Multisig
Wallet requiring multiple signatures to authorize actions.
A multisig, or multi-signature wallet, requires approvals from several cryptographic keys before executing an action. A threshold such as two-of-three means any two authorized signers can approve. Multisigs reduce reliance on one key and are widely used for protocol administration, DAO treasuries, businesses, and shared custody.
On smart contract networks, multisig logic is commonly implemented in a contract wallet. Signers approve a structured transaction, and the wallet executes after reaching threshold. Other blockchains may support multisignature rules directly. Contract-based systems add deployment, upgrade, module, and interface considerations beyond the individual signer keys.
Multisigs matter because a stolen or lost key no longer creates automatic total loss. They also enforce separation between transaction preparation and authorization. Public on-chain approvals can improve auditability. A multisig does not eliminate insider risk, since enough signers can still collude or approve a misleading request.
Signer independence is essential. Keys should use separate hardware devices, backups, people, and where appropriate, organizations and locations. Every signer needs to verify destination, amount, network, contract call, and simulation rather than trusting the proposer. Blindly approving defeats the control.
Threshold design balances security and availability. Too low leaves weak protection; too high creates lockout when people are unavailable. Teams need signer replacement, emergency response, succession, transaction limits, and communication procedures. Modules or guards that automate actions must receive the same security review as the wallet.
Before funding, verify the multisig contract, chain, signers, threshold, owners, modules, fallback handlers, and upgrade behavior. Monitor changes and test recovery with low value. Do not store all seed phrases together. A multisig is an authorization framework, not a complete governance process. Its security comes from independent keys, careful human review, clear policy, and tested ability to replace unavailable signers without granting one party hidden control.
Teams should rehearse routine and emergency transactions, including a signer loss, hardware failure, and malicious proposal. Every approval needs a human-readable description and independent simulation. Transaction proposers should not be the only reviewers. Alerts should cover signer, threshold, module, and guard changes as well as asset movement. Periodic owner confirmation prevents an outdated employee or inaccessible wallet from remaining unnoticed until urgent action is required.
Frequently asked questions
- A multisig removes one private key as the sole point of control by requiring a threshold of independent signers. It suits treasuries, contract administration, custody, and shared accounts. The benefit depends on genuine separation. Several keys held by one person, stored together, or signed through the same compromised device do not provide meaningful resilience.
- Choose enough signers and approvals to survive expected loss or absence while preventing one person or small subgroup from acting alone. Two-of-three and three-of-five are common, not universal defaults. Consider geography, organizations, time zones, transaction urgency, legal authority, and replacement. Higher thresholds strengthen collusion resistance but increase delay and lockout risk during emergencies.
- Verify the person's role and signing address through separate trusted channels, require a hardware wallet, explain transaction review and incident duties, then test a low-value action. Update policy, contacts, backups, and monitoring. Changing signer sets is a privileged transaction requiring the old threshold. Remove departing signers promptly and confirm every supported chain or wallet separately.