How to find a deceased person's crypto

Most people who owned crypto left traces: a device, a document, a statement, an email, or a single entry in a password manager. This page is a complete search workbook, where to look, what each trace can and cannot prove, and when the search is properly finished. It is about finding evidence of assets, not about accessing them; access is a separate legal question covered at the end.

How to use this workbook

• Work through the sections in order and write down only what you found, never the contents of anything secret.
• Do not touch, photograph, scan, type or share any words, keys or passwords you encounter. See what did you find? for how to handle items.
• When a trace is found, note it in your search log (below) and continue. The checklist is complete only when the last section is done.

The legal frame comes first

Searching for information about an estate is lawful and ordinary. Accessing accounts or unlocking devices is a different matter: it requires lawful authority, which comes from the estate process, not from finding a device or knowing a password. See legal authority vs technical access.

Two rules protect everyone involved:

• Possession is not authority. Holding a phone or a notebook does not make you the owner of what is inside.
• Correspondence addressed to the person who passed away should be opened only by the person with legal authority to administer the estate. Privacy rules differ by country.

If you are a family member without an official role, your job is to collect and hand over, not to investigate privately in ways that could create evidence problems later. The estate’s authorised person (executor, administrator or heirs under local law) coordinates the official steps.

Keep a search log: fact, inference, assumption

Every trace you find falls into one of three categories. Keeping them strictly separate is the single most valuable habit in this workbook:

Category	Definition	Example
Fact	Something you saw or verified yourself	A hardware wallet is in the desk drawer
Inference	A reasonable conclusion drawn from facts	The wallet most likely contains crypto
Assumption	An unverified belief	“They only used one exchange”

Why this matters:

• Unverified claims stay in the assumption column. A message that says “we found crypto in the estate” is worthless until you have facts you can verify yourself.
• Professionals need facts. An executor, notary or exchange can act on evidence, not on hopes.
• A visible balance or screenshot proves nothing about ownership, access or legal title. See why a wallet balance proves nothing.

Write three columns in a notebook or file (Fact, Inference, Assumption) or use the search log template. Never write actual passwords, keys or recovery words in it.

Where to search, the full checklist

1. Physical places

Where to search	What to look for	What it can prove
Desk, drawers, home safe	Envelopes or folders marked “backup”, “seed”, “recovery”, “wallet”, “bitcoin”	A wallet or backup exists
Notebooks, diaries, address books	A list of 12–24 words, handwritten codes, wallet addresses	Recovery material exists, treat any word list as the secret itself
Safe deposit box	Hardware wallet, USB sticks, paper documents, printed keys	Assets or keys exist. Opening rules depend on the bank and country, ask which documents they require
Hardware wallet packaging	Box, recovery card, cable, manual	A device exists; the recovery card inside is key material
Attic, garage, wardrobe, storage	Old computers, phones, external drives, loose USB sticks	Potential wallet storage, see old devices with a possible wallet

2. Devices and media

Old devices are where wallets are most often found. Look for:

• Wallet or exchange apps on phones and tablets, and wallet browser extensions;
• Files such as wallet.dat, keystore/JSON files, or exported wallet backups;
• Notes apps, email drafts and screenshots that mention balances or addresses;
• Browser history pointing to exchange or wallet websites;
• Saved passwords and autofill entries (record their existence only);
• External drives, memory cards and USB sticks, including ones tucked into cases or drawers;
• Encrypted drives, containers and archives (VeraCrypt, TrueCrypt, BitLocker, encrypted backups), the encryption is part of the access path, not a dead end: see encrypted drives and containers;

Leave every device as it is: do not switch it on unnecessarily, do not update, do not reset, do not connect it to the internet, and do not guess passwords or PINs, devices lock after failed attempts. Treat the machine as evidence; see old devices and chain of custody.

3. Documents and notes

Document	What to look for
Will, codicil, estate papers	Any mention of crypto, wallets, exchanges, “digital assets” or account lists
Handwritten notes	12–24 word lists, keys, passwords, website names
Printed material	QR codes, wallet addresses, backup instructions, exchange statements
Purchase invoices	Hardware wallets, mining equipment, cold-wallet purchases
Business records	Invoices paid in crypto, client or supplier wallet addresses

Any written word list, key or code is secret material, note only that it exists, never its contents. For help identifying what you found, see what did you find? and the wallet format library.

4. Administration and correspondence

Email is often the single richest source. Exchange confirmations, recovery links and 2FA setup emails name the platforms where accounts existed. Search the inbox, sent mail, trash, spam and archived folders for terms such as:

bitcoin, crypto, wallet, ledger, trezor, seed, recovery, passphrase, 2FA, authentication, deposit, withdrawal, staking, mining, NFT, blockchain, plus the names of exchanges the person may have used (Coinbase, Kraken, Binance, Bitvavo and any local platform).

