Bitcoin Multisig Explained: How 2-of-3 Wallets Protect Coins

On August 2, 2016, Bitfinex lost 119,756 bitcoin in about three hours — roughly $72 million at the time, several billion at today's prices. Every customer wallet on the exchange was a 2-of-3 multisig. Multisig is supposed to be the gold standard of bitcoin security, and here it did nothing. Understanding why is the fastest way to understand what multisig actually protects against, what it doesn't, and whether you should be using it.

What multisig actually is

A normal bitcoin wallet is single-signature: one private key produces one signature, and the coins move. Multisig — multi-signature — locks coins so that spending requires signatures from a threshold of keys, written as m-of-n. In a 2-of-3 wallet, three keys are generated and any two of them together can spend. One key alone can do nothing.

This isn't an app feature bolted on top of Bitcoin. It's enforced by Bitcoin's scripting language at the protocol level, and has been since 2012, when BIP 16 introduced pay-to-script-hash and gave multisig its own address format (the ones starting with 3). Modern setups use native SegWit addresses — the long bc1q strings — and since Taproot activated at block 709,632 in November 2021, key-aggregation schemes like MuSig2 can make a multisig spend look on-chain like an ordinary single signature. (We covered the mechanics in our Taproot explainer.)

The sentence that matters: the network itself refuses to move the coins unless the quorum signs. No company, no server, no password-reset flow sits in the middle.

What 2-of-3 buys you

Think of the three keys as three separate failures you can survive.

  • Theft. A burglar who finds one hardware wallet, or malware that compromises one signing device, has one key. Useless on its own.
  • Loss. A house fire destroys one key. You still hold two, and you sweep the coins to a fresh wallet at your leisure instead of at gunpoint.
  • Coercion. If the keys live in three places — home, a relative's safe, a bank deposit box — nobody can drain the wallet in a single visit, wrench or no wrench.
  • Inheritance. A third key held by a lawyer or a collaborative-custody service (Unchained, Casa, Nunchuk) lets your heirs recover the coins with one of yours after you're gone, while the service can never move a sat alone. Our inheritance guide goes deeper on that structure.

A single-sig wallet with a passphrase handles some of this. It doesn't handle all of it at once. Any single-sig setup has, by definition, one thing whose loss or theft is fatal.

Why Bitfinex's multisig failed

Back to 2016. Bitfinex held two of the three keys for each customer wallet — both on its own online infrastructure, reportedly on a single internal device — and BitGo held the third, on servers configured to co-sign automatically within per-user limits. The attackers didn't break multisig. They broke Bitfinex's systems, which put two keys' worth of signing in one place, then pushed withdrawals through the exchange's API until BitGo's automated co-signer rubber-stamped them.

The lesson generalizes. Multisig only helps if the keys are actually independent: different devices, different physical locations, ideally different hardware manufacturers, and no key that signs without a human touching it. Three keys on one laptop is a single-sig wallet with extra steps.

The trap that catches real people

Here is what almost nobody tells you before your first multisig. To spend from a 2-of-3, you need two private keys and all three public keys, plus the quorum rules, so your wallet software can rebuild the script the coins are locked to. That bundle of information is the wallet descriptor (some wallets call it a config file or export it in the BSMS format). Lose it, and two perfectly backed-up seed phrases will not save you, because nothing can re-derive the addresses your coins sit at.

The fix is simple and non-negotiable: keep a copy of the descriptor with every key. It contains only public keys, so it can't be used to spend — but it does reveal your balances to anyone who finds it, so treat it like a bank statement, not a public document. Sparrow, Nunchuk, and Specter will all export it as a text file or QR code in a few clicks.

What it costs

Multisig isn't free. A 2-of-3 native SegWit input is roughly 50% larger than a single-sig input, so every spend pays more in fees — a rounding error at 5 sat/vB, real money at 200. You'll buy two or three hardware wallets instead of one. Setup and recovery are slower, fewer wallets support it well, and you need to rehearse: a recovery plan you've never tested is a hypothesis, not a plan.

How to set up a sane 2-of-3

  1. Decide whether you need it. Rule of thumb: if losing your stack would change your life, multisig is worth the overhead. If it's a few hundred dollars, one hardware wallet with a good seed backup is the right answer.
  2. Get three signing devices, ideally from different makers — a Coldcard, a Trezor, and a Jade or BitBox, say — so one firmware bug can't touch all three.
  3. Use a coordinator like Sparrow Wallet on your desktop to assemble the 2-of-3 from the three devices' public keys. Register the multisig on each hardware wallet so it can verify the addresses it's signing for.
  4. Export the descriptor and store a copy alongside each seed phrase.
  5. Test every pair. Send a small amount in, then spend it back out with keys 1+2, then 2+3, then 1+3. Only after all three combinations work do you move real money.
  6. Split the keys geographically, write down in plain language where everything is and how to recover, and rehearse the recovery once a year.

Multisig is the kind of thing you build once you've decided bitcoin is a permanent part of your life — the same instinct behind BitCloset. We make heavyweight apparel for people who hold their own keys and plan on keeping them. Browse the current drop at bitcloset.shop.

Further reading

Back to blog

Leave a comment