2-of-3 Multisig Wallet: Who It Suits and What It Costs

Picture a safe that opens with any two of three keys. One key lies in your home, the second in a deposit box, the third with your brother. A burglar who breaks into your home has one key and opens nothing. If the key at home burns, you open the safe with the keys from the deposit box and from your brother. That’s how a 2-of-3 multisig wallet works.

It has one trap that isn’t obvious at first: the safe also has a blueprint, and without it the keys are just pieces of metal. In bitcoin, that blueprint is the wallet configuration. The rest of this text is about not forgetting it. The wider context of security is in the pillar how to secure crypto.

How a 2-of-3 wallet works

Multisig means “multiple signatures”. In a 2-of-3 setup you create three independent keys, usually on three separate devices, for example two Trezors and one BitBox, or three devices from different makers. Each has its own seed and its own backup. The addresses you receive bitcoin on are derived from all three public keys at once, so spending needs signatures from two of them.

In practice you send a transaction like this. Coordinating software (Sparrow or Nunchuk) creates an unsigned transaction. You sign it on the first device, then on the second. Once there are two signatures, the software broadcasts the transaction to the network. No private key ever leaves its device.

You gain two things. Losing one key doesn’t lock the funds, because the other two are enough. Stealing one key doesn’t let a thief send the funds, because they need a second. You pay for it with complexity and hardware cost.

Who it suits

A 2-of-3 multisig makes sense when bitcoin is an amount whose loss would really hurt, and you want to separate two risks: that something gets lost and that someone steals something. It most often applies to people who:

1. Hold bitcoin for years and don’t plan frequent withdrawals.
2. Want their family to have access after their death, while no single relative can take the funds alone.
3. Already have a hardware wallet and a seed backup, but worry that this single backup is a single point of failure.
4. Manage shared funds, for example family or business money.

The setup also solves the problem discussed in the guide on the seed phrase: one seed backup that someone finds gives them everything. In multisig, finding one backup isn’t enough.

Who it doesn’t suit

Multisig isn’t an upgrade for everyone. Don’t set it up if:

1. You can lose the amount without harm to your plans. The cost and complexity won’t pay off on small sums.
2. You pay with bitcoin often. Every transaction needs two devices.
3. You don’t yet have a tested backup of an ordinary seed. Get the basics right first: a hardware wallet, two copies, a recovery test.
4. You hold cryptocurrencies other than bitcoin. We set up 2-of-3 wallets for bitcoin, and for other coins we move the funds to a hardware wallet and take care of a good backup.
5. You have nobody to entrust the third key and the instructions to. A setup that nobody but the owner can run is worse for the family than an ordinary wallet with good instructions.

Single-sig vs 2-of-3

Feature	One key (single-sig)	2-of-3
What you need to spend	One key	Two of three keys
Result of losing one key	Loss of access if there’s no seed backup	No effect, the other two are enough
Result of one key being stolen	Funds stolen	The thief has no access
What you need to recover	Seed (and passphrase, if there was one)	Two seeds and a configuration backup with the public keys of all three
Number of devices	One	Usually three
Hardware cost	One wallet	Several times higher
Complexity for the family	Low	Higher, needs instructions
For what amount	Small to medium	Medium and larger, bitcoin

The trap: the wallet configuration

This is where mistakes happen most often. In an ordinary wallet you restore everything from the seed. In multisig, a seed is enough to restore only one of the three keys.

The reason comes from how keys work. A multisig address is built from three public keys (xpubs). From one seed you can work out your own xpub, but not anyone else’s. With two seeds out of three you get two xpubs. You can’t work out the third, so you can’t rebuild the same addresses. Without the third public key, the wallet won’t know which addresses to show.

That’s why recovery needs the configuration, called a descriptor. BIP380 describes descriptors as a way of writing scripts and keys that is meant to allow wallet backups that unambiguously define the scripts. The BIP129 (BSMS) standard describes setting up multisig securely and storing a record with the descriptor or its template.

Nunchuk’s documentation says this outright. To recover a personal wallet you need the seeds (as many as the signing threshold, so two in a 2-of-3 setup) and the wallet configuration file. Nunchuk saves it in the BSMS format, with a .bsms extension. If one of the keys was used with a passphrase, recovering that key takes both the seed and the passphrase.

