A multisig wallet, short for multi-signature wallet, is a crypto wallet controlled by several private keys, where a set number of those keys must sign before any funds can move. The rule is written as M-of-N: a 2-of-3 wallet has three keys, and any two of them can approve a payment.
A standard wallet has one key, so a single lost or stolen recovery phrase decides the fate of everything in it. Multisig spreads that decision across people, devices, or locations. A 2-of-3 wallet keeps working if one key is lost and stays safe if one key is stolen.
In the Bitcoin.com Wallet, this feature is called a shared wallet. Multisig also protected the exchange wallet drained of about $1.5 billion in February 2025, in a theft carried out by deceiving every signer at once.
Create a shared Bitcoin or Bitcoin Cash wallet in the self-custodial Bitcoin.com Wallet app.
Key Takeaways
- A multisig wallet has several private keys and a threshold. Funds move only when enough keys sign to meet it.
- Participants do not share one public key. Each holds their own key pair, and the wallet address is derived from a script that combines every participant's public key with the threshold.
- In any M-of-N setup, you can lose N minus M keys and still spend, and an attacker needs M keys to steal. A 1-of-2 wallet adds redundancy but no protection against theft, and a 6-of-6 wallet makes losing access more likely.
- Bitcoin supports multisig natively in its scripting language, while Ethereum multisig runs as a smart contract. The two carry different costs and risks.
- Backing up a multisig wallet takes more than each participant's recovery phrase. Rebuilding one independently requires enough private keys to meet the threshold plus every participant's public key or the wallet's full setup.
- Multisig removes single points of failure only if signers check transactions independently. In the February 2025 Bybit theft, every signer approved a falsified transaction shown on the same compromised web interface.
- Multisig and MPC wallets both spread control, but multisig enforces its rules on the blockchain, while MPC works off-chain and produces a single ordinary signature.
- The Bitcoin.com Wallet supports shared wallets for Bitcoin (BTC) and Bitcoin Cash (BCH), with two to six participants and one to six required approvals.
What Is a Multisig Wallet?
Every crypto wallet comes down to private keys, the secret numbers that sign transactions. A standard wallet has one, and whoever holds it controls the funds. A multisig wallet has several, held by different people or kept in different places, along with a fixed rule about how many must sign.
That rule is the threshold, written as M-of-N, where N is the total number of keys and M is the number needed to approve a transaction. Some common examples:
- 1-of-2: two keys, either one can spend alone.
- 2-of-2: two keys, both must sign.
- 2-of-3: three keys, any two can spend.
- 3-of-5: five keys, any three can spend.
The participants are often called cosigners. A transaction starts as a proposal from one cosigner and becomes valid once enough others have added their signatures. Until the threshold is met, nothing reaches the blockchain and the funds stay where they are.
Multisig is a form of self-custody. Each participant holds their own key, and nobody outside the group can move the funds. Arrangements where a service holds one of the keys, sometimes called collaborative custody, stay non-custodial as long as the keys you hold can meet the threshold without the service.
How Multisig Works on Bitcoin
Bitcoin has supported multisig since its early years through its built-in scripting language. Every bitcoin is locked by a small program, called a script, that states what must be provided to spend it. For a standard wallet, that means one valid signature from one key. For a multisig wallet, the script lists several public keys and the number of valid signatures required.
The address follows from that script. When a shared wallet is created, every participant generates their own key pair. The wallet software then combines all of the participants' public keys and the threshold into a single script, and derives the wallet's address from a hash of it. Every participant sees and shares the same address, but the public keys are never merged into one. Each participant's key stays separate, which is what lets each of them sign independently. The relationship between public keys and addresses works the same way for single-key wallets, with one key in place of several.
Bitcoin multisig has used three main address types over time:
| Address type | Introduced | Address starts with | What happens on chain when you spend |
|---|---|---|---|
| P2SH | 2012, through BIP-16 | 3 | The full script, including every public key and the threshold, is revealed |
| P2WSH (native SegWit) | 2017 | bc1q, with a longer address than single-key wallets | The full script is revealed, at a lower fee than P2SH |
| P2TR (Taproot) | November 2021 | bc1p | Depending on the setup, a spend can look identical to a single-key payment |
Collecting signatures from several devices or people needs a way to pass an unfinished transaction between them. Bitcoin standardized this as the Partially Signed Bitcoin Transaction format, or PSBT, in BIP-174, so that different wallets and hardware devices can each add a signature to the same transaction. Consumer apps hide this step. In the Bitcoin.com Wallet, it appears as a transaction request that other participants approve or decline.
