Multisig: the multi-key vault

On Bitcoin, multisig is native: the network itself verifies the quorum, through a mechanism proven over more than ten years. The historical trade-offs — slightly higher fees and a quorum publicly visible when spending — are fading with Taproot, which lets modern multisigs look (and cost) like an ordinary transaction. The reference coordinators are open source: Sparrow Wallet on desktop, Electrum the veteran, Nunchuk on mobile, and France's Liana, which adds time-delayed recovery paths (timelocks) designed for key loss and inheritance.

Ethereum has no protocol-level multisig: you deploy a smart contract that holds the funds and enforces the quorum. The reference is called Safe (ex-Gnosis Safe): it secures tens of billions of dollars for teams, DAOs and demanding individuals. The contract's advantage: you can change signers or the threshold without changing the address. The trade-off: you also trust the code and the interface. The early-2025 hack of the Bybit platform (around $1.5 billion) didn't break Safe's contracts: the compromised interface disguised what the signers were approving. The lasting lesson: verify every transaction on the screen of the signing device, never just on the website.

On Solana, the standard is called Squads: a repeatedly audited program that has become the vault of hundreds of teams across the ecosystem. Finally, there's a technological cousin, MPC: a single key built as distributed fragments that sign together without ever being reassembled. It's the approach of modern consumer wallets — including Deblock, with an active fragment on your phone and a passive fragment on their servers. Same philosophy (removing the single point of failure), but the quorum is enforced by software, not carved into the blockchain.

Multisig answers three anxieties at once. Theft: one compromised key (burglary, phishing, a manufacturer's flaw) is no longer enough. Loss: a fire, a flood, a mistake — the vault survives. Trust: a couple, an association or a company can guarantee that nobody walks off alone with the cash box. That's exactly why nearly all large crypto treasuries live in multisig.

For an individual, the reference guides (Sparrow, Casa, Unchained) place the tipping point where your wallet becomes real wealth — often around several tens of thousands of euros — or as soon as you start planning your inheritance. Below that, the complexity costs more than it protects: a well-backed-up hardware wallet, or even a mastered passphrase, already covers the essentials. In fact, the overwhelming majority of the world's bitcoin is still held in single-sig.

If you want the safety net without facing the technical side alone, collaborative custody (Casa, Unchained) leaves you the majority of the keys and keeps only one: the service can't move anything without you, but can help you recover or pass things on. It's also the best-marked path for inheritance: their dedicated protocols let your loved ones recover the vault when you die, without being able to touch it while you're alive.

Since 2024-2025, the most publicized threat is no longer purely digital. So-called “wrench attacks” — physically threatening someone into emptying their wallet — have risen sharply, and France has been hit particularly hard: several kidnappings and attempted kidnappings have targeted crypto entrepreneurs and their relatives, including one of Ledger's co-founders in early 2025. The French state has responded (priority access to the police emergency line, security consultations, support for exposed families). The lesson isn't panic — these cases remain rare relative to millions of holders — but security also needs thinking through in the real world.

Multisig changes this scenario at its core. If your keys are spread out geographically (home, bank safe deposit box, trusted third party), emptying everything under immediate duress becomes physically impossible: nothing available “on site” is enough. Specialized services add enforced delays — a backup key that only responds after several days, Liana-style timelocks: a smash-and-grab attack loses its point because it can't succeed fast.

The passphrase (the “25th word” from the previous module) plays a complementary but debated role: it mainly protects your paper seed, and can create a “decoy” wallet holding a plausible amount. Specialists add nuance, though: a decoy can fail if the attacker already knows what you hold, and you don't combine a passphrase and multisig on the same vault — multisig already eliminates the single point of failure.

That leaves the first line of defense, which costs nothing: discretion. The French police sum it up in one phrase: “discretion is protection”. Never show your holdings (social media, conversations, screenshots), avoid having crypto hardware delivered under your name and home address — Ledger's 2020 customer-database leak still fuels phishing and target scouting — and brief your loved ones: in the recent French cases, family members are targeted at least as often as the holder themselves.

Multisig has a price: rigor. It multiplies what you have to back up (each seed + the descriptor), the handling involved and the chances of getting something wrong. The main risk isn't the hacker: it's you. In 2-of-3, losing two keys with no copies = funds permanently lost, with no recourse whatsoever. The documented post-mortems all look alike: seeds stored in the same place, descriptor never exported, recovery never tested.

Best practices come down to a few rules: different manufacturers for the devices (a flaw at one doesn't doom the vault), genuinely separate locations, a full recovery test with a small amount before depositing your capital — then periodic re-tests. And the most counter-intuitive advice: don't over-engineer. In the vast majority of cases, the simplest option that covers your risk is the right one; a well-run 2-of-3 beats a poorly managed 3-of-5.