Build a 2-of-3 multisig

A 2-of-3 multisig wallet holds three keys and requires any two of them to spend. Lose one and you are fine. Have one stolen and the thief has nothing. It removes the single point of failure that every ordinary wallet has, and for larger amounts that is a genuine step up.

It also introduces a new way to lose everything, one that has nothing to do with keys and catches people who did the hard part correctly. That is most of what this guide is about.

Set aside an afternoon. This is not a thing to do quickly, and the last stage — rehearsing the recovery — is the stage that matters most and the one people skip.

The thing that kills multisig wallets

Your three seed phrases are not enough to rebuild this wallet.

To reconstruct a multisig, software also needs to know the policy — that it is 2-of-3 — the script type, the derivation path each key uses, and the extended public key of all three keys, including the ones you are not holding. That bundle is called the wallet descriptor, or the wallet configuration file.

Without it, you can hold all three seeds in your hand and still be unable to find your own coins, because you cannot derive the addresses they live at. The funds are visible on the blockchain and unreachable.

Note the fourth row. It is the only failure in that comparison which multisig introduces, and it is entirely preventable.

Choosing the three keys

The point of three keys is that no single event takes two of them. That applies to manufacturers as much as to locations.

Using three devices from different makers means a firmware bug, a supply-chain compromise, or a company disappearing cannot affect more than one of your keys. The cost is that you are learning three interfaces instead of one, and your coordinator has to support all three.

• Two or three different makes is the common compromise — meaningful diversity without three separate learning curves.
• Check coordinator support first. Sparrow, Nunchuk, and Specter each support a wide range, but confirm your exact three before buying.
• Prefer devices that show the full address on their own screen, since verifying a multisig receive address on-device is how you confirm the wallet is what you think it is.
• Avoid a key you cannot replace. If one device is discontinued and irreplaceable, plan for how you would rotate it out.

A key held by another person — a partner, a lawyer, a family member — is a legitimate third key and is how many people build inheritance into the wallet. It is also a relationship you are now depending on. Decide that deliberately, not by default.

Where the keys live

Three keys in one house is a single point of failure wearing a disguise. One burglary, one fire, one flood takes all three, and you have paid the complexity cost for nothing.

The rule is that no single event and no single location should reach two keys. In practice that usually means home, a second property or a trusted person, and a bank safe deposit box or equivalent.

Three different hardware wallets laid out on a desk, visibly different makes, each with its own backup card beside it.

Image to come

• Spreading keys too far has its own cost. If assembling two signatures takes a week of travel, you will avoid using the wallet, and an unused wallet is one you never verify still works.
• Do not store a key and its own backup in the same place. That pairing is what a burglar finds together.

Building it

The mechanics vary by coordinator, but the sequence is the same everywhere.

• Set up each of the three devices independently, generating its own seed on-device and taking its own backup. Do not create all three from one seed — that is one key wearing three hats.
• Export the extended public key from each device, by microSD or QR rather than by typing.
• In the coordinator, create a new multisig wallet, set the policy to 2-of-3, and import all three public keys.
• Give the wallet a name you will recognise in a decade, not wallet2.
• Register the wallet configuration back onto each device that supports it — this is what lets the device recognise its own change addresses and display them safely.
• Export the wallet configuration file and store a copy with every seed backup.

That registration step matters more than it looks. A device that does not know the wallet policy cannot verify that a change address belongs to you, which means it cannot warn you if a compromised computer tries to route your change somewhere else.

What each backup location should contain

Three identical packages, in three places. Each one holds one key and everything needed to use it.

• One seed phrase — written by hand, on paper or metal.
• A copy of the wallet configuration or descriptor.
• A note of the policy in plain language: 2 of 3 required to spend.
• The wallet's master fingerprints, so a restore can be verified against something.
• A note of which coordinator software was used and where to get it.
• The passphrase policy, if any key uses one — recorded separately from that key's own words.

Write the note as though the reader has never heard of any of this, because one day the reader may not be you.