Taproot added a further option. Under MuSig2, defined in BIP-327, several participants can combine their keys into one aggregate key and produce one signature together, so a multisig spend looks on chain like an ordinary single-key payment. The privacy and fee benefits of that approach are part of what Taproot was designed to deliver.
Multisig on Bitcoin vs Ethereum
The word multisig describes the same idea on both networks, and very different machinery.
| Bitcoin multisig | Ethereum multisig | |
|---|---|---|
| How it works | Native script, built into the protocol | A smart contract deployed to the network |
| Most common implementation | Built into many Bitcoin wallets | Safe (formerly Gnosis Safe) |
| Setup cost | None until funds are sent | Gas fee to deploy the contract |
| Can the rules change after setup? | No. A new wallet is needed | Yes, if the owners approve a change to the contract |
| Main risks | Key handling and wallet software | Key handling, contract logic, and the web interface used to sign |
| Signing | Wallet software or hardware devices sign a PSBT | Owners sign through a web or app interface |
The ability to change an Ethereum multisig contract adds flexibility and a new attack surface. In the Bybit theft described below, the signers approved what they believed was a routine transfer and in fact authorized a change to the wallet's contract logic that handed control to the attacker.
Choosing an M-of-N Setup
Every configuration trades two risks against each other: losing access and having funds stolen. In an M-of-N wallet, you can lose up to N minus M keys and still spend, and a thief needs M keys to take anything.
| Setup | Keys you can lose and still spend | Keys a thief needs | Typical use |
|---|---|---|---|
| 1-of-2 | 1 | 1 | Shared access between partners, emergency access for a family member |
| 2-of-2 | 0 | 2 | Two devices you own, or two business partners who must both agree |
| 2-of-3 | 1 | 2 | Personal savings across locations, escrow, inheritance planning |
| 3-of-5 | 2 | 3 | Business treasuries and boards |
| 4-of-6 | 2 | 4 | Larger groups that need majority approval |
| 6-of-6 | 0 | 6 | Rarely sensible for funds anyone needs to reach |
1-of-N adds redundancy without adding protection against theft. Any single key can spend, so a 1-of-2 wallet is twice as exposed to theft as a single-key wallet. It is a good fit for giving a partner or family member access. It does not protect against a stolen phrase.
N-of-N makes loss more likely. A 6-of-6 wallet looks like the most secure option, but if any one of the six keys is lost, the funds can never move again. Each added key that must sign is another single point of failure.
For most individuals securing their own savings, 2-of-3 is the standard choice. It survives one lost key and one stolen key, which no single-key wallet can do. Keeping the three keys in three separate places, so that a fire, a burglary, or a lost bag affects at most one, is what makes it work in practice.
Where Multisig Protects You and Where It Fails
| Threat | Does multisig help? | Why |
|---|---|---|
| One recovery phrase is stolen | Yes, if M is 2 or more | A thief with one key cannot meet the threshold |
| One device or backup is destroyed | Yes, if N minus M is 1 or more | The remaining keys can still spend |
| One signer acts dishonestly | Yes | One person cannot move funds alone |
| Malware on a single signer's device | Partly | It can capture one key, but not enough to meet the threshold |
| All signers use the same compromised interface | No | Every signer can be shown the same false transaction |
| Phishing aimed at the whole group | No | Enough signers can each be tricked separately |
| Losing more keys than the setup allows | No | The funds are permanently locked |
| Sending to the wrong address | No | A valid transaction is valid however many people approved it |
On February 21, 2025, in the largest crypto theft on record, attackers took about $1.5 billion from the exchange Bybit's Ethereum cold wallet, a multisig wallet run through Safe. According to Sygnia's forensic investigation, the attackers had compromised a Safe developer's computer earlier that month and used it to plant malicious code in the web interface Bybit's signers used. When the signers opened what looked like a routine transfer, their screens showed the expected details, while the data sent to their hardware signing devices did something else entirely. Enough signers approved it to meet the threshold. The FBI attributed the theft to North Korean hackers.
The multisig contract itself worked exactly as designed. What failed was the assumption that several signers meant several independent checks. All of them trusted the same screen, so a single compromised interface defeated every signature at once.
