What is Aeternum
A trustless, non-custodial asset recovery and inheritance protocol on Ethereum — built for people who want self-custody without the risk of permanent asset loss.
The Problem With Self-Custody
Self-custody is the right choice. When you hold your own private keys, no exchange can freeze your account, no company can go bankrupt with your funds, and no one can deny you access to what is yours.
But self-custody carries a risk: if you lose access to your keys, become incapacitated, or pass away, your assets can become permanently inaccessible. This isn't hypothetical — and the known cases likely understate it. On the Bitcoin blockchain alone, Chainalysis estimated 2.3 to 3.7 million BTC — roughly 11 to 18% of its 21 million maximum supply — is believed to be permanently lost, based on dormancy analysis of wallets that stopped moving in patterns consistent with lost access or death. No equivalent dormancy-based estimate exists for Ethereum specifically, which tells you how unmeasured this problem still is. On a pseudonymous ledger, a wallet that stops moving could mean the owner passed away, lost a seed phrase, misplaced a hardware device, or simply chose to hold — and the chain alone cannot distinguish between them, which is exactly why the public cases aren't the size of the problem. They're just the fraction that happened to become a story.
Traditional finance has established mechanisms for account recovery, beneficiary designations, and the transfer of assets when an owner can no longer access or control an account. These systems work because institutions, custodians, executors, and legal processes can intervene.
In the Ethereum ecosystem, existing approaches either rely on trusted parties (guardians, custodians, legal trusts), which self-custody was built to avoid, or change how keys are secured (MPC). Designs built on guardians or co-signers, such as social recovery and multisig, also depend on people who must notice what happened and choose to act, and who are exposed to the same loss and mortality risks they are meant to cover.
Aeternum takes a different approach: you set a backup address and an inactivity period, and if the period passes with no on-chain activity, an immutable smart contract transfers your funds to that address. Because the trigger is inactivity alone, the same mechanism covers lost access, incapacity, and death.
What Aeternum Does
AeternumVault is a trustless, non-custodial smart contract vault deployed on Ethereum. It gives you two things at once:
A normal wallet experience. You can deposit ETH, send it anywhere, and withdraw it at will. Your funds are held in the contract and mapped to your address: your balance is accounted for separately from every other user's, it is never lent out, and no other user can move it.
An automatic backup plan. You designate a backup address — a beneficiary, trusted family member, or heir, or a separate wallet you control as your own safety net — and set an inactivity timer. If you stay inactive for the full period, your ETH transfers to that address without any action from you. If you stay active, nothing happens. How recovery is executed, and why no one party can gatekeep it, is covered in The Core Mechanism below.
No privileged roles
AeternumVault has no owner function, no pause mechanism, and no upgrade key. The contract is immutable, so its rules can't be changed after deployment, including by Aeternum Labs.
The Core Mechanism
The system rests on one idea: an on-chain inactivity timer. Every time you interact with your vault — a deposit, a send, a withdrawal, or a call to the ping() function — the timer resets and the full countdown restarts from your configured period.
If the timer reaches zero, the transfer to your backup address becomes executable. Someone still has to submit that transaction. In practice that is almost always the Aeternum Labs keeper bot, but triggerRecovery(), the function that executes the transfer, has no access restriction: any address can call it, including an independent keeper, your backup address, or you. Recovery doesn't depend on any one company's infrastructure staying online.
The caller can only submit the transaction. The contract, not the caller, decides whether the transfer is valid, how much moves, and where it goes, based entirely on your current vault configuration, which you can update at any time. The only address that can receive your funds without your direct action is the backup address you chose, and only after your inactivity period has fully elapsed.
The diagram shows the actors and flow of interactions. The dashed arrow is on-chain events emitted by the vault, picked up by an off-chain indexer and fed into the keeper's database; it is data flowing out of the vault, not a live call to it. The keeper re-checks each candidate directly against the contract before acting (a read, so not drawn as an arrow). The solid arrow, triggerRecovery(), is the only on-chain transaction between the keeper network and the vault. It often batches several wallets into one transaction for gas efficiency, and gas is paid in ETH by whichever address submits it.
Key Properties
| Property | Detail |
|---|---|
| Custody | Non-custodial — funds sit in an immutable contract that no one, including Aeternum Labs, can redirect |
| Admins | None — no owner key, no pause function, no upgrade mechanism |
| Cost | No protocol fee — no subscription, no tiers, identical protection for every user; you pay only ETH gas. Source-available under BUSL-1.1 |
| Network | Ethereum Sepolia (testnet) — mainnet pending external audit |
| Recovery trigger | Time-based only — becomes executable after your inactivity period fully elapses, and only if the vault holds a non-zero balance |
| Minimum timer | 180 days (mainnet) · 5 minutes (Sepolia testnet) |
| Maximum timer | 3,650 days (~10 years) |
What Aeternum Is Not
Understanding the boundaries is as important as understanding the capabilities.
Aeternum is not a multisig. Your designated beneficiary cannot access your vault while you are active. Funds only move to that address if recovery triggers.
Aeternum is not a social recovery system. There are no guardians, no votes, and no approval window after the inactivity period ends. The period itself, which you set, is the only wait.
Aeternum is not custodial. The contract has no owner function, pause, or upgrade path, so Aeternum Labs cannot access your funds.
Ready to Get Started?
The fastest way to see it working is the Quick Start — the full recovery cycle takes under five minutes on Sepolia. If you want to understand the mechanics before committing to any settings, start with The Vault and The Inactivity Timer.