What is a multisig wallet? How crypto’s biggest treasuries get secured, and robbed

Multisignature wallets guard most of the serious money in crypto: DAO treasuries, exchange cold storage, protocol funds, and the savings of the security-conscious. They are also at the center of the industry’s biggest heists, from Bybit’s $1.5 billion to this year’s UXLINK breach, because attackers stopped picking locks and started fooling the people holding the keys. This guide explains how multisig actually works, the M-of-N design choices, how the famous multisig hacks really happened, and how to run one without becoming a case study.

Ask where crypto’s serious money lives, and the answer, overwhelmingly, is behind multiple signatures. A majority of institutional custodians run multisignature arrangements; DAO treasuries holding billions coordinate through them; exchanges guard cold storage with them; custody chains behind institutional products depend on them; and protocols park their upgrade keys and reserve funds inside them, most commonly in Safe, the contract system formerly known as Gnosis Safe, which alone secures values rivaling large banks. The idea is old, borrowed from bank vaults and nuclear launch protocols: no single person, key, or machine should be able to move what matters. Require M signatures out of N keys, 2-of-3, 3-of-5, and a thief must compromise several independent guardians instead of one.

And yet the largest theft in crypto’s history, Bybit’s $1.5 billion, walked out through a multisig. So did this year’s $11.3 million UXLINK breach, and the Ronin bridge’s $600 million before them. The pattern is the most instructive fact in modern crypto security: the multisig math has never been broken; the humans and interfaces around it are broken constantly. Multisig eliminates the single point of failure and replaces it with a subtler question, whether your several points of failure are actually independent, and the industry’s disaster record is a catalog of discovering they were not.

This guide covers the mechanism and its failure modes with equal seriousness: how multisignature schemes actually work on Bitcoin and on smart-contract chains, how to choose M and N and what each choice trades, the anatomy of the great multisig heists and the blind-signing problem at their core, multisig against its modern rivals, MPC and smart accounts, and the operational playbook that separates the treasuries that survive from the ones that headline.

The mechanism: M-of-N, on two architectures

A multisig wallet requires a threshold of signatures, M, from a set of authorized keys, N, before any transaction executes. A 2-of-3 personal setup might split keys across a hardware wallet at home, a second device in a bank box, and a trusted relative; a 4-of-7 DAO treasury spreads keys across council members on different continents. The threshold is the design’s dial: security against compromise rises with M, resilience against key loss rises with the gap between N and M, and operational friction rises with both.

Under the hood, two architectures implement the idea. On Bitcoin, multisig is native to the protocol’s scripting: an address encodes the M-of-N requirement itself, and spending requires the signatures to be presented and verified by the network. It is minimal, battle-tested, and rigid, changing signers means moving funds to a new address. On Ethereum and similar chains, multisig lives in smart contracts: a program, such as a Safe, holds the funds and enforces the policy, collecting signatures until the threshold is met and then executing. The contract approach is vastly more flexible, signers can be rotated, thresholds changed, daily limits and timelocks and module extensions added, and that flexibility is double-edged: the policy is code, code can have flaws, and, as the disaster section will show, the richness of what a contract wallet can execute is exactly what modern attackers exploit.

The transaction flow in both worlds follows the same rhythm. Someone proposes a transaction, recipient, amount, and, on contract wallets, arbitrary program calls. The proposal circulates to signers, each of whom reviews and cryptographically approves it with their own key, on their own device. When approvals reach the threshold, the transaction becomes executable and is broadcast. Every step is auditable: the chain records exactly which keys approved what, creating the accountability trail that makes multisig the governance tool of choice for DAO treasuries whose control is otherwise contested through token votes, for corporate funds requiring officer sign-off, and for escrow arrangements where a neutral third key arbitrates disputes, the human-governed cousin of the time-locked contracts that automate escrow on-chain.