The defenses follow from that:
- Verify on the signing device. Read the destination and amount on a hardware wallet's own screen, and refuse to approve anything a device cannot display in readable form, a practice known as blind signing.
- Diversify the signers' setups. Different devices, different software, and different networks make a single compromise far less likely to reach everyone.
- Confirm unusual transactions out of band. A phone call between cosigners before approving a large or unexpected payment costs nothing and catches a great deal.
- Treat requests to approve with the same suspicion as any request for funds. The patterns used in crypto fraud apply to cosigners as much as to individuals.
How to Back Up a Multisig Wallet
A single-key wallet can be restored from one recovery phrase. A multisig wallet is built from several parts, and a backup has to account for all of them.
| Part of the wallet | What it does | Who needs to back it up |
|---|---|---|
| Each participant's recovery phrase | Restores that participant's private key | Every participant, separately |
| Every participant's public key | Needed to rebuild the script and find the address | Ideally every participant |
| The setup | The threshold, number of participants, address type, and asset | Every participant |
| The wallet software and coordination details | Some apps store the setup on a server that passes requests between participants | Every participant should note which app and version they used |
The second row is the one most people miss. To rebuild a multisig wallet independently of any particular app, you need enough private keys to meet the threshold plus the public keys of every participant, including those who will not sign. Without the full set, the software cannot reconstruct the script, cannot calculate the address, and cannot find the funds. Bitcoin Core's multisig documentation builds wallets this way, from a combined record of every participant's public key known as an output script descriptor. Where a wallet app can export that descriptor, keeping a copy with each participant's backup closes the gap.
Many shared-wallet apps use a coordination server to pass transaction requests between participants and to keep track of the wallet's setup. While that service is available, re-entering your own recovery phrase usually returns you to your place in the wallet. How a given app handles recovery if its service is ever unavailable varies, so ask each app what you would need in that case and write the answer down with your backup.
In practice, each participant should keep:
- Their own recovery phrase, written down offline and stored the way any phrase should be.
- A note of the setup: the threshold, the number of participants, the asset, and the app used.
- A copy of the wallet descriptor or every participant's public key, where the app provides one.
- Contact details for enough other participants to meet the threshold.
Backing Up a Shared Wallet in the Bitcoin.com Wallet
Shared wallets in the Bitcoin.com Wallet need a manual backup of each participant's recovery phrase. Each participant can view theirs in one of two ways:
- From the home screen, open the shared wallet, tap the menu button in the top right, and select Show my recovery phrase.
- Or open Settings, select Backup & security, then Manual backup, and choose the shared wallet.
To restore, open ADD/IMPORT, select Import wallet, choose the asset type, set the wallet type to Shared Wallet, and enter the 12-word recovery phrase. Once restored, confirm with the other participants that each of them still has access to their own backup.
Multisig vs MPC
Multisig and multi-party computation (MPC) wallets both spread control of funds across several parties. They do it at different layers.
| Multisig | MPC | |
|---|---|---|
| Where the rules live | On the blockchain, in a script or smart contract | Off-chain, in the signing protocol |
| What appears on chain | Several signatures, unless keys are aggregated with MuSig2 | One ordinary signature |
| Visible as a shared wallet? | Usually, once funds are spent | No |
| Chain support | Depends on the network's scripting or contract support | Works on any chain that uses standard signatures |
| Changing participants | Usually requires a new wallet and moving the funds | Key shares can often be refreshed without moving funds |
| Transaction fees | Higher for older script types | The same as a single-key wallet |
| Independent verification | Anyone can check the threshold on chain | Depends on the provider's implementation |
| Track record | Used on Bitcoin since 2012 | Newer, and varies by implementation |
Multisig's rules are public and enforced by the network itself, which makes them auditable by anyone. MPC keeps the arrangement private and cheaper on chain, at the cost of relying on more complex cryptography that differs from one provider to the next. How MPC wallets split and recombine key shares, and who holds those shares, decides whether a given MPC wallet is truly self-custodial.
