Multisig basics (2-of-3)

How 2-of-3 works

Three independent keys exist and any two are required to spend. A thief needs two keys; you can lose one and still recover. Use multisig after you are comfortable with single-sig.

Vendor diversity

Use devices from different vendors (for example BitBox02 + Jade + Trezor Safe). The 2026 COLDCARD weak-seed incident (Coinkite) showed how one vendor bug can affect every seed made on that firmware. With mixed vendors, a single bug cannot take two keys.

The descriptor is essential

To spend you need two seeds and the public details of all three keys (xpubs, fingerprints, derivation paths, quorum and script type). The output descriptor holds all of it. It cannot spend funds, but it reveals your balance and history, so keep it private. Store a copy with every seed backup.

Setup outline (Sparrow Wallet)

1. Prepare each device: current firmware, genuine check, new seed with your own entropy, metal backup, restore test.
2. In Sparrow: File → New Wallet → Policy type Multi Signature, script Native SegWit, 2 of 3.
3. Import each device as a keystore and confirm each master fingerprint matches the device.
4. Save the descriptor PDF and store one copy with each seed backup.
5. Register the multisig wallet on every device that supports it and check the quorum and fingerprints on screen.
6. Verify a receive address on two devices, receive a small amount, then test-spend with each pair: A+B, B+C, A+C.
7. Store the three keys and backups in three separate locations.

Common mistakes

• Not backing up the descriptor (the most common multisig recovery failure).
• Two keys in the same place.
• Three devices from the same vendor.
• Never testing every key pair.