Multisig wallets: what they solve, and what they cost you

A multisignature wallet holds funds that can only move when several independent keys sign off — two of three, three of five, or whatever threshold you choose. It converts the central risk of self-custody, where one lost or stolen key is fatal, into a design you can survive. The price is a setup that must be documented, tested and understood by everyone who holds a key.

What problem does multisig actually solve?

Ordinary self-custody concentrates everything into one secret. Whoever holds the seed phrase controls the funds, and whoever loses it destroys them. That single point of failure is fine for spending money and uncomfortable for savings, because it means one house fire, one convincing phishing page or one moment of carelessness ends the story. Our self-custody explainer covers that baseline; multisig is what you reach for when one secret is no longer enough.

A threshold signature spreads that authority. With a 2-of-3 arrangement, an attacker who compromises one key gets nothing, and an owner who loses one key still has two — enough to move funds to a new setup. Nothing is trusted to a company; the rule is enforced by the network.

How does a multisig setup work in practice?

You create three keys on three separate devices, ideally from different manufacturers so a firmware flaw in one does not compromise all of them. The wallet software combines their public keys into a single address, along with the threshold. Spending then requires signatures from the threshold number of devices, gathered in sequence and broadcast as one transaction.

• A common personal layout: one key at home, one in a bank deposit box or with a trusted party, one in a second location entirely.
• A common team layout: 3-of-5 across separate people, so no individual can move funds and no two absences block operations.
• You must back up the wallet descriptor or configuration — the record of which public keys and threshold form the wallet — not just the seed phrases.
• Signing is asynchronous: a partially signed transaction can travel between devices before it is complete.

How do implementations differ by chain?

On Bitcoin, multisig is part of the base protocol: the spending condition lives in the script that locks the coins, and it is enforced by every node. There is no extra contract to trust, and the arrangement is as durable as Bitcoin itself.

On smart-contract chains, a multisig is a contract that holds assets and enforces its own signing rules. That brings flexibility — spending limits, roles, session keys, module upgrades — and adds contract risk, since a bug in the wallet code is a bug in your custody. Established, heavily audited contract wallets exist for exactly this reason; new ones are a different proposition.

What are the failure modes?

Multisig removes one class of disaster and introduces another. The dominant cause of loss is not attackers; it is complexity meeting time.

• Undocumented setups. Six months later, nobody remembers which device holds which key, or where the third one went.
• Untested recovery. A setup that has never been rebuilt from backups is a hypothesis, not a plan.
• Co-signer unavailability. If keys are held by other people, illness, travel or a falling-out becomes a treasury problem.
• Fee and interface friction. Higher on-chain cost on Bitcoin, and a smaller pool of wallet software that supports your exact arrangement.
• Single-vendor concentration. Three keys on three devices from the same manufacturer share one supply chain and one firmware.

Who should actually use one?

If your holdings are modest and active, a hardware wallet with a well-stored seed phrase is proportionate, and multisig will mostly add friction you will resent. Multisig starts to pay for itself when the balance would materially hurt to lose, when more than one person is responsible for the funds, or when you need a plan for what happens if you are not around. Treat the threshold as the easy part and the documentation as the real work: write down the layout, store it with the backups, and rehearse a recovery on a small amount before it matters. Our best hardware wallets ranking compares the devices most people use as the individual keys in a setup like this.

What does multisig cost in practice?

Three costs deserve attention before you commit funds. On Bitcoin, a multisig spend carries more data than a single-signature spend, so the transaction fee is higher — modest in quiet conditions, noticeable when the network is busy. On smart-contract chains, the wallet is a contract that must be deployed and then executes more logic per transaction, which shows up as gas.

The second cost is time. Gathering signatures from devices kept in different places is deliberate friction, and that friction is the security feature — but it means multisig suits savings rather than the wallet you swap from on a Tuesday evening.

The third is software. Not every wallet supports every arrangement, and you are choosing a smaller ecosystem with fewer interfaces. Check that at least two independent pieces of software can rebuild your setup from its descriptor, so you are not dependent on one vendor continuing to exist.