role, your job is to collect and hand over, not to investigate privately in ways that could create evidence problems later. The estate’s authorised person (executor, administrator or heirs under local law) coordinates the official steps.

Keep a search log: fact, inference, assumption

Every trace you find falls into one of three categories. Keeping them strictly separate is the single most valuable habit in this workbook:

Category	Definition	Example
Fact	Something you saw or verified yourself	A hardware wallet is in the desk drawer
Inference	A reasonable conclusion drawn from facts	The wallet most likely contains crypto
Assumption	An unverified belief	“They only used one exchange”

Why this matters:

• Unverified claims stay in the assumption column. A message that says “we found crypto in the estate” is worthless until you have facts you can verify yourself.
• Professionals need facts. An executor, notary or exchange can act on evidence, not on hopes.
• A visible balance or screenshot is not sufficient proof of ownership, access or legal title. See why a visible wallet balance does not prove access or ownership.

Write three columns in a notebook or file (Fact, Inference, Assumption) or use the search log template. Never write actual passwords, keys or recovery words in it.

Where to search, the full checklist

1. Physical places

Where to search	What to look for	What the find may indicate
Desk, drawers, home safe	Envelopes or folders marked “backup”, “seed”, “recovery”, “wallet”, “bitcoin”	May indicate a wallet or backup
Notebooks, diaries, address books	A list of 12–24 words, handwritten codes, wallet addresses	May indicate recovery material; treat any word list as the secret itself
Safe deposit box	Hardware wallet, USB sticks, paper documents, printed keys	May indicate assets or keys; whether the box can be opened depends on the bank, the country and the applicable rules
Hardware wallet packaging	Box, recovery card, cable, manual	May indicate a device; a recovery card inside is key material
Attic, garage, wardrobe, storage	Old computers, phones, external drives, loose USB sticks	May indicate wallet storage; see old devices with a possible wallet

2. Devices and media

Old devices are where wallets are most often found. Look for:

• Wallet or exchange apps on phones and tablets, and wallet browser extensions;
• Files such as wallet.dat, keystore/JSON files, or exported wallet backups;
• Notes apps, email drafts and screenshots that mention balances or addresses;
• Browser history pointing to exchange or wallet websites;
• Saved passwords and autofill entries (record their existence only);
• External drives, memory cards and USB sticks, including ones tucked into cases or drawers;
• Encrypted drives, containers and backups (such as VeraCrypt, TrueCrypt or BitLocker) can contain important data. Preserve them unchanged. Whether access is possible depends on the system used and the passwords, recovery keys or other access material available. See encrypted drives and containers;

Leave every device as it is: do not switch it on unnecessarily, do not update, do not reset, and do not connect it to the internet without first assessing what preservation requires; do not guess passwords or PINs; some devices slow down, lock, reset or wipe local data after several wrong attempts. Treat the machine as evidence; see old devices and chain of custody.

3. Documents and notes

Document	What to look for
Will, codicil, estate papers	Any mention of crypto, wallets, exchanges, “digital assets” or account lists
Handwritten notes	12–24 word lists, keys, passwords, website names
Printed material	QR codes, wallet addresses, backup instructions, exchange statements
Purchase invoices	Hardware wallets, mining equipment, cold-wallet purchases
Business records	Invoices paid in crypto, client or supplier wallet addresses

Any written word list, key or code is secret material, note only that it exists, never its contents. For help identifying what you found, see what did you find? and the wallet format library.

4. Administration and correspondence

Email is often the single richest source. Exchange confirmations, recovery links and 2FA setup emails name the platforms where accounts existed. Search the inbox, sent mail, trash, spam and archived folders for terms such as:

bitcoin, crypto, wallet, ledger, trezor, seed, recovery, passphrase, 2FA, authentication, deposit, withdrawal, staking, mining, NFT, blockchain, plus the names of exchanges the person may have used (Coinbase, Kraken, Binance, Bitvavo and any local platform).

Only search an account when the person administering the estate is authorised to do so and access is permitted under the provider’s procedure. If that is not clear, use the provider’s official procedure first.

Also check postal mail: statements and letters from platforms are usually not sent by email alone.

Time matters, email accounts can be closed. Google considers an account inactive and reserves the right to delete it after two years without use; Microsoft may close accounts with no sign-in for two years (subject to exceptions such as purchases or subscriptions). If the email of the person who passed away holds the only exchange records, that clock runs regardless of the estate process. Preserving evidence early, through the authorised route, matters.

Sources: Google: Inactive Account Policy and Microsoft: account activity policy.

