Bitcoin multisig

A 2-of-3 multisig wallet needs any two of three keys to spend, so no single device, location, or mistake can take the money. I gave a talk on setting one up properly in Galway in August 2026: why (and why not), hardware, backups, and the habits that make it recoverable years later.

Download the slides (PDF, 0.6 MB)

The short version

• Seeds on stainless steel, never only on paper.
• One key per location, three genuinely independent locations. A fire, a flood, or a burglary should only ever reach one of them.
• The wallet descriptor stored with every seed, in every location. Any two locations must be enough to recover everything.
• Independent hardware wallets, from different vendors: one bug should never be able to touch two keys.
• Standard derivation paths. Don't be clever.
• Test the restore before real money: two seeds plus the descriptor on a clean machine.
• Once a year, sign a transaction with each pair of keys. Signing is enough; nothing has to move.

Storing each key

One way of doing it, not the only way.

• Outer layer: a fireproof document bag. It handles water, smoke and a short fire. The steel and the other two locations are what actually save you.
• Inner layer: a tamper-evident bag, its serial number logged in your password manager. A swapped or tampered bag is detectable; a copied seed otherwise is not.
• Inside: the hardware device with this key on it, the seed on steel, the descriptor as plain text and QR, a short note saying whose it is and who to call, and a sachet of indicating silica gel to help with moisture.
• Not inside: anything about where the other two bags are. Whoever finds one bag can already see the balance in the descriptor; don't hand them a map as well.
• Yearly: open one bag, check the plates and paper, refresh the silica, reseal in a new bag, log the new serial.

If you'd like to talk through your own case, how to set this up in your situation, or a one-to-one workshop, contact me.