You're dealing with a loss, and on top of everything else, you've come across something that suggests your relative may have held bitcoin or cryptocurrency. Maybe it was an old laptop. A USB drive. A handwritten note with unfamiliar words. A hardware device that looks like a USB stick. Or maybe they simply mentioned bitcoin at some point and you're wondering if there's anything there.
This guide will walk you through exactly what to do — in the right order — without risking the assets or making irreversible mistakes.
Don't plug in unknown USB drives, don't try to boot old laptops to "just check," and don't move or wipe any devices until you've read this. The most common way families accidentally destroy recoverable crypto is by trying to investigate it themselves before understanding what they're looking at.
Step 1: Secure everything first, investigate second
Before you do anything else, gather and physically secure any devices that might be relevant. This means laptops, desktops, external hard drives, USB drives, devices that look like small USB sticks (hardware wallets), and anything with the words "Ledger," "Trezor," or "cold storage" on or near it.
Put them somewhere safe. Don't try to turn them on, plug them in, or "just take a quick look." The reason for this is simple: Bitcoin wallets can be stored on old hardware in ways that are easily damaged by normal use. If a device is malfunctioning and you try to boot it, you can overwrite deleted files that a forensic scan might have recovered. If you plug in an unencrypted USB drive on a compromised computer, the contents can be exposed.
Securing the hardware costs you nothing. Rushing costs you potentially everything.
Step 2: Look for the obvious signs before calling anyone
While you're gathering devices, look for any of the following — these are strong indicators that crypto may exist:
- Handwritten notes with 12 or 24 random words — this is a "seed phrase," the master key to a crypto wallet. If you find one, treat it like cash. Do not photograph it with your phone, do not type it into any website, and do not share it with anyone until you understand what it is.
- Hardware wallet devices — small physical devices resembling USB drives, often branded Ledger or Trezor. These are dedicated crypto storage devices.
- Printed QR codes alongside long strings of letters and numbers.
- Exchange account emails — look through the deceased's email for registration or transaction emails from Coinbase, Kraken, Gemini, Binance, or similar platforms.
- Tax documents mentioning cryptocurrency — Form 8949 or Schedule D entries for digital assets confirm prior holdings.
- Old laptops from 2009–2016 — Bitcoin was primarily stored on personal computers during its early years. A laptop from this era with no obvious reformatting is worth examining.
Step 3: Understand what you're actually dealing with
Bitcoin and cryptocurrency come in two main forms, and how you recover them depends entirely on which type you're dealing with.
Exchange accounts (custodial)
If your relative held crypto on an exchange like Coinbase, Kraken, or Gemini, those assets are held by the exchange the same way a brokerage holds stocks. The exchange can verify the death and transfer the account to the estate — similar to any other financial account. You'll need a death certificate and, if probate is open, Letters Testamentary. Contact the exchange directly through their official website and look for an "estate" or "deceased account" section.
Self-custodied wallets (non-custodial)
If your relative held crypto directly — in a software wallet on their computer or a hardware wallet device — there is no company holding the assets. The only way to access them is with the password, the seed phrase, or through forensic recovery work. This is where it gets complicated and where professional help is most valuable.
Exchange accounts can usually be recovered with proper estate documentation. Self-custodied wallets require either the password/seed phrase — or a professional investigation. If you don't have those credentials, you'll need outside help for the second type.
Step 4: Do not open probate just for crypto — yet
A common misconception is that you need to open a formal probate proceeding before you can investigate whether crypto exists. You don't. Investigation can happen before probate is opened — in fact, knowing whether assets exist is often what determines whether probate is worth opening at all.
If the estate is otherwise simple — no real estate, no business interests, assets below your state's small estate threshold — you may be able to handle everything through simplified procedures. Finding out whether crypto exists first gives you the information you need to make that call intelligently.
Step 5: Know what a professional investigation actually involves
A forensic digital asset investigation does several things that a family member cannot do safely on their own:
- Creates a forensic image of the hard drive — a bit-for-bit copy that preserves the original and allows analysis without risking the source data
- Scans for wallet files, including deleted ones that have been recovered from unallocated drive space
- Reviews the individual's digital footprint — browser history, exchange registrations, email accounts — for evidence of crypto activity
- Checks blockchain explorers to confirm whether found wallet addresses hold any balance before investing time in access attempts
- Delivers a written findings report documenting what was found or confirmed not to exist
The written report matters for estate purposes regardless of outcome. If crypto exists, it needs to be inventoried. If it doesn't, you need documentation that a reasonable search was conducted.
What if you find a seed phrase?
If you find a seed phrase — 12 or 24 words, often written on paper or stamped on metal — handle it carefully. This is the master key to the wallet. Anyone who has it can access and transfer the funds.
Do not enter it into any website that asks for it. Legitimate wallets never ask for your seed phrase for identification purposes — any site that does is a scam designed to steal the funds. If you want to check the balance associated with a seed phrase, contact a professional who can do it on an air-gapped machine not connected to the internet.
What if you find a wallet but don't have the password?
This is the most common scenario. An old laptop has a wallet file — typically named wallet.dat for Bitcoin Core — but nobody knows the password. This is a password recovery problem, not a lost-wallet problem, and it is often solvable.
The approach depends on what's known about the password. GPU-accelerated password recovery can test millions of combinations per second, but against Bitcoin Core's encryption, targeted approaches built from personal information — names, dates, phrases the person commonly used — dramatically outperform generic wordlists. A professional will gather that information before running any recovery attempt.
The bottom line
If you suspect your relative held bitcoin or crypto, the right sequence is: secure the hardware, look for obvious indicators, identify whether you're dealing with exchange accounts or self-custodied wallets, and then get professional help for anything that requires device access or password recovery.
You don't need probate open to call us. You don't need to know whether anything is there. If you have a device and a suspicion, that's enough to start.
Not sure what you're dealing with?
Book a free 15-minute consultation. We'll assess your situation, tell you what's likely there, and explain exactly what investigation would involve — with no obligation to proceed.
Book a Free Consultation