In practice it means one extra backup, which you make when you create the wallet:

1. After creating the wallet, save the configuration file (the descriptor). Sparrow and Nunchuk both export the wallet configuration, and in Nunchuk it’s a .bsms file.
2. Print it and keep it with each key backup, so in each of the three places. Also save the file on two independent media.
3. Note which wallet it belongs to and which program created it.
4. Add the information to your family instructions.

The configuration file contains public keys, not private ones. It doesn’t let anyone spend the funds. It does show the whole structure of the wallet, though, so whoever gets it can track your balance and transactions. For that reason a printout next to the keys is safe for the funds, but don’t send the file around without need. Without it, two seeds may not be enough, so a missing printout is a real risk.

You’ll practise restoring from the configuration file in the recovery test described below. During a setup we do it with you.

How the setup goes, step by step

The process depends on the program, but the order is always similar.

1. Prepare three devices, each with its own freshly generated seed. Don’t use one seed in two places.
2. Write down and check the backup of each seed, as with an ordinary wallet.
3. In Sparrow or Nunchuk, create a new wallet, choose the multisig type, set the 2-of-3 threshold and add the public keys from the three devices.
4. Export the configuration and save it in several places.
5. Generate the first address and check it on the device screens, if the program and hardware allow it.
6. Send a small amount and run the recovery test described below.

On top of this comes a decision on who holds which key. Write it into the instructions, because in a few years nobody will remember which device is which.

Cost

The cost has three parts.

Hardware. Three devices instead of one, so several times the price of an ordinary hardware wallet. You can use devices from different makers, for example a Trezor and a BitBox, so a fault in one model doesn’t hit all the keys. You buy three steel plates or three sheets of paper for the seeds yourself.

Time. The first setup, the recovery test and writing everything up for your family take many hours. We help with this in the setup service: €300 to €1,500 one-off after a check-up, depending on scope. We help you choose wallets and plates, which you buy yourself, set up the 2-of-3 arrangement in Sparrow or Nunchuk, and run the recovery test with you. You type in the seeds yourself. We never see them.

Maintenance. Software updates, an annual recovery test and reminders. You can do these yourself or use the care service for €10–30 a month.

Where to keep the three keys

A typical layout: the first key at home, in a safe, the second in a deposit box or with a trusted person in another city, the third with a person who knows the access instructions. The aim is that no single person and no single place holds two keys. You keep the configuration backup separately, in at least two places.

The rules for storing the seeds of each of the three devices are the same as for an ordinary wallet: paper or steel, no photos and no cloud. We describe them in the guide on storing a seed phrase.

Mistakes that show up only after years

Several mistakes come to light after a long time, when they’re hard to fix.

All three seeds sit in one place. A 2-of-3 setup then loses its point, because a single burglar or a single fire takes the full set. Each key should be stored separately.

Nobody remembers which seed belongs to which device. Label the backups briefly and neutrally, and keep the description separately, in the instructions.

The configuration file was only on one computer, which broke. That’s why we talk about copies in several places.

One of the devices stopped being supported by the program. The seed remains, so the key can be rebuilt on new hardware, but you have to remember that and practise the restore before it’s urgent.

Recovery test

Multisig without a recovery test is an assumption. With a small amount, check the whole thing before you send the main funds.

1. Create a 2-of-3 wallet and export the configuration file.
2. Send a small test amount.
3. Remove the wallet from the program on your computer.
4. Restore it from the configuration file and connect two of the three devices.
5. Sign and send a small transaction.
6. Repeat the exercise with a different pair of keys, to make sure no single key is indispensable.

Only after such a test move a larger sum. Repeat the test once a year and after any change of hardware.

What next

If you’re wondering whether 2-of-3 suits your situation, or you want someone to go through the setup and the test with you, we’ve described the scope in the setup service. If you’re not sure whether an ordinary wallet and a good backup wouldn’t be enough, start with a check-up. The terms are explained in the glossary entries xpub and multisig. For how to avoid typical mistakes, read the guide common crypto security mistakes.