5. Financial records

• Bank statements (often covering years) showing transfers to or from exchanges;
• Credit and debit card statements showing card payments to platforms;
• Tax returns and tax-office correspondence, crypto is reported in many countries;
• Accountant or tax adviser files, they may hold the full picture;
• Payroll history, salary was sometimes paid in crypto or to an exchange.

A payment from or to an exchange is a strong indication that a relationship or transaction with that platform existed; by itself it is not conclusive proof of an account in the name of the person who passed away, ownership or a current balance. It does not by itself prove access, ownership or what is still in the account, those are established through the platform’s official process. See exchange accounts after a death.

6. Password managers

A password manager is often the best-kept secret list a person had, and finding it is a secret-free first step. The existence of the manager, and the names of accounts in it, are facts you can record without unlocking anything. Unlocking it is a separate step that requires lawful authority, not technical skill.

If the master password is missing, some password managers offer emergency-access or recovery routes and some do not, read what is realistically possible in wallet recovery, and never ask anyone online to “unlock” the vault.

7. Portfolio trackers, staking, DeFi and mining

• Portfolio tracker apps (such as portfolio features of market-data sites) may list holdings, useful as clues, but they hold no keys.
• Staking, lending and DeFi dashboards, look in correspondence and apps for pool or protocol names.
• Mining pool accounts and validator setups, invoices, pool emails and dashboard screenshots are the traces.
• Hardware wallets in non-obvious places, safes, locked drawers, safety deposit boxes, or packaging that looks unopened.

Records from these sources are clues and evidence, not access. They help reconstruct what existed so the authorised person can start the official process.

Red lines, never do these

• Never log into accounts or unlock devices without lawful authority. Unauthorised access can have legal consequences.
• Do not reset, wipe, update, reinstall or connect old devices without first assessing what preservation requires.
• Do not pay on the basis of an unproven claim that someone ‘found your crypto’. For complex investigations, professional forensic or blockchain analysis can be useful, but check the party, assignment, method, evidentiary value and costs in advance, and treat guarantees as a warning sign.
• Never use anonymous “blockchain tracing” services that guarantee results. Blockchain analysis can identify transactions, but no service can guarantee “finding your crypto”, and results you cannot verify are worthless to an estate process.
• Do not casually share seed phrases, private keys, passwords, passphrases, PINs or authentication codes with anyone offering help. A legal, tax or standard exchange procedure does not need this secret material. Specialist technical recovery may later need specific material or information about possible passwords; provide only what was agreed in advance in writing and through a secure process.
• Never respond to unsolicited messages claiming you have inherited crypto or that “a balance is waiting”. Check senders, type addresses yourself and use only official support channels.

More on protection: scams targeting crypto estates and wallet recovery: what is realistically possible.

The stop rule: when is the search complete?

Not every trace is equal. Keep three levels in mind:

Level	What it means	Example
Clue	Suggests crypto may exist	Browser history shows an exchange website
Evidence	Confirms a specific account or digital record, but not automatically ownership or authority	Official confirmation from the provider or a verified on-chain record
Entitlement proof	What platforms and the estate process require	Death certificate plus proof of authority plus the platform’s own procedure

You can stop when:

• you have found what exists, or
• you have worked through every section above and documented what you did and did not find.

You do not need to find every coin before starting. For exchange-held assets you need enough evidence to begin the platform’s official procedure; the exchange itself establishes what remains. If the search ends empty but suspicion remains, document it and move on, continuing into invasive or unlawful digging helps no one and can damage the estate’s position.

What to do with what you found

1. Record it in your search log, facts and evidence only, never secret contents.
2. Route it correctly:
   • Traces of an exchange account → exchange accounts after a death;
   • A physical item (device, paper words, QR code, USB) → what did you find?;
   • An unidentified file or format → wallet format library;
   • A locked device or missing password → wallet passwords and passphrases;
   • A missing 2FA factor or authenticator app → 2FA and wallet access after a death;
   • A blocked or lost key → wallet recovery: what is realistically possible and help with inherited crypto.
3. Route it through the right person. Everything found belongs to the estate process, and every official step is taken by the person with legal authority. If you are not sure who that is, start with first steps after a death and legal authority vs technical access.

Sources

• Google, Inactive Google Account Policy, checked 2026-08-09
• Microsoft, Microsoft account activity policy, checked 2026-08-09
• Coinbase, Claim a decedent’s Coinbase account, checked 2026-08-09
• Kraken, Deceased client account claims, checked 2026-08-09
• Bitvavo, Accessing the account of a deceased family member, checked 2026-08-09