Multi-Sig Basics — Taking Custody — The Bitcoin Transition

Film · No single key · 1:34

Block ———

A short film for module 4 of Self-Custody: why a single key is a single point of failure; how a 2-of-3 multisig wallet works, with three keys of which any two can spend; why losing one key leaves the coins yours and stealing one gets a thief nothing; keys that cannot fail together, from unrelated vendors, on open-source firmware, kept in different places and seeded with your own dice rolls; the wallet descriptor, which must be backed up with every key because three seeds without it will not recover the wallet; multisig's own risks, said plainly: falling below the threshold, more steps to get wrong, harder for heirs; practising recovery with a small amount first, and keeping less in cold storage if this is more than you will maintain; and the contrast with fiat currency in a bank, a claim on one institution.

Read the film, with its sources

Self-Custody · Module 4 of 4Multi-sig Basics. With a single key, one loss or one theft can cost you everything. A multi-signature wallet is built so that no single key can.
One keyA wallet with one key, backed up as one seed phrase, has one point of failure. If the key is lost or destroyed, the coins are gone for good. If someone copies it, they can take them, and no one can reverse it.
2-of-3 multisigA multi-signature wallet needs more than one key to spend. Bitcoin has had a standard form for it since BIP 11: M keys of N must sign. The common personal choice is 2-of-3: two of three keys can spend. Each key is made on its own device, and the three together define one wallet.BIP 11, “M-of-N Standard Transactions” (Gavin Andresen, 2011)BIP 383, “Multisig Output Script Descriptors” (Pieter Wuille and Ava Chow, 2021)
One key lostIf one key is destroyed, in a fire or a flood or by a failed device, the other two can still sign. 2 of 3 remain, the coins are still yours, and you can move them to a new wallet with fresh keys.BIP 383, “Multisig Output Script Descriptors” (Pieter Wuille and Ava Chow, 2021)
One key stolenIf a thief takes one key, it is not enough: the wallet needs 2 signatures, and they hold one. The other two keys are still yours, and with them you can move the coins somewhere the stolen key has no part in.BIP 383, “Multisig Output Script Descriptors” (Pieter Wuille and Ava Chow, 2021)
Keys that cannot fail togetherThe protection only holds if the keys cannot fail together. So each key comes from an unrelated vendor, so no single device or vendor being wrong can cost you; runs open-source firmware, so anyone can check it; is kept in a different place, so one fire, flood or burglary cannot reach two; and is seeded with entropy you generate yourself: at least 50 fair, private dice rolls, about 129 bits, more than the 128 of a 12-word seed phrase, or a strong unique passphrase. No device or vendor is named here, by design.BIP 39, “Mnemonic code for generating deterministic keys” (12 words carry 128 bits of entropy)
The descriptorA multisig wallet has one more thing to keep: the wallet descriptor, the record of which public keys form the wallet and how many must sign. Written out, a 2-of-3 looks like wsh(sortedmulti(2,KEY_A,KEY_B,KEY_C)), with the real keys in place of the names. Without it, the three seed phrases will not recover the wallet; the standard itself says a backup of the keys alone means “this backup solution is insufficient”. Keep a copy of the descriptor with every key.BIP 380, “Output Script Descriptors General Operation” (Pieter Wuille and Ava Chow, 2021)BIP 383, “Multisig Output Script Descriptors” (Pieter Wuille and Ava Chow, 2021)
Multisig’s own risksMultisig is not a free upgrade, and it has risks of its own. Lose the descriptor and the seeds alone will not rebuild the wallet. Lose two keys of three and you fall below the threshold: the coins cannot be spent by anyone. There are more steps to get wrong, at setup and at every spend, and it is harder for heirs to follow.BIP 380, “Output Script Descriptors General Operation” (Pieter Wuille and Ava Chow, 2021)
Practise firstPractise a full recovery with a small amount before trusting the wallet with savings. And if this is more than you will realistically maintain, that is a legitimate answer: it should change what you keep in cold storage, rather than push you into a setup you cannot operate. A small spending wallet can stay simple.
Fiat currency and multisigFiat currency in a bank is a claim, not money in your hands: in the Bank of England’s account, a deposit is a record of what the bank owes you, so it rests on one institution. Bitcoin held in multisig is not a claim on anyone, and it rests on no single key, device, vendor or place. Few prices are set in bitcoin yet, and keeping it safe takes care, but the care is yours to take.McLeay, Radia and Thomas, “Money creation in the modern economy”, Bank of England Quarterly Bulletin 2014 Q1, p. 16
The Bitcoin TransitionWhat is multi-sig? Fiat trusts one bank. Multisig trusts no single key.

