Around 20% of the world’s Bitcoin supply is permanently inaccessible because owners lost their private keys or backups, according to Chainalysis data cited by researcher bcTanji. Oobit’s 2026 survey adds that 35% of crypto holders have lost wallet access at least once, and 31% never recovered.
The core culprit: traditional recovery phrases. Expecting ordinary internet users to write down a random word list and safeguard it for life is a method suited for cryptography textbooks, not modern consumer software. bcTanji argues the crypto sector is ready to retire seed phrases, driven by WebAuthn and passkeys that promise to overhaul wallet security and usability.
How WebAuthn Works: Biometrics over Passwords
Standardized by the W3C, WebAuthn uses asymmetric cryptography. When a user creates an account, the device’s secure chip (Apple Secure Enclave, Android Titan M, Windows TPM 2.0) generates a unique key pair; the private key never leaves the device. Authentication requires only a fingerprint or face scan. Passkeys are inherently phishing-resistant—authentication is cryptographically locked to the wallet’s real domain, so fake sites can’t trigger the process.
The Curve Mismatch: Why Bitcoin Lags
The main technical hurdle is elliptic curve divergence. WebAuthn relies on NIST P-256 (secp256r1), whereas Bitcoin uses secp256k1. A device-generated passkey cannot directly produce a valid Bitcoin digital signature. The report outlines four bridging architectures: TEE-based signing (passkey authenticates biometrically, then a remote Trusted Execution Environment signs), MPC (key sharding with one share protected by the device passkey), PRF-based derivation (WebAuthn PRF extension generates a deterministic secret locally to unlock the Bitcoin key), and on-chain verification (Ethereum-style chains can verify P-256 signatures directly, but Bitcoin doesn’t support this natively).
Layer-2 Wallets Lead Adoption
bcTanji notes that fastest change will occur in Bitcoin Layer-2 wallets, which target less technical users and frequent transactions. Spark offers an SDK that allows wallet developers to integrate passkey-based onboarding with minimal friction. Spark uses the FROST threshold signature model; the user’s key share is secured by the device passkey rather than exposed as a word list. Biometrics trigger the key share on-device for secure signing. The report highlights General Bread as a real-world example of a seedless, passkey-protected Layer-2 wallet powered by Spark.
Trade-offs: Platform Dependency and Automation Friction
The report draws several conclusions from bcTanji’s insights. Security and convenience can finally coexist: cloud-synced passkeys (iCloud or Google Password Manager) mean losing a device no longer equals disaster. But the flip side is platform dependency—if an iCloud or Google account is locked or all trusted devices are lost, synced passkeys and the funds they protect become inaccessible, a critical trade-off for decentralization purists. Additionally, passkey specs require live biometric verification for each transaction, complicating automated trading bots and AI-driven wallets that may need to adapt their models to function in a passkey-first world.