A Bitcoin multisignature wallet, or multisig wallet, lets you define how many different keys must authorize a payment. It can help you share control or retain access if one key becomes unavailable, but it also adds responsibilities for setup, verification and recovery. More hardware wallets do not automatically make your bitcoin safer.

Before choosing multisig, make sure you understand both what the signing devices protect and what you need to recover the complete wallet. This article explains those requirements for a conventional Bitcoin multisig setup.

What does a 2-of-3 multisig wallet mean?

In a 2-of-3 wallet, there are three different signing keys, and any two can authorize a transaction. A cosigner is a participant in that setup, represented by a signing key. One person can control all three keys, or different people can each control one.

The number of signatures required is called the threshold. With a correctly configured 2-of-3 wallet, someone who obtains only one signing key cannot spend the bitcoin alone. You can also lose access to one key and still spend using the other two, provided you retain the wallet configuration described below.

These must be different keys. Restoring the same recovery words and, if used, the same optional passphrase on three devices creates copies of the same signing secret; it does not provide three independent cosigners.

When can multisig help?

Multisig is useful when you have a specific need for shared control, separation of signing keys or redundancy. For example, two people may need to approve a company payment, or one person may keep signing keys in separate locations so that losing one location does not remove access.

Those benefits depend on how you manage the setup. Keeping enough devices and backups to meet the threshold in one place can let a single theft compromise them together. Combining devices from different manufacturers can reduce reliance on one implementation, but also introduces different verification features and recovery requirements.

If you do not need shared control and cannot confidently verify and recover a multisig wallet, a well-managed single-signature hardware wallet may be the more suitable choice. Multisig adds more information to preserve and more opportunities for mistakes.

For more examples of how multisig can be used, read our blog overview of multisig wallets and who they are for.

Why verifying the initial setup matters

A multisig wallet uses public information from every cosigner to calculate its addresses. An extended public key, usually called an xpub, provides the information needed to derive a cosigner's public keys across the account. The wallet combines these with its threshold and other configuration details.

A compromised computer could substitute an attacker's public keys during setup. For example, replacing two cosigners in an intended 2-of-3 wallet could produce addresses controlled by the attacker, even though your own device's key is included.

How to establish a trusted comparison

The reference for each cosigner's account xpub is that cosigner's own hardware-wallet screen. Compare the full key for the account and derivation path used in your multisig wallet. An account name or short fingerprint alone is insufficient.

You can make the comparison in either of these ways, where your devices and wallet software support the required display:

• Use a verified paper record. Record each cosigner's account xpub from its own device screen, or check a printed copy against that screen character by character. Compare the cosigner keys shown during multisig registration with those verified records.
• Compare device screens directly. Display the relevant account xpub on its originating device while comparing it with the same cosigner's xpub shown on another device during registration. Repeat for every cosigner in each configuration you register.

In BitBox's multisig registration review, its own key is identified as belonging to the connected device. This distinguishes the key the device can verify itself from the other cosigner keys you must cross-check. A device's ability to show a key also depends on the wallet software exposing that function; do not assume there is a separate command to display it again later.

Complete the cross-checks before funding the wallet. Comparing two screens or files supplied by the same computer does not provide independent verification, and an unchecked printout is not a trusted record.

The same extended public key can have different encodings, such as xpub and Zpub. BitBox supports displaying cosigner keys in different formats, but the wallet integration determines the format requested. Use a supported matching format for comparison: changing only the prefix does not convert a key correctly. If you cannot establish a trusted match, stop before funding rather than relying on an online converter.

Our 2020 analysis of cosigner verification and xpub substitution attacks explores these risks in more detail. Its device comparisons describe the implementations available at the time.

What must you back up?

A multisig recovery plan needs two different kinds of information:

• The signing-key backups. Preserve each cosigner's recovery information and, if used, its exact optional passphrase. You need access to enough distinct signing keys to meet the threshold.
• The complete wallet configuration. Preserve every cosigner's extended public key, the threshold, derivation paths (the rules for locating keys) and script type (the form of the wallet's spending conditions). A wallet descriptor—a structured description of those conditions and public keys—or an appropriate wallet configuration export can record this information. Check what the chosen export actually contains.

For a 2-of-3 wallet, recovery requires enough private signing keys to meet the threshold and public information for all three cosigners. Keep a verified copy of the complete configuration with each separately stored signing backup.

A public-only configuration cannot sign a payment by itself, but it can reveal the wallet's addresses, balance and transaction history. Protect it from disclosure, alteration and loss. Verify its public keys against the originating devices, just as you do during setup.

Your signing backups require stricter secrecy. Keep recovery words and microSD backups private and offline. Never enter recovery words into a computer, phone, website, support chat or AI tool. Enter them only directly on a trusted compatible hardware wallet during recovery. See BitBox backup options and their protection requirements.

What should you check when receiving and spending?

Receiving bitcoin

Use a hardware wallet that checks the receiving address against your verified multisig configuration. Compare the full address you share or paste with the device display. Where a device does not remember the configuration, the required cosigner checks must be repeated; follow the verified procedure for that particular setup.

Spending bitcoin

Check the intended multisig account, full recipient address, amount and fee on the signing devices. The setup must also verify that change—bitcoin returned to you after a payment—belongs to the same intended wallet, with the correct cosigners and threshold. Do not approve an unexplained output or warning on the assumption that it is change.

For technical examples of receiving-address and change-output attacks, see our 2019 article on the pitfalls of multisig with hardware wallets. The vendor-specific findings are historical, rather than a comparison of current products.

Testing and recovery

A small successful payment can help you learn the workflow, but it does not prove that the setup or its backups are correct. Malicious software could allow a test to succeed and interfere later. Plan a recovery rehearsal using the configuration and backups without deleting your originals, resetting funded devices or entering wallet secrets into software.

How BitBox multisig registration helps

BitBox supports Bitcoin multisig through compatible third-party wallet software. The software coordinates the wallet and transactions, while the BitBox holds its signing keys and asks you to approve relevant details on the device. See compatible third-party wallets for integration options.

During registration, BitBox presents these details for confirmation:

• The network and signing threshold, such as Bitcoin 2-of-3.
• The account name.
• The script type and account derivation path.
• Every cosigner's extended public key, identifying its own key as belonging to the connected device.

BitBox checks that its designated public key belongs to the currently unlocked wallet. After confirmation, it stores the account name and a cryptographic hash of the configuration. The hash lets it recognize the approved configuration when checking receiving addresses and transactions; it is not a recoverable copy of the configuration.

Registration preserves what you approved, so the initial cosigner verification remains essential. Check the expected account when using it, and retain both your signing backups and the complete verified wallet configuration.

Our illustrated blog walkthroughs show multisig setup with Sparrow Wallet, Electrum and Specter Desktop. These guides were published in 2020–2022, so screens and workflows may differ today. Apply the independent cosigner checks explained above: keys shown by the computer or on an unchecked printout are not a trusted reference.

If a public key, wallet name, address or transaction detail differs from your verified records, stop before receiving funds or signing. For an unexpected BitBox warning, contact BitBox Support with the warning text and your app and firmware versions. Never send recovery words, wallet backups, private keys, passwords or passphrases.