How multisigs work
Ethereum multisigs are smart contracts; Bitcoin multisigs are native scripts. Both enforce the M-of-N rule:
- N signer addresses are designated at setup.
- A threshold M is set (e.g. 2 of 3, 3 of 5).
- To spend from the multisig, a transaction is proposed; any signer can propose.
- M signers approve by signing.
- Once the threshold is met, the transaction executes.
On Safe (Ethereum), the interface is familiar: visit app.safe.global, see pending transactions, click to sign, and when enough signers have approved, the transaction auto-executes.
Common multisig configurations
- 2-of-3 — three hardware wallets held by different trusted parties. Two must agree. Used by small teams, DAOs, and individuals who want redundancy.
- 3-of-5 — more resilience; any two keys can be lost without losing access.
- Geographic distribution — each key in a different country or jurisdiction. Protects against single-location disasters or coercion.
- Keys-on-different-devices — distributes across Ledger + Trezor + smart-phone + cold backup. Protects against single-vendor vulnerabilities.
Institutions use higher thresholds (5-of-7, 7-of-10) combined with air-gapped signing ceremonies. Fireblocks, Copper, and BitGo productize this for enterprise.
Use cases
- DAO treasuries — every major DeFi protocol’s treasury is held in a multisig. The Uniswap Foundation, Aave DAO, and MakerDAO all manage hundreds of millions through Safe.
- Team funds — startup treasuries, investor funds, grant programs.
- Personal high-value custody — single individuals use 2-of-3 or 3-of-5 multisigs split across multiple hardware wallets for significant balances.
- Exchange cold storage — many major exchanges use multisig for cold vaults with operational procedures for signing.
Risks and considerations
- Coordination failure — getting 3 signers available to sign quickly can be hard during emergencies. Plan for key-holder unavailability.
- Smart-contract bugs — Safe has had audits, bug bounty programs, and zero major exploits; earlier multisig implementations have not been so lucky. The Parity multisig hack (2017) locked $150M permanently via an init bug.
- Key-holder turnover — when a signer leaves the team or can’t participate, the multisig must be updated. Requires signers to sign a transaction modifying the signer set.
- Compromised signer — if one signer is compromised, remove them promptly. An M-of-N multisig is only as secure as the ability to remove a compromised key before it accumulates enough other compromises.
- UX complexity — multisigs add friction to every transaction. For active DeFi use, some teams maintain a smaller “hot” multisig for ops and a larger “cold” multisig for reserves.
For most individuals, a single hardware wallet is sufficient — multisig adds operational complexity that isn’t always worth it. The threshold where multisig becomes necessary is roughly: balances that another party would actively attempt to steal if they knew about them, or situations where a single lost key would be unacceptable.