Choosing M and N: the design space

The threshold choice is a risk allocation, and the standard configurations each answer a different question. 2-of-2 is a partnership with no tiebreaker and no recovery, one lost key strands the funds, and is mostly used with one key held by a service. 2-of-3 is the individual’s workhorse: it survives the loss of any one key, resists the compromise of any one key, and keeps signing friction tolerable; the classic personal build spreads three hardware keys across locations, and the classic collaborative-custody build gives one key to a professional service that can co-sign recovery but can never move funds alone. 3-of-5 and up is institutional territory, tolerating multiple losses and requiring multiple corruptions, at the price of coordination overhead that, in practice, tempts organizations into the worst sin of the genre: concentration, several keys held by one person, one office, one laptop, or one cloud account. A 3-of-5 whose keys live in three browsers and two drawers of the same office is a 1-of-1 with extra steps, and post-mortems of real losses find this shape constantly. The rule the design space reduces to: the security of a multisig is the security of its most correlated keys, and independence, of people, devices, software, and geography, is the entire point of the exercise.

Key-holder policy matters as much as the numbers. Every signer is a target the moment the arrangement is visible on-chain, and large treasuries are visible by definition, tracked by the same wallet-attribution lens that maps every whale. Serious operations therefore treat signers as an attack surface: hardware keys only, dedicated signing devices, no signer identities published unnecessarily, and procedures rehearsed before they are needed, because the day a treasury must move funds under pressure is the worst day to discover the third signer’s key is in a safe nobody can open.

How multisigs actually get robbed

The heist record is where this subject earns its place in a security curriculum, because the attacks share an anatomy and it is not the one intuition expects. No major multisig loss has come from breaking the cryptography. They come from making the right people sign the wrong thing.

The Bybit theft, $1.5 billion, the largest in industry history, is the canonical case. The exchange’s cold storage sat behind a multisig with executives as signers, exactly as best practice prescribes. Attackers, attributed to North Korea’s Lazarus Group, compromised the infrastructure of the wallet interface the signers used, so that when the executives performed a routine, scheduled transfer, their screens showed the legitimate transaction while their hardware keys signed a different payload, one that handed the attackers control of the wallet’s logic. Every signature was genuine. Every signer was diligent by the standard of what they could see. The vault held; the vault’s window lied. The Ronin bridge before it fell differently but rhymes: a 5-of-9 arrangement whose keys were insufficiently independent, with one organization controlling enough of them that compromising it, via a social-engineered employee, crossed the threshold, the key-compromise pattern behind the largest bridge disasters. And this year’s UXLINK breach showed the small-scale version: attackers who gain threshold control do not just drain, they use the wallet’s own administrative powers, adding themselves as signers, ejecting the owners, because on a contract multisig, governance of the wallet is itself just another transaction.

The common thread is blind signing. A hardware key protects the signature; it does not tell the signer, in honest human terms, what they are signing, and complex contract-wallet payloads are unreadable hashes on a tiny screen. Attackers therefore aim at the layer between intention and signature: the web interface, the signer’s laptop, the proposal pipeline, the human’s routine. The defenses that address this are specific and increasingly standard: independent verification of every payload on a second channel before signing, signing devices that decode and display transaction meaning, simulation tools that preview a transaction’s actual effects, timelocks that delay large movements long enough for review, and the simple institutional rule that no transaction is routine, because routine is precisely the state of mind the Bybit attackers were waiting for.

From Bitcoin script to Safe: how the standard was built

Multisig’s history is the history of crypto custody growing up, and its milestones explain today’s defaults. The capability is nearly as old as Bitcoin itself, formalized in the protocol’s early years through pay-to-script-hash addresses that let spending conditions, including M-of-N signature requirements, be encoded on-chain. The first institutional era was built directly on it: the early exchange and custody pioneers ran Bitcoin multisig vaults, and the first collaborative-custody businesses sold 2-of-3 arrangements to individuals a decade ago. The idea crossed to Ethereum as smart-contract wallets, where the flexibility of code produced both the triumphs and the scars: an infamous 2017 library bug in a widely used contract wallet froze hundreds of millions permanently, the formative lesson that flexible custody code is itself an attack surface, and the survivor of that era’s consolidation, Gnosis Safe, hardened through years of audits and adversarial value into the default it is now.

