Multisig

A multisig address commits to a script that names several public keys and a threshold, most often two of three. Bitcoin has treated it as a standard transaction type since BIP-11 was written in October 2011, years before hardware wallets existed. For savings you plan to hold across a decade, it removes the single point of failure that one recovery phrase creates.

How it works

The multisig rule lives in the output's script, so the network enforces it rather than any application. A classic two-of-three redeem script reads: push the number 2, push three public keys, push the number 3, then OP_CHECKMULTISIG. Nodes count valid signatures against the listed keys and reject the spend unless at least two check out. No company, no server, and no wallet vendor participates in that decision.

Three encodings of the same idea have been standard at different times, and the size limits differ.

Bare multisig places the keys directly in the output. Relay policy has capped it at three keys for years, and it wastes space, so it survives mainly in very old coins.

P2SH hides the script behind a hash and reveals it when spending. The 520-byte limit on a redeem script caps that route at 15 compressed public keys.

P2WSH, the SegWit version, moves the script into the witness and raises the ceiling to a 3,600-byte witness script, at which point the opcode's own limit of 20 keys binds first. Native SegWit multisig addresses start with bc1q and are what most current coordinator software produces.

One historical quirk is still visible in every spend. OP_CHECKMULTISIG pops one item more than it needs, a bug from the original implementation that could not be removed without a hard fork. BIP-147 made that leftover item required to be empty as a consensus rule, activating alongside SegWit at block 481,824 on 24 August 2017.

Taproot changed the picture again. BIP-342 disabled OP_CHECKMULTISIG inside tapscript and introduced OP_CHECKSIGADD, which tallies signatures one key at a time and lifts the 20-key ceiling. Separately, MuSig2 lets a group of signers combine their keys into one, so an n-of-n spend appears on the chain as an ordinary single-signature Taproot payment, indistinguishable and cheaper.

Why this matters when you buy bitcoin

Multisig is not an alternative to an exchange. You still buy on one of the platforms reviewed here, and multisig is the destination you withdraw to, so the buying guides and this decision are independent.

What it changes is the shape of your risk. A single-signature wallet fails completely from one event: a lost phrase, a house fire that reaches both copies, a coerced disclosure, a firmware backdoor in one vendor's product. A two-of-three built from three different manufacturers survives all of those, because no single seed, no single building, and no single company is sufficient. That is why our hardware reviews flag which devices lack a secure element: in a mixed quorum, one weaker device stops being fatal.

The costs are real and should be counted honestly. Spending is bigger, since a two-of-three native SegWit input weighs roughly 105 vbytes against about 68 for a single-signature one, so the same payment costs around half as much again in fees. Setup takes an evening rather than three minutes. And there is a new object to back up, the wallet descriptor listing every extended public key, the derivation paths, and the threshold, which is not reproducible from the seeds you hold if you cannot reach the cosigners.

The honest threshold for adopting it is behavioural, not financial. If you have already tested restoring a single-signature wallet from your written words, and the amount at stake now worries you, multisig is the next step. If you have not run that drill yet, adding two more devices multiplies the ways an untested backup can disappoint you.

A two-of-three that survives one lost key

Here is a two-of-three multisig configuration that people actually maintain, described concretely enough to copy.

Buy three signing devices from three vendors, ideally from three different suppliers, and set each one up on its own with its own recovery words. Combine their extended public keys in coordinator software such as Sparrow or Nunchuk, choosing a two-of-three policy, and export the resulting descriptor.

Store the three seed backups in three places that fail independently: a home safe, a bank box or workplace, and a trusted relative in another town. Store a copy of the descriptor with every one of them, since it is not secret and holding it alone lets nobody spend anything, while missing it can strand coins that all three seeds could otherwise recover.

Fund it with a small amount, then rehearse the failure. Pretend one device is gone, spend from the other two, and confirm the transaction settles. Do the same drill after any change to the quorum, and again once a year.

When a device genuinely fails, you have not lost anything, but you are now running a two-of-two. Replace the missing signer, build a fresh quorum with the new key, and move the coins to the new address rather than living on the reduced margin.

Multisig vs multisig vault

Multisig is the underlying scheme; a multisig vault is a product built on top of it. Services sell managed quorums where the provider holds one key, you hold one or two, and a recovery process covers the rest. The script on the chain looks the same either way, but the trust model does not: a vault introduces a company that can go out of business, change its pricing, or be compelled by a court, which is precisely the dependency self-managed multisig removes. Both are legitimate choices, and confusing them means misjudging who has to stay alive for your coins to move.

Multisig vs P2SH multisig

Multisig is the spending policy; P2SH multisig is one way of putting that policy into an address. The distinction became load-bearing when SegWit and Taproot arrived, since an identical two-of-three now has at least three possible on-chain forms with different sizes, different address prefixes, and different privacy properties. When restoring a wallet, "it was a two-of-three" is not enough information; you also need to know which script type produced the addresses you funded.