Rehearse the recovery

This is the stage that turns a multisig from an arrangement into something you have actually verified. Skipping it is the single most common way people end up with an elaborate wallet they cannot open.

• Fund the wallet with a small test amount and confirm it arrives.
• Spend from it using keys one and two.
• Spend from it again using keys one and three, then again with two and three. Every pair must work — an untested pair is a pair you are assuming.
• Rebuild the wallet from scratch in a fresh install of the coordinator, using only the configuration file and two seeds. This proves the backup package is sufficient.
• Ideally, do that rebuild in a different coordinator than the one you built it in, which proves you are not dependent on one piece of software.

Only after all of that should the wallet hold an amount you would miss.

What it does not fix

Multisig is not a general-purpose upgrade, and it is worth being precise about the gaps.

• Coercion. Someone forcing you to hand over funds can wait while you fetch the second key. Distributing keys makes this slower, not impossible.
• Bad operational habits. Approving a transaction without checking the address on-device is just as fatal with three keys as with one.
• Inheritance. Multisig makes this harder, not easier, unless you write the plan down. More parts means more that has to be explained.
• Your own attention. Three devices, three backups, and three locations need periodic checking. A key you have not verified in five years is a key you may not still have.

The costs you should expect

Multisig transactions carry more data on-chain than single-signature ones, because every spend has to include multiple signatures and the script. Expect to pay noticeably more in network fees for the same transaction, and more still when the mempool is busy.

Spending is also slower in practice. Two devices must be brought together, or a partially signed transaction passed between them, which is friction by design — useful for savings, poor for anything you spend from regularly. Most people who run multisig keep an ordinary single-signature wallet alongside it for day-to-day amounts.

If holding all three keys yourself is too much

Everything above assumes you hold every key. There is a middle option between that and leaving coins on an exchange, usually called collaborative custody: a multisig wallet where a company holds one of the keys and you hold the rest.

The important structural point is that this is not custody. In a 2-of-3 where you hold two keys and the company holds one, they cannot move your bitcoin — one signature is not enough. You can spend without them, using your own two. What they provide is a key that survives your house burning down, plus support from people who do this every day.

The services people use

• Unchained — Bitcoin-only collaborative custody vaults, where the client typically holds two keys and Unchained holds the third. Also offers inheritance arrangements and lending against the vault.
• Casa — tiered multisig plans with a company-held recovery key and mobile-first key management, scaling up to larger quorums for higher tiers.
• Nunchuk — assisted wallets and inheritance planning layered on top of a wallet you can also run entirely by yourself.
• Some Canadian users also arrange an equivalent privately, with a lawyer or accountant holding the third key rather than a company.

The question that separates good arrangements from bad ones

Ask it before you sign up, and expect a clear answer in the documentation rather than from a salesperson:

If this company disappears overnight, can I still spend my bitcoin — and do I already have everything I need to do it?

In a properly structured collaborative custody wallet the answer is yes, because your own two keys meet the threshold. But that only holds if you also hold the wallet configuration, which is the same descriptor problem as before. A service that keeps the configuration and never gives you a copy has quietly made itself necessary.

• Confirm you can export the full wallet descriptor, and store it exactly as described earlier — with each of your own backups.
• Confirm you can recover using open-source software rather than only the company's app.
• Rehearse a spend using only your own two keys, before the wallet holds anything serious. This is the whole test.
• Understand the ongoing cost. These are subscription services, and a lapsed subscription should not be able to strand your funds — check what happens if you stop paying.

What you are trading away

• Privacy. The company knows your identity and your balance, and holds records that can be subpoenaed. Self-managed multisig has no such counterparty.
• An ongoing fee, indefinitely, for something you could do yourself at zero recurring cost.
• A dependency you did not have before — smaller than an exchange, but not zero, and it needs re-evaluating if the business changes hands.

Collaborative custody suits people who want the failure tolerance of multisig without becoming the sole operator of it — often those with meaningful amounts, limited time, and a family who would struggle to recover a fully self-managed setup. That is a real category of person and it is not a lesser choice. It is simply a different trade: you are paying a company to reduce the chance that you are the point of failure.