A standard Bitcoin wallet uses a single private key to authorise transactions. Multi-signature (multi-sig) wallets require multiple keys — typically two out of three, or three out of five — to sign a transaction before it can be broadcast. This eliminates the single point of failure that defines single-key custody.

Why Multi-Sig Exists

Single-key custody has an inherent vulnerability: if one key is compromised, all funds are lost. If one key is destroyed, all funds are lost. The risk is binary — a single event can produce total loss in either direction.

Multi-sig changes the risk profile. In a 2-of-3 setup, losing one key does not lock you out (you still have two), and an attacker who obtains one key cannot spend the funds (they need two). You can survive a single catastrophic failure — fire, theft, or device failure — without losing access.

How It Works

A multi-sig wallet is defined by two numbers: the threshold (how many keys are needed to sign) and the total (how many keys exist). The most common configurations are:

2-of-3 — three keys exist; any two can authorise a transaction. This is the most common personal multi-sig setup.
3-of-5 — five keys exist; any three can authorise a transaction. This is common for institutional or family custody.
2-of-2 — two keys exist; both are required. This offers no redundancy for key loss and is rarely recommended for savings.

Each key is held on a separate device — typically a separate hardware wallet — and ideally stored in a separate physical location. Open-source wallet software on your computer coordinates the signing process: it constructs the transaction, sends it to each signing device in turn, and broadcasts it once the threshold is reached.

A Practical 2-of-3 Setup

Here is a concrete example of a 2-of-3 multi-sig for personal savings:

Key 1 — an open-source signing device from one vendor, stored in your home safe.
Key 2 — a device from a second, unrelated vendor, stored at a family member's house or a safety deposit box.
Key 3 — a device from a third vendor, stored in a third location (a trusted friend, a second safety deposit box, or your office).

Three unrelated vendors, three locations, three independent firmwares — that combination is the point, and it is why we do not tell you which three devices to buy. Generate your own entropy where the device allows it: at least 50 fair, independent, private dice rolls contribute enough randomness on their own to put the seed beyond brute force, regardless of what the device's internal generator did, and around 99 rolls gets you a full 256 bits. Verify the resulting phrase on the device before funding it.

Multi-signature is not a free upgrade, and we would rather say so than sell it as one. It is harder to set up, harder to operate, and harder to hand on. Recovery needs the wallet descriptor — the record of which public keys form the wallet — and all three seed phrases without it will not open the wallet. Falling below the threshold ends it. If this is more than you will realistically maintain, that is a legitimate answer and it should change what you keep in cold storage, rather than push you into a setup you cannot operate. Practise a full recovery with a small amount before trusting it with savings.

Each device generates its own key pair during setup. The wallet software combines the three public keys to create a multi-sig address. To spend from this address, you need to sign the transaction with any two of the three devices.

If your home burns down (Key 1 destroyed), you still have Keys 2 and 3. If the second device is stolen (Key 2 compromised), the thief still needs a second key. If one vendor turns out to have shipped a firmware defect, the two keys from other vendors are unaffected. In every one of those scenarios you retain access and the attacker does not.

The Complexity Trade-Off

Multi-sig is more complex to set up and to operate than single-key custody. Each transaction requires coordinating multiple devices, potentially in multiple locations. The initial setup requires care in recording each key's seed phrase and the wallet's configuration file (the "wallet descriptor" or "multisig quorum"), which is needed to reconstruct the wallet.

A single device with a strong seed phrase backup is reasonable for money you expect to spend. For savings, a single point of failure is not acceptable, and the added complexity is the price of removing it, which is why the caveats above matter as much as the setup.

Collaborative Custody

Collaborative custody is a middle path: a company holds one of the three keys, you hold the other two, and the company assists with signing, recovery and inheritance planning. You retain ultimate control, because you hold the threshold. We do not name providers; if you consider one, check that you could leave it and spend with your own two keys alone, using standard software and your own copy of the wallet descriptor.

The trade-off is that the company knows your identity and your key configuration. For those who require privacy, a fully self-managed multi-sig is the only option. For those who want professional support without giving up sovereignty, collaborative custody is a reasonable compromise.

← Previous

Seed Phrase Security