// learn · season 02 · episode 07

Multisig — many keys, one vault

Episode 6 introduced a trade: cold storage reduces online exposure, but backup loss and unsafe approvals remain risks. A 2-of-3 policy can tolerate one unavailable signer while the other two remain able to sign. The vault below uses three real keypairs to demonstrate that policy; it is a browser simulation, not a deployed wallet, and moves no assets.

01 · the vault

Three keys, one rule

A multisig vault is an address with a policy attached: m of n signatures required. Set the rule, propose a payment, and collect signatures. Try executing early — the vault will tell you no.

rule:

any 2 of these 3 can move the funds; no single person can — and signing remains possible if one key is unavailable; replace compromised keys promptly

You

ready

phone + hardware wallet

…

Co-founder

ready

their hardware wallet

…

Lawyer

ready

sealed envelope, offline

…

nothing queued — propose something for the owners to sign

02 · lose a key on purpose

How key loss changes the threshold

Episode 4 used a single key without recovery. With this demo’s 2-of-3 policy, two surviving keys can still sign after one becomes unavailable. Losing another prevents reaching the threshold. A real key loss still calls for investigation and a recovery or replacement procedure; continued access does not mean there is nothing to do.

✓ the vault still works

3 of 3 keys reachable · 2 needed

With 3 keys available and 2 required, the demo can still sign. Losing access to a signer changes the remaining margin for failure.

You

held

phone + hardware wallet

Co-founder

held

their hardware wallet

Lawyer

held

sealed envelope, offline

the dial, again

m-of-n sits between two opposite disasters. 1-of-3 means any single stolen key drains everything. 3-of-3 means any single lost key freezes everything. 2-of-3 is the classic middle: no one key can act alone, and no one key can destroy access. Try each rule above and lose a key to feel the difference.

the inheritance shape

In a 2-of-3 arrangement, any two keyholders can sign together, including while the original owner is still available. That ability must be matched to appropriate legal authority, recovery procedures, and safeguards against collusion. A signing threshold alone does not establish an inheritance plan; involve the relevant professionals.

03 · two flavors

Bitcoin multisig vs Gnosis Safe

The same idea — m of n — implemented in two very different places. One puts the rule in the lock on the coins; the other puts it in a program that holds them.

Bitcoin multisig

script-level

The rule lives in the script that locks the coins (P2SH / P2WSH). The address commits to the script rather than directly revealing the threshold or public keys.

  • — Signatures are collected off-chain: a partially signed transaction (PSBT) is passed from signer to signer, then broadcast once as a single transaction.
  • — Changing the owners or the threshold means creating a new address and moving the funds to it.
  • — No on-chain queue — coordinating who signs next is the wallet software's job, not the chain's.
  • — Compatible hardware wallets from different vendors can reduce dependence on one manufacturer; shared software, backup locations, and procedures can still create common risks.

Gnosis Safe

smart contract · EVM

The vault is a smart contract. Owners and threshold are on-chain state that the contract enforces on every transaction.

  • — Owners and threshold can be changed by transaction — add a signer, raise the threshold — without moving the funds anywhere.
  • — Safe can collect proposals and signatures off-chain through its transaction service. The contract checks the required signatures when the transaction executes on-chain.
  • — Extensible with modules and guards: spending limits, allowances, recovery arrangements, automation.
  • — Executing costs gas, and someone has to pay it — the contract is a program, and programs run on someone's dime.

Reference: Safe Transaction Service documentation.

what they share

Neither is automatically “safer”. The security lives in how many keys, who holds them, and where those keys live — everything you learned in episodes 5 and 6 still applies to each key in the vault. A suitable threshold and independently managed keys can reduce dependence on any one signer. Shared devices, operators, or backups may still create a common point of failure. Keep signer records, recovery procedures, and access arrangements current.

04 · what multisig costs

Nothing is free, including safety

it's visible

On-chain, a multisig vault usually announces itself as one — including how many signers it has. That's a privacy cost, and occasionally a targeting one.

it needs coordination

Every signer needs working tooling, a reachable device, and the willingness to use it — at 2am, on holiday, years from now.

it can be rigid

On Bitcoin, changing who holds keys means moving the funds. On EVM chains it's a transaction — but a transaction someone must pay for and get signed.

Which raises an interesting question. Multisig makes many signatures and shows them to the world. What if you could have many people — and still produce one ordinary signature without reconstructing the complete private key during signing? That's threshold signing, explored in episode 8. How the shares were created remains an important part of the security model.

next up

Episode 08 — MPC: signing without reassembly play now →

Split a secret and explore signing without reassembling the key — the season finale.

Building something that needs this to be right? →