Multisig vs Single-Key Custody: Where a Threshold Helps

A multisig arrangement requires several keys to authorise a transaction — two of three, three of five, whichever threshold is chosen. The obvious benefit is that no single key compromise loses the funds. The less obvious cost is that the arrangement introduces coordination, more backup surface and more ways to be locked out permanently. Both sides need to be on the table.

What a threshold genuinely removes

Single-key theft stops being fatal. An attacker who obtains one key of a two-of-three cannot move anything, and you have time to move funds to a new arrangement before they find a second.

Single-key loss stops being fatal in the same way. Lose one key of three and you still control the funds with the remaining two, which converts a catastrophe into an inconvenience.

Coercion becomes harder in a specific configuration: keys held in different places, by different people or under different jurisdictions mean the person in front of an attacker genuinely cannot comply alone.

And it enables shared control. Two people, or a person and an institution, can hold funds where neither can act unilaterally — which is not a security property so much as a governance one, and is the reason most organisational treasuries use it.

What it adds

More keys means more backups, and each backup is a thing that can be lost, found by the wrong person, or degraded. A two-of-three has three seeds to store securely rather than one, and the storage problem is where most self-custody actually fails.

Recovery becomes procedural rather than simple. Restoring a single-key wallet needs one seed. Restoring a multisig needs the threshold of keys plus the wallet descriptor — the record of which keys, in what order, under which script type. Lose the descriptor and holding enough keys may not be sufficient to reconstruct the arrangement, which is a failure mode single-key custody does not have at all.

Compatibility narrows. Fewer wallets support multisig, support varies in quality, and moving between them is harder. A setup that depends on one piece of software is a dependency you did not have before.

And routine use gets slower. Every transaction requires assembling signatures from multiple devices. That friction is protective against mistakes and corrosive to discipline: setups that are annoying to use get shortcuts, and shortcuts are where the security went.

Choosing the threshold

The two numbers encode two different fears, and they trade against each other directly.

Raising the threshold — three of five rather than two of five — makes compromise harder and lockout easier. Lowering it does the reverse.

Adding keys at a fixed threshold — two of five rather than two of three — makes lockout harder and compromise easier, because there are more keys an attacker could reach.

Two of three is the common default because it survives one loss and one theft, which covers the realistic scenarios for an individual without becoming unwieldy. Larger schemes belong to organisations, where the governance requirement rather than the security one is doing the work.

The mistake that undoes it

The most common way a multisig fails is that the keys are not actually independent.

Three keys generated on the same device, at the same time, and backed up in the same safe, produce a scheme with the security properties of a single key and the complexity of three. The same applies to keys held on three devices from the same manufacturer with the same firmware, or in three cloud accounts secured by the same email.

Independence is the entire premise. Different devices, different physical locations, different recovery paths — and, where the scheme is meant to survive coercion or jurisdictional risk, different people or countries. A multisig where a single event can reach the threshold is decoration.

When single-key is the better answer

For most individuals holding an amount they could rebuild, a single well-protected key on a good signing device with a carefully stored backup is the stronger practical choice — not because it is more secure in theory, but because it is simple enough to be executed correctly and recovered under stress.

Multisig earns its complexity when the amount justifies the operational burden, when several parties must share control, or when the specific threats you face are coercion and single-point compromise rather than your own error. Those are real situations. They are not everyone's.

• Are your keys generated on different devices, stored in different places, with different recovery paths.
• Is the wallet descriptor backed up alongside the keys, and would a non-expert know what to do with it.
• Could one event — a fire, a burglary, a subpoena, a manufacturer bug — reach the threshold.
• Have you performed a full recovery from backups, on different hardware, without the original setup available.
• Is the arrangement simple enough that whoever inherits it can execute it.

That last question is the one that most often converts a multisig from protection into a trap, and it belongs in the design rather than in the aftermath.