Bitcoin multisig
A 2-of-3 multisig wallet needs any two of three keys to spend, so no single device, location, or mistake can take the money. I gave a talk on setting one up properly in Galway in August 2026: why (and why not), hardware, backups, and the habits that make it recoverable years later.
Download the slides (PDF, 0.6 MB)
The short version
- Seeds on stainless steel, never only on paper.
- One key per location, three genuinely independent locations. A fire, a flood, or a burglary should only ever reach one of them.
- The wallet descriptor stored with every seed, in every location. Any two locations must be enough to recover everything.
- Independent hardware wallets, from different vendors: one bug should never be able to touch two keys.
- Standard derivation paths. Don't be clever.
- Test the restore before real money: two seeds plus the descriptor on a clean machine.
- Once a year, sign a transaction with each pair of keys. Signing is enough; nothing has to move.
Storing each key
One way of doing it, not the only way.
- Outer layer: a fireproof document bag. It handles water, smoke and a short fire. The steel and the other two locations are what actually save you.
- Inner layer: a tamper-evident bag, its serial number logged in your password manager. A swapped or tampered bag is detectable; a copied seed otherwise is not.
- Inside: the hardware device with this key on it, the seed on steel, the descriptor as plain text and QR, a short note saying whose it is and who to call, and a sachet of indicating silica gel to help with moisture.
- Not inside: anything about where the other two bags are. Whoever finds one bag can already see the balance in the descriptor; don't hand them a map as well.
- Yearly: open one bag, check the plates and paper, refresh the silica, reseal in a new bag, log the new serial.
If you'd like to talk through your own case, how to set this up in your situation, or a one-to-one workshop, contact me.