Bitcoin multisig wallet: how it works and how to set one up

A bitcoin multisig wallet is a wallet that can only spend coins when several keys from a predefined set sign, for example any two of three (a 2-of-3 setup). The keys live on different devices in different places, so one stolen or lost key neither gives a thief your coins nor locks you out. The trade-off is a more involved setup, a wallet descriptor you must back up, and somewhat larger transactions.

How bitcoin multisig works

A regular wallet is one private key, or one seed phrase that derives your keys. Whoever holds it can spend. Multisig changes the spending rule: coins sit on an address whose condition reads "M signatures out of N keys." The network enforces that rule itself, with no middleman.

The idea is old. In 2011 Gavin Andresen proposed BIP 11, which made M-of-N transactions built on OP_CHECKMULTISIG standard, with at most three keys at the time. The catch was that the sender had to spell out the full spending conditions. His follow-up, BIP 16 (P2SH), fixed that: the sender pays to a short script hash, and the receiver reveals the conditions only when spending. The new rules apply to blocks timestamped from April 1, 2012. Ever since, a multisig address looks like any other address to the person paying it, and it fits in a QR code.

Today most multisig wallets use SegWit P2WSH addresses (starting with bc1q, longer than single-key ones) or Taproot (bc1p). We cover the formats in Bitcoin address types.

Common setups: 2-of-3, 3-of-5 and others

A setup is written as M-of-N: N is the total number of keys, M is how many signatures a spend needs. N minus M is how many keys you can lose and still recover; M is how many keys a thief has to get.

Unchained, which only offers 2-of-3 itself, compares the two popular quorums: a standard 2-of-3 means securing 6 items (3 devices and 3 backups), while 3-of-5 means 10. Its conclusion is that 2-of-3 strikes the best balance for most people, while 3-of-5 resists attacks better but costs more and is harder to use. Every extra key is one more location to protect and one more trip when you need to sign.

There is a technical ceiling too. Under BIP 383, legacy P2SH fits at most 15 compressed keys, and the SegWit wrapper allows up to 20. For individuals those limits never matter.

What multisig protects against, and what it doesn't

The core benefit is no single point of failure. A standard cold wallet rests on one seed phrase: someone finds the paper and takes everything, or a house fire destroys it and everything is gone. In a 2-of-3 wallet a single found backup is useless and a single lost one is survivable.

Multisig makes sense when: - the amount is large enough that losing it hurts more than an evening of setup; - the money is shared (spouses, partners, a company) and nobody should be able to spend alone; - you are planning inheritance: one key with the owner, one with a relative, one with a lawyer or service, so no one can spend alone but heirs can gather two keys.

It does not protect against everything. The clearest example is the Bybit exchange hack. According to the FBI, on or about February 21, 2025, North Korean hackers (the FBI calls the activity TraderTraitor) stole roughly $1.5 billion in virtual assets from the exchange. The target was an Ethereum multisig cold wallet. The Safe foundation, whose interface Bybit used, traced the breach to a compromised developer machine that proposed a disguised malicious transaction, which the signers then approved. No keys were stolen; the people signing were fooled. The lesson for individual holders: verify the address and amount on the hardware device's own screen, not just in the desktop app.

How to set up a 2-of-3 multisig wallet, step by step

1. Pick a coordinator. This is the software that combines keys into one wallet and builds addresses and transactions. Popular open-source options include Sparrow, Nunchuk and Electrum; collaborative custody services such as Unchained, Casa and Nunchuk hold one of the keys for you.
2. Use hardware wallets from different vendors. Sparrow's best practices recommend at least 2-of-3 for true cold storage and devices from different vendors, so one manufacturer's flaw can't compromise the whole wallet.
3. Generate a seed phrase on each device and back each one up separately. Three phrases, three independent keys.
4. Export the public keys (xpubs) to the coordinator and set the quorum to 2-of-3. The coordinator creates the wallet and shows its descriptor.
5. Back up the descriptor. It is a text string like wsh(sortedmulti(2,…)) containing all three xpubs, derivation paths and the 2-of-3 rule (format defined in BIP 383). Without it, two seed phrases may not be enough to find your addresses. The descriptor can't spend coins, but it reveals your whole balance, so keep a copy with each seed backup rather than in an open cloud folder.
6. Verify the first receive address on every device screen. It must match what the coordinator shows.
7. Run a test cycle: send a small amount, spend it by signing with two devices, and only then move real savings.
8. Store keys in separate places: home, a safe deposit box, a trusted person. Two keys in one drawer turn 2-of-3 back into a single-key wallet.

How much a multisig transaction costs

Multisig transactions are heavier because they carry several signatures plus the script with all the keys. Working from the SegWit weight rules, a regular SegWit (P2WPKH) input weighs about 68 vB, while a 2-of-3 P2WSH input weighs about 104.5 vB, roughly 1.5 times more (Spark's calculator shows the same figures). With Taproot and MuSig the signatures combine into one and the input drops to 57.5 vB, which Mark Erhardt (Murch) estimates is about 45% cheaper than P2WSH.

Here is what that means in practice. As of 1:00 PM ET on November 14, 2026, our mempool.space data showed a fast Bitcoin network fee of 2 sat/vB, with BTC trading near $65,892 (live numbers are in All Bitcoin numbers). At that rate one 2-of-3 input costs about 209 sats (≈$0.14) versus 136 sats (≈$0.09) for a regular wallet, a trivial gap. At a congested 100 sat/vB, the same input costs 10,450 sats versus 6,800, roughly $6.9 versus $4.5 at the same price. That is why multisig works best when you deposit in larger chunks and spend rarely. See our guide to mempool fees for how fees move.

Common mistakes

• Not backing up the descriptor. The costliest mistake: you have two seed phrases but no record of which addresses they control. With all three seeds, recovery is easier, but don't count on it.
• All keys in one place. A fire, raid or burglary takes two keys at once.
• All devices from one vendor. One firmware bug becomes a bug in your whole wallet.
• A phone key for serious money. Unchained's comparison calls this an unacceptable compromise for a material share of wealth.
• Blind signing. As Bybit showed, check the recipient and amount on the device screen.
• Over-engineering. A 4-of-7 with keys in three countries sounds robust until you need to send funds quickly.

Limitations

Multisig is a savings tool, not a spending wallet: each transaction needs several devices and sometimes several people. Heirs need clear written instructions, or they won't be able to assemble two keys and the descriptor. Collaborative custody is convenient, but you rely on the provider during recovery and usually pass identity checks. Finally, multisig doesn't stop coercion: if someone can force you to unlock two keys, the setup won't help.

FAQ

Does a beginner need multisig? Usually not. Start with one hardware wallet and a solid seed phrase backup, and revisit multisig once the amount matters to your finances.

Can I build multisig from one seed phrase? No. All keys would sit in one phrase, which defeats the purpose. Each key needs its own seed.

What if my collaborative custody provider shuts down? In a 2-of-3 where you hold two keys, you can spend without the provider using your two seeds and the descriptor.

Can people see on-chain that I use multisig? With P2SH and P2WSH, yes, once you spend the script is revealed. With Taproot and MuSig a spend looks like a single-signature one, according to Bitcoin Optech. Track the coin itself on our Bitcoin page.

This is not investment advice.