Multisig wallets explained
More than one key, so no single lost or stolen key ends in disaster.
A multisig (multi-signature) wallet needs approval from several keys before funds can move, for example any 2 of 3. One stolen key isn't enough for a thief, and one lost key doesn't lock you out. It's stronger than a single seed phrase for large holdings and inheritance, but more complex: you must back up every key and the wallet's setup details, and every signer must check what they're approving.
Legitimate support will never ask for your seed phrase (recovery phrase) or private key. Not an exchange, a wallet maker, a lawyer, the police or the FBI. Anyone who asks for it, or asks you to type it into a website, is trying to steal from you.
How it works
A normal wallet has one private key (backed up by one seed phrase). A multisig wallet is defined by M-of-N: N keys exist, and any M of them must sign. Common setups:
| Setup | Typical use | What it protects against |
|---|---|---|
| 2-of-3 | Individuals and families: three hardware wallets from different makers, kept in different places | One key stolen, or one key lost |
| 2-of-2 | Two partners who must both agree | Theft of one key, but losing either key locks funds |
| 3-of-5 and up | Companies, funds, DAO treasuries | Several compromised or unavailable signers |
On Bitcoin, multisig is built into the scripting system and has been used since 2012. On Ethereum and similar networks it's a smart-contract account, most commonly a Safe (formerly Gnosis Safe), so it also carries smart contract risk. Some companies offer "collaborative custody," where they hold one of three keys and you hold two.
Benefits
- No single point of failure. A burglar who finds one seed phrase, or malware on one computer, can't move funds.
- Recoverable. In a 2-of-3, losing one key is an inconvenience, not a catastrophe.
- Inheritance and shared control. Keys can be split among you, a trusted person and a lawyer or service, so heirs can recover funds without any one party holding everything. See crypto estate planning.
Risks and traps
- Backups are more than seed phrases. On Bitcoin, recovering a multisig requires every key's public information (the "wallet descriptor" or configuration file), not just M seed phrases. Lose the descriptor and recovery becomes much harder. Store a copy with each key.
- Complexity causes mistakes. Test a full recovery with a small amount before moving savings.
- Higher fees on Bitcoin, because transactions carry more signatures, and contract deployment costs on Ethereum.
- Signers can be fooled together. Multisig only protects you if each signer checks what they sign.
The Bybit lesson (February 2025)
Bybit's Ethereum cold wallet was a multisig. On February 21, 2025, its signers approved a transaction shown in a tampered Safe web interface. It looked like a routine transfer but actually handed control of the wallet to North Korean attackers, who took about $1.5 billion. Every required key signed, so the multisig "worked." The fix is to verify the transaction details on each hardware wallet's own screen, refuse to sign anything the device can't decode, and, for large sums, have signers check independently on separate computers.
If it happened to you
- If one key is lost or exposed, use the remaining keys to move funds to a new multisig wallet with fresh keys right away, before a second key is lost or found.
- Write everything down before anything gets deleted: wallet addresses, transaction IDs (hashes), website addresses, usernames, phone numbers, screenshots of chats, dates and amounts.
- Report it to the FBI at ic3.gov and the FTC at reportfraud.ftc.gov. Reports are free. If funds land at a regulated exchange, law enforcement can sometimes freeze them, and speed matters. A local police report gives you a reference number for your bank or insurer.
- Contact the exchange you sent from, and the receiving exchange if the blockchain shows one, through its official website or app (never a number or link from a search ad or a stranger). Ask them to flag the addresses and the transactions.
- Expect a second scam. Victims are targeted again by fake "recovery" firms, fake lawyers and fake FBI agents. Real law enforcement never charges a fee. Read crypto recovery scams.
Need the steps in order? Use the emergency checklist for a compromised wallet or account.
Frequently asked questions
Is multisig safer than a hardware wallet?
It usually uses hardware wallets. A 2-of-3 multisig with three hardware wallets is safer against theft and loss than one hardware wallet, at the cost of more complexity.
Do I need multisig?
For small amounts, a single hardware wallet with a well-stored seed phrase is usually enough. Multisig earns its complexity for large or shared holdings and for inheritance planning.
What happens if I lose one key in a 2-of-3?
You can still move funds with the other two. Do so promptly, into a new multisig with a fresh third key.
Is a multisig the same as splitting my seed phrase?
No. Cutting a seed phrase into pieces weakens it. Multisig uses separate, complete keys, so no piece reveals anything on its own.
Where to next
Sources
- Bitcoin developer guide: multisig (developer.bitcoin.org)
- Safe documentation
- North Korea responsible for $1.5 billion Bybit hack (FBI PSA, February 26, 2025)
- Lazarus hacked Bybit via breached Safe{Wallet} developer machine (BleepingComputer)
Written for beginners and checked against the sources listed. Last reviewed November 5, 2026. This page is educational and is not financial, tax or legal advice. How we write and check pages.