MSTR Cat

Trust Law/Level IX · Trusts on chain/9.1 Digital assets in trust/Lesson 3

Multisig and inheritance planning

How m-of-n multisignature arrangements and blockchain time-locks can support inheritance planning, what can go wrong, and how heirs can be guided without exposing secrets.

Education, not legal advice. Trust law changes from country to country and state to state, and the right structure depends on your situation. Anything you sign should be drafted or reviewed by a qualified lawyer where you live.

The lean path

The cheapest, lowest-tax, simplest and most private route the law allows, best first. Each step names the rule it rests on and the condition that keeps it lawful.

  1. Zero-fee start: a 2-of-3 multisig with keys held by the owner, a trusted relative and a separate backup location means one lost or stolen key neither locks nor moves the coins. Catch: any two key holders can act together, so choose them carefully.
  2. Pair it with a free letter of wishes or instruction listing wallets, key holders, wallet software and contacts, but no seed phrase. Catch: a letter of wishes binds no one, so the will or trust must name the same people who hold the keys.
  3. For a do-it-yourself dead-man switch, a relative time-lock (BIP 68 and BIP 112, active since July 2016) opens an heirs’ recovery path only if the coins sit unmoved. Catch: the owner must refresh the coins before expiry, paying a network fee each time.
  4. Store the wallet configuration, each key’s public information and the spending rules with the instructions, because restoring a multisig needs more than the keys. Catch: if too few key holders remain to meet the threshold, no court can move the coins.

MaterialsBIP 65 (OP_CHECKLOCKTIMEVERIFY), free in the bitcoin/bips repository on GitHubA simple diagram of a 2-of-3 multisig arrangement, showing who holds each keyLesson 9.1.2, on keys and custody, and lesson 9.1.5, on RUFADAA

Wonder

  1. How does a 2-of-3 multisig keep any one key holder from moving funds alone?
  2. How can a time-lock open a recovery path only if the owner stops acting?
  3. How can heirs be told what exists and whom to contact without revealing any secret?

Explore

  1. Coins controlled by a single key pass with that key: whoever has it can move them, and if nobody has it they cannot be moved. Inheritance planning for such assets therefore has two sides. The legal side, a will or trust, says who should receive the assets (lesson 9.1.5 covers fiduciary access in the US). The technical side decides who can actually sign. Multisig and time-locks are two ways to shape the technical side. This lesson explains the concepts at a general level, gives no code and recommends no product or provider.
  2. A multisignature (multisig) arrangement requires m signatures out of n keys, written m-of-n, to move funds. In a 2-of-3 arrangement, any two of three keys can sign, so one lost key does not lock the funds and one stolen key cannot move them. For inheritance, the keys might be split among the owner, a family member or trustee, and a professional key agent. The design has trade-offs: any two key holders can move the funds together without the third, and if two keys are lost the funds are stuck. Since Taproot (2021), some cooperative multisig spends can look like single-signature spends.
  3. A time-lock makes funds unspendable until a set block height or time. Every Bitcoin transaction has an nLockTime field, which stops that transaction from being mined before the stated point; but it binds only that transaction, so the coins can still be spent another way first. OP_CHECKLOCKTIMEVERIFY (CLTV), proposed in BIP 65 and activated in December 2015, puts an absolute time-lock into the coins’ own locking script. Relative time-locks (BIP 68 and BIP 112, activated in July 2016) count from when the coins were confirmed. These are consensus rules enforced by the network, not by any company.
  4. Time-locks can act like a dead-man switch. A wallet can be set up so that the owner can spend at any time, while a recovery path, such as the heirs’ keys or a 2-of-3 group, becomes usable only after a relative time-lock runs out. While alive, the owner keeps the recovery path closed by moving the coins to a fresh output before the lock expires, which restarts the clock. If the owner dies or loses capacity and stops doing so, the lock expires and the recovery keys can sign. Mistakes in setup can open the path too early or keep funds locked longer than intended.
  5. Each design carries risks. Key holders can die, lose capacity or lose their keys, and if too few remain to reach the threshold, the funds are stuck. Key holders can collude: in a 2-of-3 arrangement, any two can move the funds without the third. A professional key agent may stop operating. Heirs may not know the arrangement exists, or which wallet software and settings are needed to rebuild it. Restoring a multisig wallet generally needs more than the keys: the public information about every key and the spending rules must also be kept.
  6. A letter of instruction can guide a trustee or heirs without exposing secrets. It can list which assets and wallets exist, what kind of arrangement protects them, who holds each key or device, which professionals to contact and where the will or trust is, without recording any private key or seed phrase. A will may become public after probate, so it is a poor place for secrets. If the legal documents and the technical setup point to different people, those who can sign may not be those entitled to the assets, which can lead to disputes.

Key facts

  • In an m-of-n multisig arrangement, m signatures out of n keys are needed to move funds; in a 2-of-3 arrangement, any two of three keys can sign.
  • In a 2-of-3 arrangement, one lost key does not lock the funds, but any two key holders can move them without the third.
  • nLockTime stops a particular transaction from being mined before a set block height or time, but binds only that transaction.
  • OP_CHECKLOCKTIMEVERIFY (BIP 65), activated in December 2015, enforces an absolute time-lock in the coins’ locking script.
  • A relative time-lock can open a recovery path only if the owner has not moved the coins for a set period, acting like a dead-man switch.
  • A letter of instruction can say what exists and whom to contact without recording any private key or seed phrase.

Exercise nine, six, three, one

9CollectList up to 9 elements or risks of a multisig or time-lock inheritance arrangement described in this lesson or a source you are reading (some sources give fewer), such as the key threshold, who holds each key, a time-lock, a lost key or a missing instruction.
6ClusterSort them into 6 categories: key thresholds, key holders, time-locks, death or incapacity of a key holder, collusion, and instructions and records.
3DistillReduce the 6 categories to 3 groups: what lets the right people sign, what could stop anyone from signing, and what could let the wrong people sign.
1CrystallizeWrite 1 sentence explaining, in your own words, how a time-lock can act like a dead-man switch for inheritance.

Fact check

Dates, figures and claims checked against the published sources listed below.

Open in the interactive academy →

PT ES ZH JA KO RU DE FR MS