Multisig Wallet: How Multi-Signature Crypto Security Works

A multisig wallet is a crypto account that needs approvals from several separate keys before it can move funds, written as “m-of-n”: a 2-of-3 wallet has three keys and any two can sign. It removes the single point of failure in an ordinary wallet, where one stolen or lost seed phrase means everything is gone. The trade-off is complexity, and complexity creates its own ways to lose money. Below, three realistic setups are designed and then deliberately broken to show where that complexity bites.

Key takeaways

• m-of-n means n keys exist and m signatures are required; 2-of-3 is the common personal design because it tolerates one lost and one stolen key.
• On Ethereum and EVM chains, multisig is a smart-contract account, most commonly Safe; on Bitcoin, it is built into the script and coordinated by wallet software.
• For Bitcoin multisig, the wallet descriptor (or every cosigner’s xpub) is as essential to recovery as the seeds themselves.
• The February 2025 Bybit theft passed every multisig check because signers approved a disguised transaction; what your hardware screen shows matters more than what a website shows.
• Multisig, MPC and smart wallets all spread risk, but they fail differently and suit different users.

What a multisig wallet is (m-of-n in one minute)

A normal wallet has one private key. Whoever holds it, or the seed phrase that generates it, has total control. A multi-signature wallet replaces that one key with a set of independent keys and a rule. The rule is enforced by the blockchain itself, not by a company: on Bitcoin, the coins are locked by a script that checks for m valid signatures; on EVM chains, a contract account refuses to execute a transaction until enough owners have signed it.

Two numbers drive every design decision:

• n, the number of keys, sets how many things you must store, back up and keep track of.
• m, the threshold, sets how many keys an attacker needs (higher is safer) and how many you can lose before the funds are frozen (lower is safer). With 2-of-3 you can lose one key and still spend; a thief needs two.

The keys are only as independent as their storage. Three seeds in one drawer is a 1-of-1 wallet with extra steps. “Key geography” means spreading keys across different device brands, physical locations and, where appropriate, people. Our broader guide to crypto security covers single-key hygiene; this page assumes you already have that down.

Three multisig setups and how they fail

Here are three designs, each pushed through the failures that actually happen: a lost key, a burglary or coercion, a death in the family, and a compromised computer.

A common desktop coordinator is covered in our review of Sparrow’s coin control and PSBTs, which explains how it pairs with hardware signers and multisig setups.

Setup 1: solo saver, 2-of-3

Key A is a hardware wallet at home. Key B is a different-brand hardware wallet in a bank safe-deposit box. Key C is a seed phrase stamped on metal and held by a trusted relative or a collaborative-custody service. Spending normally uses A plus B.

• Lost key: lose A in a house fire, sign with B and C, and move funds to a fresh multisig. Survives.
• Coercion at home: an attacker who finds A still needs a second key held elsewhere. The delay a bank box forces is a real deterrent. Survives, provided B and C never sit at home together.
• Death: heirs need two keys plus the wallet configuration. Without written instructions they may not know key C exists. Weak point.
• Compromised computer: malware can show a fake receive address or a false transaction summary. Both hardware wallets should display and verify the destination. Survives if you read the device screens.

Setup 2: couple, 2-of-3

Each partner holds one hardware wallet; the third key sits with an attorney, a family member or a collaborative-custody provider. Either partner plus the third key can spend, so one person’s death or incapacity does not freeze the funds.

• Lost key: survives, as above.
• Coercion: if both partners’ keys live in the same house, a home invasion defeats the design. Store at least one device off-site.
• Relationship breakdown: neither partner can spend alone, which can be protective or paralysing. Agree in writing in advance what the third keyholder should do in a dispute.
• Third-party failure: if the custodian of key C disappears, you still hold two keys. Survives.

Setup 3: small DAO or team treasury, 3-of-5

Five signers in different cities each use a hardware wallet. Three must approve any payment.

• Signer apathy: if three people go quiet, payroll stops. Teams usually add a process for replacing inactive signers while a quorum still exists.
• Collusion: any three can move everything. A 3-of-5 is only as good as the independence of its members.
• Interface attack: every signer uses the same web app. If that app is compromised, all five see the same false information. This is precisely the Bybit scenario covered below.

Safe wallet on Ethereum and other EVM chains

Safe, formerly Gnosis Safe, is the most widely used multisig on Ethereum and EVM networks. A Safe is a smart-contract account: you choose owner addresses (each normally a hardware or software wallet), set a threshold, and deploy the contract. Proposals are collected off-chain, owners sign them, and the final signer, or a relayer, submits the transaction with all signatures attached. The official web app lives at app.safe.global; type it yourself and bookmark it rather than following links from search ads or messages.

Points that catch new Safe users:

• Deployment costs gas. Creating a Safe is a contract deployment, and executing from it costs more gas than a plain wallet transfer because the contract checks every signature. Fees are cheaper on layer 2 networks, but they are never zero.
• Chains are separate. A Safe deployed on Ethereum does not automatically exist on Base or Arbitrum, even if the address looks identical. Confirm the Safe is deployed on a network before receiving funds there.
• Owners and threshold can change. Adding or removing an owner is itself a multisig transaction, so you can rotate a compromised key without moving funds, provided you still meet the threshold.
• Security add-ons exist. Safe’s help centre documents Safe Shield transaction scanning and, since a November 2025 partnership, an optional Hypernative Guardian transaction guard that can flag or block risky transactions according to owner-set policies.

