Multisig: Removing the Single Point of Failure

An ordinary wallet has one key, and that key is simultaneously the thing that must never be stolen and the thing that must never be lost. Those two requirements pull in opposite directions – backing it up more makes theft easier, backing it up less makes loss easier – and multisig is the structural answer to that tension.

What it actually is

A contract that holds the funds and will only execute a transaction when enough of its designated signers have approved it. Two of three is the common setup: three keys exist, any two can act, and no single one can do anything alone.

It is not a special kind of key or a wallet application. The funds belong to a contract address, and the keys are inputs to its rules.

Why two of three works

Because it survives both failures. A stolen key is useless on its own, so a compromise gives you time to move funds using the other two. A lost key still leaves two, which is enough to act – and to add a replacement.

What it costs

Every transaction requires multiple approvals, each of which is a transaction, so gas is higher and acting is slower. That slowness is a genuine cost when something needs to move quickly, and it is also a feature – a wallet you cannot drain in thirty seconds is a wallet you cannot be socially engineered into draining in thirty seconds.

The failure mode people do not plan for

Key distribution that looked sensible and becomes unreachable. Three keys in the same drawer is one key. Three keys across three people who stop speaking is a locked wallet. Two keys on devices that both got replaced is a very expensive lesson.

The configuration is a decision about failure, so it should be made by listing the failures: what happens if a device dies, if a person is unreachable for a month, if a house burns down, if you are the one who is unavailable.

• Keep signers genuinely independent – different devices, different locations, different custody methods.
• Write down the recovery procedure somewhere a successor could find, because an undocumented multisig is a trap for anyone who inherits it.
• Test a transaction with a small amount after setup and after any signer change.
• Keep a separate ordinary wallet for trading. A multisig is for holdings, not for reacting to a chart.

For most individuals the honest recommendation is simpler than multisig: a hardware-backed wallet for holdings, a separate hot wallet funded with trading size, and approvals cleared regularly through Revoke.cash. Multisig earns its complexity when funds are shared, or large enough that a single mistake is unacceptable.