Today Safe-style contracts secure treasuries whose combined value rivals major banks, the DAO era having made the multisig council crypto’s standard governance executive, and Bitcoin’s own multisig lineage continues in parallel, favored for deep cold storage precisely because its rigid, minimal script surface offers so little to exploit.

The standardization has a consequence worth naming: concentration of a different kind. When one contract system secures the majority of on-chain treasuries, its code, its interface, and its upgrade process become systemic infrastructure, and the Bybit attack’s compromise of interface infrastructure was, among other things, a demonstration that the ecosystem’s eggs share more baskets than the M-of-N math suggests. The response, interface diversity, independent transaction verification services, signing-device decoding, is effectively the community rebuilding independence one layer up the stack, the same principle the wallets encode, applied to the tooling around them.

Setting one up: the individual’s path

For an individual reader, the practical on-ramp deserves concreteness. A personal 2-of-3 today is a weekend project: three hardware keys, ideally from two different vendors to avoid a shared firmware flaw; a contract wallet on an inexpensive network or a native Bitcoin multisig, depending on holdings; owner addresses triple-checked before deployment, because a mistyped owner is a permanent stranger with signing power; and the three keys distributed across genuinely separate locations, home, bank box, trusted party, with recovery instructions that someone other than you can follow.

The recurring costs are minor, deployment gas and slightly larger transaction fees, and the recurring disciplines are not: test the setup with small amounts first, rehearse a lost-key migration before losing one, keep a small gas balance where the contract needs it, and revisit the arrangement whenever a signer, device, or living situation changes. The friction is real, every transaction becomes a small ceremony, and the friction is the feature: a wallet that requires deliberation cannot be drained by one bad click, which, given that a single mistaken approval is how most individual losses now happen, is the entire value proposition in one sentence.

Multisig and its rivals: MPC and smart accounts

Two adjacent technologies answer the same single-point-of-failure problem, and choosing among them is a real decision, not branding.

Multi-party computation, MPC, splits one key into mathematical shares held by different parties, who jointly compute a signature without the full key ever existing anywhere. To the blockchain, the result looks like an ordinary single signature: cheaper, private, chain-agnostic, and revealing nothing about the policy behind it. The trade is opacity and dependence: the threshold logic lives in the providers’ off-chain software rather than in public code, there is no on-chain trail of who approved what, and the institutional MPC market is dominated by vendors whose systems must be trusted. Institutions increasingly use both, MPC for operational hot flows, multisig for deep cold governance.

Smart accounts, account abstraction, generalize the contract-wallet idea: programmable accounts with recovery guardians, spending policies, session keys, and multisig as merely one available policy among many. They are the likely long-term home of these ideas for individuals, folding multisig-grade protection into interfaces normal users can operate. For treasuries today, the audited, battle-hardened dedicated multisig remains the standard, precisely because its decade of scars, documented above, produced a decade of hardening.

Between the architectures sits a question every treasury eventually asks: how many signers is too many? The coordination cost of thresholds grows faster than linearly, five signers across five time zones can turn a routine payment into a week, and organizations respond with delegation structures that deserve scrutiny because they quietly re-centralize. Common patterns include a small operational multisig with spending limits for daily flows, governed by a larger cold council for everything above the limit; module systems that pre-authorize specific recurring actions; and role separation between proposers, who prepare transactions, and signers, who approve them, narrowing what any single compromised seat can initiate. Each pattern trades purity for function, and the honest evaluation standard is the same one the thresholds themselves answer to: enumerate what the compromise of each seat, device, and interface enables, and check that no enumeration ends in everything. Treasury security is not a product purchased once; it is that enumeration, repeated, forever, against adversaries who read the same post-mortems.

