Why people switch to H33.

A retired engineer stored a 24-word phrase on a paper card in a home safe six years ago. When the family cleaned out the safe last month, the card was gone. Or moved. Or accidentally shredded with a stack of bank statements. Nobody remembers what happened to it.

The hardware wallet is right there on the desk. It powers on, shows the balance, and asks for the phrase to sign a transaction. Without the phrase, the balance is a photograph of a fortune. Chainalysis estimates that between 3 and 4 million Bitcoin are already stranded like this. Every year adds more.

The father was 68, healthy, and had not yet gotten around to writing everything down. He assumed there would be time. He owned Bitcoin, some ETH, three insurance policies, an IRA with a brokerage nobody in the family had heard of, and a hardware wallet in a safe deposit box he alone had authority over.

The adult daughter was named executor. She found the hardware wallet but not the seed phrase. She called the exchange; they froze the account. She called the insurance companies; two of the three required a certified death certificate before they would tell her which policies existed. Three months in, she was still trying to identify which assets were part of the estate.

A mid-sized manufacturing company. A $4.2 million wire went out eighteen months ago to a legitimate vendor. Now a regulatory examination is asking: prove that Jim, the VP of Finance who has since left the company, actually approved this specific amount, to this specific recipient, at this specific moment.

The SIEM has a session log showing Jim was authenticated. SAP has an entry showing the wire was approved. Neither is cryptographic proof that Jim's authentication and Jim's approval were bound to this particular transaction, at this particular version, under this particular policy. The internal audit team's honest answer is 'we believe so.' The regulator's expected answer is 'demonstrate it.'

A software company, 340 employees. In late 2022 they used LastPass Business. When the vault-blob breach was disclosed and offline brute-force became plausible, the security team spent four weeks rotating credentials, chasing employees whose browsers had cached the old passwords, and answering the same question from the board: 'how do we prevent this next time?'

The correct answer is not another password manager. Another vault is another single point of compromise for the same failure class. The correct answer is that sites verify a cryptographic signature. But rolling that out across 340 people, providing recovery when devices die, and handling the last 15% of sites that don't support WebAuthn yet is a real deployment.

A regional bank's CISO in 2025. Passkeys were finally viable across enough of the customer-facing site set that the bank could commit to a passwordless roadmap. The engineering team started implementing WebAuthn against a handful of relying parties. Six months in, the practical questions kept arriving.

What happens when a customer loses their phone? What happens when they sign a large wire from a new device? How does the bank identify the customer to a call-center agent when there is no password to verify? None of these questions have crisp answers inside a pure WebAuthn deployment. WebAuthn handles the initial credential. It does not handle recovery, cross-device continuity, or the graceful degradation to human channels.