Multisig custody and inheritance

Wonder

1. Why does losing a key and its backup end a single-signature wallet, while a multisig wallet can survive the loss?
2. How can a custodian hold one key to assist with recovery while the owner retains effective control over the funds?
3. What specific data, beyond the seed phrases themselves, is required to recover a multisig wallet if all devices are lost?

Explore

Part IMultisig custody

1. A standard single-signature wallet relies on one private key. If that key is stolen, the thief can take everything; if the key and all its backups are lost, the coins are gone. One secret is a single point of failure. Multi-signature setups distribute this risk by requiring multiple distinct keys to authorize any transaction.
2. In a common 2-of-3 configuration, three private keys are generated across separate devices, often from different manufacturers, and stored in different physical locations. Any two of these keys can co-sign a transaction. If one device is lost or stolen, the remaining two still control the funds, while a single stolen key cannot move the funds on its own.
3. Collaborative custody formalizes this distribution for institutions and high-net-worth individuals. A custodian holds one key to provide recovery services and operational support, while the owner retains two keys. This structure allows for professional assistance without ceding unilateral control; if the custodian fails or is compromised, the owner’s two keys remain sufficient to move the assets.
4. Recovery from total device loss requires more than just seed phrases. The wallet configuration—specifically the extended public keys (xpubs) of all cosigners and the script type—is essential for reconstructing the addresses. Without this metadata, the seeds alone cannot generate the correct receiving addresses. Recovery requires these xpubs or an output descriptor, so they must be backed up alongside the seeds.
5. The trade-offs involve complexity and cost. Managing three keys increases operational overhead for daily use and inheritance planning. Transactions with larger scripts consume more bytes in the blockchain, resulting in higher network fees compared to single-signature transactions. Taproot can cut this cost when keys are aggregated with protocols such as MuSig2, so a cooperative spend looks like a single signature; most multisig wallets still use script-based P2WSH, and the operational complexity remains.
6. Multisig is not a guarantee against all risks. The 2016 Bitfinex hack saw approximately 120,000 BTC stolen from a multisig arrangement with BitGo. Bitfinex held two of the three keys, and BitGo’s service co-signed automatically under Bitfinex’s settings, so an attacker inside Bitfinex’s systems could meet the threshold. About 94,000 BTC was recovered in 2022. Multisig protects only as well as the independence of its keys.

Part IIInheritance planning

7. Bitcoin custody presents a fundamental tension: the secrecy required to protect funds from theft renders recovery impossible for heirs. If a key holder dies or becomes incapacitated without sharing access details, those satoshis are lost forever. This is not theoretical; it is the primary reason for ‘survivability’ planning in digital asset management. Analysts estimate that millions of coins have been lost to lost keys of all kinds, deaths among them.
8. Bitcoin’s script engine allows logic that triggers under specific conditions to be encoded. A Miniscript descriptor such as `wsh(or_d(pk(@0), and_v(v:multi(2,@1,@2,@3), older(65535))))` defines a wallet where a single key (`@0`) can spend immediately, or two of three other keys (`@1`, `@2`, `@3`) can spend after 65,535 blocks have elapsed. The owner’s key can spend at any time; the heirs’ path opens only after the delay. (Wallets display such policies with placeholders like @0 for the keys.)
9. The number 65,535 in that script represents a specific duration. At roughly ten minutes per block, 65,535 blocks, the maximum for a block-based relative timelock, is about 455 days. This is an ‘inheritance lock.’ Because it is a relative timelock, the clock starts when the coins are confirmed, not when the holder disappears. The holder must move the coins periodically to keep the heirs’ path closed; once the timelock expires, the heirs can spend.
10. Multisignature schemes distribute control among trusted parties, such as a relative and a lawyer specializing in digital assets. In a 2-of-3 setup, no single person holds full power to move funds unilaterally after the timelock expires; two signatures are required. This mirrors traditional estate planning where an executor works with beneficiaries. Whoever acts as executor needs enough technical guidance to carry out the plan.
11. Plans usually pair the technical setup with a letter of instruction that explains what exists and how to use it, without containing the secrets themselves. Rules vary by jurisdiction: in many places a will becomes a public document after probate, so seed phrases do not belong in one. A cautionary case of concentrated control is QuadrigaCX, a Canadian exchange whose founder, Gerald Cotten, died in December 2018, leaving customers owed about C$215 million; regulators later found the losses stemmed mainly from his fraud, which a sole key-holder made easy to hide. Professional legal advice is commonly recommended.
12. Planners often rehearse before relying on a plan: they set up the same policy on testnet or with a trivial amount, let the timelock expire, and confirm that the heirs’ keys can actually sign, so the technical setup is known to match the legal intent. Wallets built around Miniscript, such as Liana, are designed for exactly this kind of time-locked recovery.

Key facts

Exercise nine, six, three, one

Fact check

Dates, figures and claims checked against the published sources listed below.

• A. M. Antonopoulos & D. A. Harding, Mastering Bitcoin, 3rd ed. (2023), ch. 7
• BIP380: Output Script Descriptors General Operation
• Bitfinex hack public disclosures (2016)
• Chainalysis, Lost Coins Estimates (2020)
• Ontario Securities Commission, Report on QuadrigaCX (2020)
• Liana Wallet Documentation