Single-signature custody has one structural weakness: there is exactly one secret, and both of the bad outcomes flow from it. If someone else gets that secret, they take everything. If you lose it, you lose everything.
Multisig attacks that directly. Instead of one key authorising a spend, you require m of n keys. The common arrangement is 2-of-3: three keys exist, any two can move funds.
Why 2-of-3 specifically
Work through the cases and the appeal is obvious.
A key is stolen. The thief has one key. They need two. Your coins do not move, and you still have the other two keys to migrate to a fresh setup.
A key is lost - fire, flood, a device that dies, a backup that turns out to be wrong. You still have two. You can still spend. You rebuild at your own pace instead of discovering the loss at the worst moment.
A device manufacturer turns out to have a flaw. If the three keys are on three different manufacturers' hardware, one vendor's problem is not your problem.
Single-sig has no equivalent answer to any of those. The security and the redundancy come from the same structure, which is what makes it elegant.
What it costs
This is where most multisig write-ups stop, and it is the half that decides whether you should do it.
You now have three backups, not one. Three seeds, stored in three places that fail independently. If they all live in the same house, you have paid the complexity price and bought nothing, a house fire still takes all three.
You have a fourth thing to back up, and it is the one people forget. The seeds alone are not enough to reconstruct a multisig wallet. You also need the wallet descriptor, the record of which public keys are in the quorum, the derivation paths, and the policy. Lose the descriptor and you can hold all three seeds and still be unable to rebuild the wallet or even see the funds. This is the failure specific to multisig, it is the one people do not see coming, and it does not exist in single-sig at all.
Every spend is more work. Two devices, two signing steps, a coordinator that understands the setup. Fine for savings you touch twice a year. Genuinely unpleasant for anything you spend from.
Receiving takes a check that single-sig does not need. A single-sig address is derived from one key your device holds, so the device can confirm it. A multisig address is derived from all three public keys, which means the coordinator software computes it, and software that has been tampered with can show you an address that is not yours. Register the wallet policy on each signing device and confirm the receive address on a second device before sending anything to it.
Recovery is more fragile than it looks. It depends on wallet software that still supports your specific setup years from now. The descriptor is at least a standard format, specified in BIP 380, which is what makes recovery on software other than the original possible at all. Practising a full recovery, from seeds and descriptor, on software you did not originally use, is the only way to know it works.
More parts, more chances to get it wrong. A misconfigured multisig can be less safe than a competent single-sig. The complexity is not free, and it is borne by you.
Who it is actually for
Worth it if: you hold an amount where losing it would materially change your life; the holding is long-term savings you rarely move; you are comfortable with the tooling; and you can genuinely store three backups in three places that do not fail together.
Not worth it if: the amount is modest; you are still new to self-custody; you spend from it regularly; or you do not have three genuinely separate storage locations. In those cases a well-executed single-sig with a tested backup beats a badly-executed multisig, comfortably.
There is a real ordering here. Get single-sig right first. If you have not yet done a full wipe-and-restore from your written seed, multisig is not the next step - that is.
Collaborative custody
A middle option: a company holds one key of a 2-of-3 while you hold two. As of August 2026 Unchained builds its vaults this way, and Casa does the same on its entry tier, with a five-key arrangement above it. Check the current shape of either before signing up, since the products move.
What it gets you: the provider cannot move funds alone, because they have one key of three. You can still spend without them, using your two. If you lose one of yours, they help you recover with theirs. You get an expert on the setup and a documented recovery path.
What it costs you: a subscription, a KYC relationship, a company that knows what you hold, and a dependency on that company continuing to exist. The last one is manageable if, and only if, you hold the descriptor yourself and have verified you can recover without them. Confirm that before you sign up, not after.
For people who want the redundancy without becoming their own systems administrator, it is a reasonable trade. It is not self-custody in the strict sense, and it should not be described as such.
If you set one up
- Three different manufacturers, so one vendor's flaw is not your problem.
- Three genuinely separate locations, failing independently. Not three drawers.
- Back up the descriptor alongside every seed, and in a place your heirs will find.
- Register the policy on every signing device, and confirm the first receive address on a second device before you send anything to it.
- Practise a full recovery - from backups only, ideally on different software - before the wallet holds anything meaningful.
- Write down how it works, in plain language, for whoever has to do this without you. See inheritance planning.
Related: what self-custody requires and choosing a wallet.