Multisig wallets explained: requiring more than one key to move your crypto

With an ordinary crypto wallet, one private key controls everything. Lose it, and the funds are gone. Let someone steal it, and they can take everything. NIST, the US standards agency, puts it bluntly: if a private key is stolen, the attacker has full access to all the assets it controls.

A multisig (multi-signature) wallet removes that single point of failure by requiring several keys to approve a transaction. This guide explains how it works, the common setups, who uses it and the trade-offs.

How multisig works

A multisig wallet is set up with a number of keys, M, and a number of signatures needed to spend, N. It’s described as “N of M”: a 2-of-3 wallet has three keys, and any two of them must sign before funds can move.

ethereum.org explains the rule: multisigs require N signatures out of M possible acceptable signatures, where N is less than or equal to M and M is more than 1. It says 3-of-5 and 4-of-7 are commonly used. In a 4-of-7 multisig, four of seven possible signatures are needed, which means:

• the funds are still retrievable even if three keys are lost; and
• a majority of key holders must agree before anything moves.

Why people use it

ethereum.org lists the main benefits:

• No single point of failure for wallets holding substantial amounts.
• Shared responsibility: control and key management are divided between several parties.
• Protection against loss: losing one private key doesn’t lead to an irreversible loss of funds.

Common uses include:

• Personal security: keys kept in different places or on different devices, so a single theft or lost device isn’t fatal. See hot vs cold wallets.
• Shared funds: business partners or a family who want joint control.
• Organizations and DAOs: ethereum.org notes that multisig contracts can be used for simple DAO governance. See what is a DAO?
• Escrow: a buyer, a seller and a neutral party each hold a key, and any two can release the funds.
• Protecting smart contracts: ethereum.org recommends multisig accounts, such as 3-of-5, to control sensitive functions like upgrading or pausing a contract.

Multisig on bitcoin

Bitcoin has supported multisig for a long time. BIP 11, a 2011 Bitcoin Improvement Proposal by Gavin Andresen, made M-of-N signature transactions a standard transaction type. Its stated goal: to enable secured wallets, escrow transactions and other uses where spending requires more than one signature. Its examples:

• a 2-of-2 wallet where one signature comes from your computer and the second from a separate protection service; and
• three-party escrow with a buyer, a seller and a trusted dispute agent, using 2-of-3.

NIST’s blockchain overview, in a bitcoin example, describes escrow the same way: funds placed with a third party and released based on conditions, via multi-signature transactions.

Backing up a bitcoin multisig: keys aren’t enough

With a single-key wallet, the seed phrase is usually all you need to restore it. A multisig is different. BIP 380, which defines output script descriptors, explains that backups have typically consisted only of private keys, mostly as seed phrases, and that this is insufficient: it has led to incompatibilities between wallets when restoring.

A descriptor describes exactly which scripts and keys a wallet uses. For multisig, BIP 383 defines it as multi(k, KEY_1, KEY_2, ..., KEY_n): the threshold (k) plus every co-signer’s public key. To rebuild a 2-of-3 wallet, a wallet app needs to know all three public keys and the threshold, even though only two keys will sign.

In practice: back up the descriptor (or the setup file your wallet produces) alongside each seed phrase, and keep a copy with each key. A descriptor built from public keys can’t be used to spend, but it does reveal which addresses belong to the wallet, so keep it private too.

MuSig2: multisig that looks like a single signature

Since the Taproot upgrade, bitcoin also supports a newer approach. BIP 327 standardizes MuSig2, in which several signers combine their keys into one aggregate public key and jointly produce one ordinary signature:

• Smaller and cheaper: on-chain, the output is essentially a single public key and spending it needs a single signature, which is more compact than each signer adding their own key and signature.
• More private: a MuSig2 output is indistinguishable from a regular single-signer Taproot output to anyone looking at the blockchain.
• All must sign: MuSig2 is an n-of-n scheme, not an m-of-n threshold. Every signer has to take part. Backup spending conditions can sit in hidden script paths, revealed only if used.

Fees: Bitcoin.org notes that bitcoin fees depend on the size of a transaction in bytes, so multisig transactions may cost more than simple ones. See bitcoin transaction stuck?

Multisig on Ethereum

On Ethereum, a multisig is a smart contract account that requires multiple valid signatures before it executes a transaction, as ethereum.org describes it. That brings extra flexibility, but also smart contract risk: the wallet is only as safe as its code.

ethereum.org’s security guide cites two incidents involving Parity wallets:

• the Parity multi-sig wallet hack, with $30 million lost to hackers; and
• the Parity frozen wallet issue, with over $300 million in ETH locked forever.

If you use a smart contract multisig, choose a widely used, well-reviewed one, and remember that audits help but aren’t a guarantee. See what is a smart contract?

The trade-offs

• More complexity. Setting up and using a multisig takes more steps, and mistakes in setup can be costly.
• More backups. Each key needs its own secure backup, and you need to know where the wallet’s setup details are. Losing more keys than the threshold allows, or the information needed to rebuild the wallet, can make the funds unrecoverable.
• Coordination. Every transaction needs enough signers to be available.
• Fees. On bitcoin, multisig transactions are larger and may cost more.
• Signers can still be tricked. A multisig only helps if each signer checks what they’re approving. If several signers approve a malicious transaction they didn’t understand, the protection is gone. See token approvals and how to revoke them.

Tips if you set one up

1. Choose a sensible threshold. 2-of-3 is a common personal setup: one key can be lost or stolen without losing control.
2. Keep keys in different places and, ideally, on different types of device.
3. Back up everything you need to rebuild the wallet, not just the keys.
4. Test with a small amount, including a full recovery, before moving larger sums.
5. Write clear instructions for whoever might need to act if you can’t. See crypto and inheritance.
6. Verify every transaction on each signing device before approving.

For the basics behind multisig, see public keys, private keys and addresses and seed phrase security.