Lazarus Protocol
Last updated: September 9, 2026
Lazarus Protocol — Estate Planning & Emergency Continuity
HellBound & Nyxor
The Lazarus Protocol monitors wallet activity and can notify designated beneficiaries if the user becomes unreachable for a defined period ranging from 30 to 365 days.
How It Works
When Lazarus is configured, XColdPro registers a background watchdog process with the operating system:
- Windows: Task Scheduler
- macOS: LaunchAgent
- Linux: crontab
The watchdog runs automatically every 6 hours, even when XColdPro is not open. During each check, it reads the last recorded activity timestamp and compares it against the configured inactivity threshold.
Five-Stage Escalation
| Stage | Trigger | Action |
|---|---|---|
| 1 — Reminder | 30 days before timeout | Sends a reminder to the user |
| 2 — Warning | 7 days before timeout | Sends an urgent warning to the user |
| 3 — Notify | At timeout | Notifies designated beneficiaries |
| 4 — Recovery | 7 days after trigger | Delivers recovery instructions |
| 5 — Final Notice | 30 days after trigger | Directs beneficiaries to act on recovery instructions |
Each time XColdPro is opened, the activity timestamp is updated and all escalation stages are reset.
Security Architecture
| NEVER Transmitted | Transmitted When Triggered |
|---|---|
| Seed phrases / mnemonic words | Beneficiary name & relationship |
| Private keys | Wallet owner's name (from Gmail) |
| Wallet passwords | Inactivity duration |
| Full wallet addresses | Custom recovery instructions (written by you) |
| Blackhole encryption keys | Attorney/executor contact info (if configured) |
| Internal system paths | Portfolio snapshot: networks, masked addresses, balances |
Storage & Consent
- Configuration and beneficiary metadata are obfuscated at rest with a SHA-256-keyed stream cipher. This layer deliberately does not use your master password: Lazarus is a dead-man's switch that must read its own configuration while you are absent, so a key only you could supply would stop the watchdog from ever firing. No seed, private key or master password passes through it.
- Notification service credentials are held in isolated stealth storage and are scoped to sending only. As with any credential shipped inside a client application, they should be treated as public.
- Files use Hidden + System + Read-only attributes — invisible to file browsing
- Disabling Lazarus automatically removes the scheduled task — fully removable
Quick Reference
| Setting | Value |
|---|---|
| Background Check | Every 6h (OS scheduler) + every 60s (app open) |
| Timeout Options | 1 min (test), 30, 60, 90, 180, 365 days |
| Admin Required | No — runs at user level |
| Platforms | Windows 10/11, macOS, Linux |
| Email Method | Gmail OAuth 2.0 API + Resend (redundant delivery channels) |
For best results, use a moderate timeout period (30–90 days). Combine Lazarus with SeedVault Shamir shares distributed to trusted individuals and/or an attorney for maximum estate continuity.