Multisig wallets explained

Designing a two-of-three

Two-of-three is the arrangement that suits almost everyone, and the design decisions are about where the keys live rather than about the cryptography.

Key one: at home. Your primary signing device, the one you actually use. Kept where you can reach it.

Key two: offsite. A different building — a family member's house, a private vault, a workplace safe. This is the key that survives a house fire or a burglary. Most New Zealand banks have exited the safe deposit business, with New Zealand Vault having taken over the ANZ, BNZ and National Bank operations and Westpac still offering boxes, so a fireproof safe at a sibling's place is a perfectly reasonable answer.

Key three: with a third party. A solicitor holding it with your will, or a trusted person who knows what it is and does not know where the other two are. This is the inheritance key. They cannot spend alone, which is precisely why giving it to them is safe.

Use three different manufacturers. This is the part people skip and it matters. If all three keys sit on devices from the same maker, a firmware flaw or a supply-chain compromise affecting that maker could in principle reach all three. A Coldcard plus a Trezor plus a Keystone means an attacker has to defeat three different architectures with three different failure characteristics. This is exactly why we said, on our Ledger versus Trezor page, that the answer for multisig is "one of each".

Building it: devices and software

The coordination happens on a desktop, and there is a clear best tool.

Sparrow Wallet is what we would use for Bitcoin multisig. Free, open source, supports multiple hardware wallet brands as co-signers, connects to your own full node if you run one, and its multisig construction and descriptor handling are the most capable available to a private individual. It is a serious piece of software with a learning curve to match, and it is worth the afternoon. See our desktop wallets page.

On the device side, Coldcard has the strongest multisig support — it can verify the multisig configuration on the device itself, which closes an attack where a compromised computer presents a wallet with an extra key you do not control. Keystone and Blockstream Jade both work well as co-signers, and Jade is available domestically through The Bitcoin Shop in Tauranga.

Budget roughly NZ$700 to NZ$900 for three devices, more if you want a Coldcard Q at US$239 in the mix. That is a real cost, and against a holding large enough to justify multisig it is a rounding error.

Test everything before funding. Build the wallet, back up all three phrases and the descriptor, then reconstruct the whole wallet from scratch using two of the three keys plus the descriptor, on a fresh install. Only when that works does money go in. Then send a small test amount and spend it back out, so you have proven the signing flow end to end. This is more testing than a single-key wallet needs, and the reason is the next section.

The descriptor, and the mistake people make

This is the failure mode unique to multisig and it catches people who did everything else right.

A multisig wallet is not defined by its keys alone. It is defined by a descriptor: a record of which public keys form the wallet, in what order, with what threshold and what derivation paths. To reconstruct the wallet you need two of the three private keys and the descriptor. Without the descriptor, you can hold two valid keys and still be unable to rebuild the wallet or spend from it.

The good news is that a descriptor contains no secrets — it is public information — so backing it up is easy and you can be liberal about it. Print it. Store a copy with each of the three key backups. Put it in your inventory document. Give a copy to your solicitor alongside the third key. There is no downside to redundancy here.

The bad news is that people forget, because a descriptor does not feel like a secret and therefore does not feel important. It is the single most likely reason a well-built multisig fails, and it is entirely preventable with a printer.

Multisig and inheritance

This is where multisig earns its keep for people whose holdings are not enormous, and it deserves emphasis because inheritance destroys more crypto than theft does.

The single-key approach to inheritance is a sealed envelope with your recovery phrase, held with your will. It works, and it has an obvious flaw: whoever holds that envelope has complete unilateral control from the moment they open it, and you are relying entirely on them not opening it early.

With two-of-three, your executor or a family member holds one key. They can do nothing with it alone. On your death, they combine it with a second key — held offsite, identified in your instructions — and the funds become accessible. No single person ever has unilateral control while you are alive, and no single loss breaks the arrangement.

Whatever structure you choose, leave a written explanation rather than only the material. A page describing what exists, roughly what it is worth, where each key and backup is, what the descriptor is for, and the practical steps — written for someone who does not know what a seed phrase is. Twenty-four words and a plastic device mean nothing to a non-technical beneficiary. Our backup guide covers the wording.

The honest downsides

Four, and you should weigh them properly rather than treat multisig as a free upgrade.

Complexity is a risk in itself. More moving parts means more ways to misconfigure something. The descriptor problem above is the clearest example, and there are others — wrong derivation paths, keys added in a different order, software that handles descriptors differently.

Spending is slower. Every transaction needs two devices, which if one lives offsite means a trip. That is by design and it is fine for savings; it is unworkable for anything you touch often.

Software support is narrower. Bitcoin multisig is well supported. Multisig on other chains varies considerably, and if you hold a broad portfolio you may find that only part of it can live in this arrangement.

Higher on-chain fees. Multisig transactions are larger, so they cost more to broadcast. Marginal, but real on Bitcoin during congestion — see our fees guide.