Also check postal mail: statements and letters from platforms are usually not sent by email alone.

Time matters, email accounts can be closed. Google considers an account inactive and reserves the right to delete it after two years without use; Microsoft may close accounts with no sign-in for two years (subject to exceptions such as purchases or subscriptions). If the email of the person who passed away holds the only exchange records, that clock runs regardless of the estate process. Preserving evidence early, through the authorised route, matters more than most people expect.

Sources: Google: Inactive Account Policy and Microsoft: account activity policy.

5. Financial records

• Bank statements (often covering years) showing transfers to or from exchanges;
• Credit and debit card statements showing card payments to platforms;
• Tax returns and tax-office correspondence, crypto is reported in many countries;
• Accountant or tax adviser files, they may hold the full picture;
• Payroll history, salary was sometimes paid in crypto or to an exchange.

A bank transfer to an exchange is strong evidence that an account existed. It does not by itself prove access, ownership or what is still in the account, those are established through the platform’s official process. See exchange accounts after a death.

6. Password managers

A password manager is often the best-kept secret list a person had, and finding it is a secret-free first step. The existence of the manager, and the names of accounts in it, are facts you can record without unlocking anything. Unlocking it is a separate step that requires lawful authority, not technical skill.

If the master password is missing, some password managers offer emergency-access or recovery routes and some do not, read what is realistically possible in wallet recovery, and never ask anyone online to “unlock” the vault.

7. Portfolio trackers, staking, DeFi and mining

• Portfolio tracker apps (such as portfolio features of market-data sites) may list holdings, useful as clues, but they hold no keys.
• Staking, lending and DeFi dashboards, look in correspondence and apps for pool or protocol names.
• Mining pool accounts and validator setups, invoices, pool emails and dashboard screenshots are the traces.
• Hardware wallets in non-obvious places, safes, locked drawers, safety deposit boxes, or packaging that looks unopened.

Records from these sources are clues and evidence, not access. They help reconstruct what existed so the authorised person can start the official process.

Red lines, never do these

• Never log into accounts or unlock devices without lawful authority. Unauthorised access can have legal consequences and can freeze an official claim.
• Never reset, wipe, update, reinstall or connect old devices to the internet.
• Never pay anyone to “confirm”, “trace” or “search” for crypto. The search in this workbook is free; anyone offering certainty for a fee is a warning sign.
• Never use anonymous “blockchain tracing” services that guarantee results. Blockchain analysis can identify transactions, but no service can guarantee “finding your crypto”, and results you cannot verify are worthless to an estate process.
• Never share seed words, passwords, passphrases or codes with anyone, including people who claim to be helping.
• Never respond to unsolicited messages claiming you have inherited crypto or that “a balance is waiting”. Check senders, type addresses yourself and use only official support channels.

More on protection: scams targeting crypto estates and wallet recovery: what is realistically possible.

The stop rule: when is the search complete?

Not every trace is equal. Keep three levels in mind:

Level	What it means	Example
Clue	Suggests crypto may exist	Browser history shows an exchange website
Evidence	Shows an account or asset existed	Bank statement shows a transfer to an exchange
Entitlement proof	What platforms and the estate process require	Death certificate plus proof of authority plus the platform’s own procedure

You can stop when:

• you have found what exists, or
• you have worked through every section above and documented what you did and did not find.

You do not need to find every coin before starting. For exchange-held assets you need enough evidence to begin the platform’s official procedure; the exchange itself establishes what remains. If the search ends empty but suspicion remains, document it and move on, continuing into invasive or unlawful digging helps no one and can damage the estate’s position.

What to do with what you found

1. Record it in your search log, facts and evidence only, never secret contents.
2. Route it correctly:
   • Traces of an exchange account → exchange accounts after a death;
   • A physical item (device, paper words, QR code, USB) → what did you find?;
   • An unidentified file or format → wallet format library;
   • A locked device or missing password → wallet passwords and passphrases;
   • A missing 2FA factor or authenticator app → 2FA and wallet access after a death;
   • A blocked or lost key → wallet recovery: what is realistically possible and help with inherited crypto.
3. Route it through the right person. Everything found belongs to the estate process, and every official step is taken by the person with legal authority. If you are not sure who that is, start with first steps after a death and legal authority vs technical access.

Sources

• Google, Inactive Google Account Policy, checked 2026-08-09
• Microsoft, Microsoft account activity policy, checked 2026-08-09
• Coinbase, Claim a decedent’s Coinbase account, checked 2026-08-09
• Kraken, Deceased client account claims, checked 2026-08-09
• Bitvavo, Accessing the account of a deceased family member, checked 2026-08-09