One misconception deserves explicit correction before the playbook: multisig does not protect against approving a bad idea unanimously. If all required signers are deceived by the same forged interface, the same fraudulent counterparty, or the same internal fraudster’s paperwork, the threshold is met and the mathematics executes the mistake faithfully. Signature independence protects against compromised keys; only verification independence, different signers checking the payload through different tooling and channels, protects against compromised information, and the great heists were failures of the second kind wearing the confidence of the first.

The operational playbook

Everything in this guide compresses into a practice list, and the list is the difference between the mechanism and its reputation. Choose thresholds for both compromise and loss: 2-of-3 personal, 3-of-5 or higher institutional. Make independence real: different people, devices, vendors, physical locations, and no key in a browser. Verify what you sign: second-channel confirmation of every payload, simulation before approval, and a standing suspicion of anything urgent. Add time as a defense: timelocks on large transfers turn a successful deception into a recoverable one. Rehearse recovery: a lost-key drill and a signer-rotation drill, run before either is needed. And treat the wallet’s own governance, adding or removing signers, changing thresholds, as the crown jewels, because the UXLINK lesson is that whoever can edit the signer set owns everything the signatures guard.

Multisig, honestly summarized, is the most successful security primitive crypto has deployed: it moved the industry’s treasuries from single hackable keys to arrangements that require conspiracies to rob, and the conspiracies, note, have had to grow to nation-state sophistication to succeed. Its failures are not refutations but curriculum, each one converting a blind spot into a checklist item, and the checklist is public. The vault works. Guard the window.

Two closing perspectives round out the subject. The first is the defender’s asymmetry, and it is encouraging: every major multisig loss has produced a specific, adoptable countermeasure, payload verification after Bybit, key-independence audits after Ronin, signer-set timelocks after the takeover breaches, and the countermeasures compound while the attacks must be reinvented. A treasury running the current playbook is not facing the same odds its predecessors did; it is facing adversaries who must now defeat every lesson previous victims paid for. Security in this domain is cumulative, and the cumulation is public.

The second is the philosophical point hiding in the mechanism, worth one paragraph because it explains multisig’s cultural weight in crypto. A multisignature arrangement is a constitution in miniature: a written rule about who may act, enforced by mathematics instead of courts, visible to everyone it governs. That is why the technology became the executive branch of the DAO era, why its failures feel like institutional scandals rather than mere thefts, and why its steady hardening matters beyond the funds it guards. Crypto’s founding claim was that agreements could be enforced without trusted enforcers, and the multisig, requiring humans to agree while preventing any of them from betraying the agreement, is the claim’s most widely deployed, most thoroughly attacked, and most durably successful embodiment. The vaults hold more than money.

For further orientation, the study list is mercifully practical: the post-mortems of the major incidents named above, each a free masterclass in one failure mode; the documentation of the dominant contract systems, whose security recommendations encode the industry’s accumulated scar tissue; the transaction-simulation and payload-decoding tools that address blind signing directly; and, for organizations, the published treasury-operations frameworks that DAOs and custodians have converged on. Multisig is the rare corner of crypto where the best practices are written down, battle-tested, and free, and where the distance between the average outcome and the best outcome is almost entirely a matter of reading them.

And if this guide leaves a single instinct behind, let it be this one: in multisig, the question is never whether the mathematics will hold, because it will. The question, every time, for every transaction, is whether the humans holding the keys know what they are signing, and every practice in the playbook above is, in the end, a different way of making sure the answer is yes.

Disclaimer: This article is for educational purposes only and does not constitute investment or security advice. Digital asset custody carries significant risk, and no arrangement eliminates it. Details are current as of July 9, 2026. Always do your own research.

Frequently asked questions