Multisig vs a Single Hardware Wallet
For an individual holding their own savings, the realistic choice is often between one well-protected hardware wallet and a multisig setup.
| Single hardware wallet | 2-of-3 multisig | |
|---|---|---|
| If one backup is stolen | Total loss | No loss |
| If one backup is destroyed | Total loss without a second copy | No loss |
| Setup | One device, one phrase | Three keys, three locations, plus the wallet setup |
| Everyday spending | Simple | Requires two devices or two people |
| Fees | Standard | Higher on older script types |
| Room for user error | Low | Higher |
| Inheritance | An heir needs the one phrase | Can be designed so an heir or trusted party holds one key |
A single hardware wallet with a tested backup is simpler and leaves less room for mistakes, which makes it the better choice for many people. Multisig earns its added complexity once the amount at stake would be serious to lose, or when more than one person needs a say. Either one can serve as cold storage for long-term holdings.
Common Uses for Shared Wallets
| Use | Typical setup | How it helps |
|---|---|---|
| Emergency and inheritance access | 1-of-2 or 2-of-3 | A trusted person can reach the funds if you are incapacitated or after your death |
| Couples with shared finances | 1-of-2 | Both partners have equal access and see every transaction |
| Personal security across locations | 2-of-3 | One key at home, one in a safe deposit box, one with a trusted person |
| Children's savings | 2-of-3 | A parent approves every transaction while the child learns to manage money |
| Introducing family to crypto | 1-of-2 | You keep access if they lose their key, without restricting their spending |
| Business treasury | 2-of-3 or 3-of-5 | No single employee or founder can move company funds |
| Group savings and club funds | 3-of-5 or 4-of-6 | A majority must agree before anyone spends the pot |
| Charity pool | 3-of-5 | Donors see exactly how pooled funds are spent |
| Escrow | 2-of-3 with an agreed third party | Buyer and seller release payment together, and the third party decides disputes |
| Prize pots and challenges | A majority setup | The group verifies the winner before payout |
Costs, Privacy, and Limitations
- Fees: Older multisig transactions carry several signatures and a longer script, which makes them larger and more expensive than single-key payments. Taproot setups can bring that cost down.
- Privacy: On P2SH and P2WSH, spending reveals the full script, so anyone looking at the blockchain can see that the wallet is multisig, how many keys it has, and the threshold.
- No changes after setup: A Bitcoin multisig wallet's participants and threshold are fixed. Replacing a participant means creating a new wallet and moving the funds into it.
- Coordination: Every payment needs enough cosigners to be available. A 3-of-5 treasury cannot pay a bill while three signers are traveling.
- Compatibility: Not every wallet supports multisig, and the Bitcoin.com Wallet supports shared wallets for Bitcoin and Bitcoin Cash only.
- Complexity. More keys, more backups, and more people create more chances for mistakes. Each participant needs to understand their part.
How to Set Up a Shared Wallet in the Bitcoin.com Wallet
Create the wallet
- Install the Bitcoin.com Wallet app and open it.
- Tap ADD/IMPORT, then select Add new shared wallet.
- Choose the asset type, Bitcoin (BTC) or Bitcoin Cash (BCH).
- Set the number of participants, from two to six, and the number of approvals required, from one to six.
- Name the wallet and enter the name other participants will see for you.
- Tap continue.
Invite participants
- Share the wallet's QR code for others to scan, or tap SHARE to send them a link.
Join a shared wallet
- Scan the QR code from the home screen's scan button, or open the link you were sent.
- Enter the name other participants will see, then tap JOIN.
Once everyone has joined, the app shows a single receiving address to all participants. Each participant should back up their recovery phrase immediately, before the wallet receives any funds.
Send from a shared wallet
- Open the shared wallet, tap send, and enter the payment details. This creates a transaction request, and the other participants are notified.
- Other participants open Requests, select the pending request, and approve or decline it.
- Once enough approvals are in, the app broadcasts the transaction automatically.
While a request is pending, the funds involved are locked and the wallet may show a zero balance. The participant who created a pending request can cancel it from Requests, which unlocks the funds.
Conclusion
A multisig wallet replaces the single key behind a standard wallet with several, and a threshold that decides how many must agree. Set up well, with a threshold such as 2-of-3 and keys kept in separate places, it survives a lost key and a stolen key, which no single-key wallet can do. It also lets families, partners, and businesses share control without handing any one person the ability to move funds alone.
Its protection depends on two things that are easy to overlook. A backup must cover the full setup of the wallet, including every participant's public key, and each signer must verify what they approve on a device they trust. The Bybit theft showed what happens when several signatures rest on one shared point of trust. For people with substantial holdings or shared responsibilities, multisig is one of the strongest forms of self-custody available, provided its added complexity is handled with the same care as the keys themselves.