Because a Safe is a smart account, it overlaps with the broader category explained in our smart wallet guide. The difference is that a multisig’s defining feature is its signer threshold, while smart wallets may use passkeys, spending limits or social recovery instead.

Bitcoin multisig: coordinators and descriptors

Bitcoin supports multisig natively in its scripting language. No contract is deployed; instead, coordinator software builds an address from every cosigner’s extended public key (xpub), assembles unsigned transactions as PSBTs (partially signed Bitcoin transactions), passes them to each hardware wallet for a signature, and broadcasts the result.

Electrum also supports multisig and hardware wallets; our review of the Electrum Bitcoin desktop wallet covers those features and the fake-update attacks of 2018–2019.

Coordinators fall into two camps:

• Self-managed software: Sparrow Wallet (desktop) and Nunchuk (mobile and desktop) let you assemble a multisig from your own hardware wallets with no company involved.
• Collaborative custody: Unchained and Casa sell plans in which the customer holds a majority of keys and the company holds one, so it can help with recovery but cannot spend alone. Unchained describes a 2-of-3 vault where the client holds two keys. Check each provider’s current plans, fees and jurisdictions directly.

The single most important Bitcoin multisig fact: seeds alone may not be enough to recover. To rebuild a 2-of-3 wallet, software needs all three xpubs, the derivation paths and the script type, even though only two keys sign. That information is packaged in a wallet descriptor (or the coordinator’s configuration file). Store copies of it alongside each key. It reveals your balances but cannot spend funds, so its privacy cost is real but its loss is worse. On fees, multisig transactions carry more signature data than single-signature ones, so they generally cost somewhat more in network fees.

Lessons from the Bybit Safe front-end attack

On February 21, 2025, attackers attributed to North Korea’s Lazarus Group stole roughly $1.5 billion in ETH and staked ETH from a Bybit cold wallet secured by Safe multisig. Forensic reviews by Sygnia and Verichains, shared by Bybit’s CEO, found that malicious JavaScript had been planted in Safe{Wallet}’s web infrastructure (served from its AWS storage) about two days earlier. Safe stated that attackers had compromised a Safe{Wallet} developer’s machine. The code activated only for Bybit’s wallet: signers saw what looked like a routine transfer, while the transaction they actually signed handed control of the wallet’s contract logic to the attackers. External researchers reported no flaw in Safe’s smart contracts.

Afterwards, Safe said it rebuilt its infrastructure, rotated credentials, temporarily removed its native Ledger integration and added extra validation of transaction hashes, data and signatures. The lessons apply to any multisig, at any size:

1. The threshold protects keys, not judgment. If every signer trusts the same screen, m-of-n collapses to 1-of-1 against an interface attack.
2. Verify on the device. Compare the destination, the function being called and, on EVM chains, the transaction hash shown on the hardware wallet with an independent source. Blind signing, approving data the device cannot decode, is how this attack worked.
3. Use a second interface. Larger treasuries check proposals in an independent tool or block explorer simulation before signing.
4. Be suspicious of delegatecalls and owner or implementation changes presented as ordinary transfers.

Multisig vs MPC vs smart wallets

For the mechanics of key shares, see our MPC wallet explainer. For choosing the signing devices that hold each multisig key, mixing brands so one firmware bug cannot touch every key, our hardware wallet comparison is the next stop. The wallet types hub places multisig alongside the other models.

FAQ

How do I set up a multisig wallet?

Choose your m-of-n design first, then gather that many hardware wallets, ideally from different makers. On EVM chains, create a Safe at app.safe.global, add each wallet as an owner, set the threshold and deploy. On Bitcoin, import each device’s xpub into a coordinator such as Sparrow or Nunchuk. Then do a small test deposit and a test spend before adding real funds.

Is a 2 of 3 multisig enough for personal savings?

For most individuals, 2-of-3 is a reasonable balance: one key can be lost and one stolen without loss of funds. It only works if the three keys are genuinely separate, in different places and on different devices, and if the wallet configuration is backed up. Larger setups add resilience but also add things to manage and forget.

What do heirs need for multisig inheritance?

Heirs need access to the threshold number of keys, the wallet descriptor or configuration file (for Bitcoin) or the Safe address and network (for EVM), and clear written steps naming the software to use. Many people store a letter with an attorney that explains where keys are without containing them. Rehearse the recovery yourself once so you know the instructions work.

Is a Safe multisig wallet safe after the Bybit hack?

Investigators did not find a flaw in Safe’s smart contracts; the attack compromised the web interface and relied on signers approving a transaction they could not read. Safe has since rebuilt infrastructure and added validation and optional transaction scanning. Your own protection is independent verification: check the transaction details on each hardware wallet and in a second tool before signing.

Crypto is volatile and risky; this is education, not financial advice. Do your own research.