The Problem With One Backup
A hardware wallet such as OneKey keeps private keys offline, but the recovery phrase is the real master key. If that mnemonic lives as a single card in one drawer, fire, flood, theft, or a curious visitor can destroy your access or hand the secret to someone else. A sharding storage strategy aims for two outcomes at once: you can still recover if one location fails, and no single location is enough to reconstruct the wallet.
Sharding Is Not Cutting the Word List in Half
The most common mistake is to divide a 12- or 24-word phrase into chunks and hide each chunk separately. That is not real sharding. Each chunk still holds a large fraction of the secret, and a stolen half can be far easier to attack than the full phrase. Proper sharding uses a threshold scheme, often implemented with Shamir secret sharing: you create several shares, and only a predefined number of them—commonly two out of three—can rebuild the mnemonic. Any one share, by itself, should reveal nothing useful.
Confirm the restore path before you rely on a format. If your OneKey model expects a standard BIP39 phrase, do not replace that backup with an encoding the device cannot import. A clever split you have never restored is not a backup. Follow the official recovery flow, and test it once in calm conditions before you distribute shares.
Choose a Threshold That Matches Real Life
For most individuals, two-of-three is the practical default.
- Share A stays in a home safe or another place you control day to day.
- Share B goes to a second site, such as a safe-deposit box or a trusted relative’s secure storage.
- Share C is the spare, held in a third location or by a second custodian who does not also hold Share B.
Two shares recover the wallet if one is lost. One share alone should not be enough for an attacker. A three-of-five layout can suit a family office or a small company, but every extra share is another object to inventory, protect, and explain later. Label plates with an index such as “Share 2 of 3.” Never put the share data itself on a sticker, a photo, or a message.
How to Store Each Share
Treat every share with the same care as the full mnemonic.
- Prefer stamped or engraved steel over ordinary paper. Paper fails in fire and water; a phone photo fails as soon as a cloud account is compromised.
- Do not type shares into email, notes apps, screenshots, or a general-purpose password manager. Digital copies quietly become a single point of failure.
- If you use an optional BIP39 passphrase, store it apart from the shares and apart from the people who hold those shares. Losing that passphrase is permanent, so its storage must be at least as durable as the metal plates.
- Do not mark containers with the wallet brand, an account balance, or exchange logins. Anonymous labels reduce the value of a theft.
- Keep a plain-language inheritance note that says a hardware-wallet backup exists, whom to contact, and that a threshold of shares is required. The note must not contain share contents.
In this design, OneKey is the signing device, not the archive. The device can be replaced. The sharded mnemonic cannot, if you lose the threshold or forget a passphrase.
Recovery Drills and Failure Modes
A strategy you have never restored is only a story. Once, using the official OneKey flow, recover onto a spare or reset device, confirm a receive address you already know, and then wipe the test device. Repeat the drill after a move, a change of custodian, or any suspected exposure.
Plan for the failures that actually happen:
- One location is destroyed. The remaining threshold still works, so you create a new share set and retire the old plates.
- One share may have been seen. Treat it as burned. If a second share might also have leaked, move funds to a new mnemonic, because two exposed shares in a two-of-three scheme are the full secret.
- You are traveling. Do not carry two shares together. That collapses the threshold in a suitcase.
- A custodian dies or becomes unreachable. That is why the third share and a written succession plan exist.
A Policy You Can Actually Follow
A workable OneKey mnemonic policy fits on one page: use a real threshold scheme rather than word splits; keep a two-of-three geographic split; store shares on metal; keep any passphrase elsewhere; never photograph the shares; test recovery once; and rotate the entire set if any share is exposed. The goal is boring resilience—access when you need it, and silence when someone else finds a single plate.