Multisig wallet

A multisig wallet moves funds only after M of its N authorised keys have signed, where an ordinary wallet needs one. In a 2-of-3 setup, three keys exist and any two can spend. Ethereum.org presents the idea as a defence against single points of failure and against the permanent loss of one private key.

From a 2011 Bitcoin proposal to smart contracts

Gavin Andresen’s BIP 11 of October 2011 made M-of-N a standard Bitcoin transaction for up to three keys. BIP 16, from January 2012, put the script behind a short hash and allows up to 15 compressed keys. Ethereum has no native version: a multisig there is a smart contract, such as a Safe, that stores its owners and a threshold.

How a multisig wallet works

1. The owners pick M and N and generate each key separately, ideally on different devices.
2. On Bitcoin, the wallet turns the public keys and M into a script, and the address is a hash of it. On Ethereum, a contract is deployed with the list of owners.
3. Someone proposes a transaction, and each signer reviews and signs it on their own device.
4. Once M signatures exist, the transaction goes out, and the network or the contract rejects it if any are missing.

The arithmetic of 2-of-3 and 3-of-5

Two subtractions tell you what a setup survives: N minus M is the number of keys you can lose, M minus 1 the number a thief can hold without being able to spend. Both setups below are hypothetical.

The table assumes independent keys. Give two keys of a 2-of-3 to one team and a single breach of that team reaches the threshold.

Bybit showed what a multisig wallet cannot check

On 21 February 2025, about $1.5 billion left Bybit’s Ethereum cold wallet, a Safe multisig, during a routine transfer. The FBI blamed North Korea. Safe said attackers used a compromised developer machine to propose a malicious transaction in disguise, and that outside reviewers found no flaw in its contracts. NCC Group’s analysis says the web interface showed signers the intended transaction while the data behind it had been altered. In NCC’s reading they blind-signed it, and so handed over control of the wallet contract.

Sygnia’s interim forensics, reported by The Block, traced this to malicious JavaScript in Safe{Wallet}’s AWS storage, cached about two days before the theft and swapped for clean files two minutes after it. Safe’s March 2025 post-mortem, as reported by Cointelegraph, says the attackers hijacked AWS sessions from a developer’s Mac.

Ronin and Parity: concentrated keys and buggy code

Ronin, a bridge rather than a wallet, needed five of nine validator signatures. The attacker controlled Sky Mavis’s four validators, then used an allowlist Axie DAO had granted in November 2021 and never revoked to obtain the fifth. Ronin’s own account dates the theft of 173,600 ETH and 25.5 million USDC to 23 March 2022. Nobody noticed until 29 March.

Parity’s failures came from wallet code. On 19 July 2017 an attacker called a setup function again on three multisigs, replaced the owners and took 153,037 ETH, according to OpenZeppelin’s analysis. On 6 November 2017 a user made themselves owner of a shared library contract and destroyed it. Parity counted 587 wallets stranded, holding 513,774.16 ETH.

Multisig vs MPC: where the rule is enforced

With a multisig, the keys are complete and separate, and the chain or a contract counts the signatures, so the rule can be audited on-chain, though Bitcoin reveals it only when coins are spent. MPC splits one key into shares and signs off-chain, and the chain sees one ordinary signature. That makes it cheaper on-chain and usable on networks without scripting, but the policy usually lives in the vendor’s software. Our report on Google’s MPC custody preview of October 2026 makes a point that holds for multisig too: two shares on one team bring back a single point of failure.

MuSig2 on Bitcoin is a third thing: several signers produce one signature, but all of them must take part, so it offers no M-of-N threshold.

Limits to weigh before you set one up

Coercion is the one that hardware cannot solve. Someone forced to sign can still sign if they control M keys, so holders who fear it leave other keys with someone else, and some setups add a delay on withdrawals. Quantum risk remains, because spending still exposes public keys.

Complexity is the everyday cost: every key needs its own backup. Our guide to crypto wallets compares custody options if one hardware device may be enough.

Multisig wallet: questions readers ask

Is a multisig wallet safe?

It is safer against one stolen or lost key, within the limits M and N set. It does not stop signers approving a disguised transaction, as Bybit found in 2025, or a flaw in contract code, as Parity found in 2017. Careful checks of what you sign remain necessary.

Is a Ledger or Trezor a multisig wallet?

No, not by itself. A hardware wallet is a device that holds keys, and a multisig is a rule that spans several keys. A Ledger or Trezor can act as one signer in a multisig, and using two different brands avoids relying on a single vendor for every key.

What happens if I lose a key?

Your funds stay reachable while you hold M keys, but your margin has shrunk, so move them to a new setup soon. In a 2-of-3, losing one key leaves you able to spend, while losing two locks the funds for good unless a recovery path was set up in advance.

How do I recover a multisig wallet?

You need M keys, and on Bitcoin also every public key and the script, because the address is derived from them and a spend must reveal the script. Keep the wallet’s descriptor, which records both, with your backups. Below M keys the funds are gone, unless a recovery path was arranged beforehand.