HomeLearning pathMulti-sig walletsSmart contract auditingPhishing awarenessVerify team member
Start learning

Multi-signature wallets for treasury management

Eliminate single points of failure from your organization's fund management. This guide covers everything from multi-sig fundamentals to advanced operational security practices used by leading protocols.

25 min read
Updated February 2025
Essential

What is a multi-sig wallet

A multi-signature (multi-sig) wallet is a smart contract wallet that requires authorization from multiple private keys before a transaction can be executed. Unlike a standard externally owned account (EOA) where a single private key controls all funds, a multi-sig distributes control across several key holders, known as signers.

The core mechanism is called m-of-n signing, where n represents the total number of signers added to the wallet and m represents the minimum number of approvals required to execute a transaction. For example, in a 3-of-5 multi-sig, there are 5 authorized signers, but any 3 of them must approve a transaction before it can proceed.

How m-of-n Signing Works

When a signer initiates a transaction, it becomes a proposal that other signers can review. Each signer independently verifies the transaction details -- recipient address, token amount, contract interaction -- and either approves or rejects. Once the required threshold of m approvals is reached, any signer can execute the transaction on-chain. The smart contract enforces these rules at the protocol level, making them tamper-proof.

Key properties of multi-sig wallets

  • Threshold enforcement: The minimum number of approvals is enforced by the smart contract itself, not by any external service or off-chain process. This cannot be bypassed.
  • Signer independence: Each signer holds their own private key. No single signer can access or reconstruct another signer's key.
  • On-chain transparency: Every proposal, approval, and execution is recorded on the blockchain, creating a full audit trail.
  • Configurable governance: The threshold and signer list can be modified through the same multi-sig process, requiring existing signers to approve changes.
  • Module extensibility: Modern multi-sig implementations like Safe support modules that can add functionality such as spending limits, recovery mechanisms, and automated recurring payments.

Multi-sig vs. MPC wallets

Multi-sig wallets are sometimes confused with Multi-Party Computation (MPC) wallets. While both distribute control, they differ fundamentally. In a multi-sig, each signer holds a complete private key and the approval logic lives in a smart contract on-chain. In an MPC wallet, a single private key is split into fragments distributed among parties, and the signing happens off-chain through a cryptographic protocol. Multi-sig is generally preferred for treasury management because the approval process is transparent and verifiable on-chain, and the smart contract logic can be audited independently.

Why multi-sig for treasury

The primary reason to adopt multi-sig for treasury management is to eliminate single points of failure. When millions or even billions of dollars are controlled by a single private key, any compromise of that key -- whether through hacking, phishing, insider threat, or physical coercion -- results in total, irreversible loss of funds.

The single key problem

A standard EOA wallet has exactly one attack surface: the private key. If an attacker gains access to it through any means, they have unrestricted, immediate access to every asset in the wallet. There is no delay, no approval process, and no way to reverse the transaction once it is confirmed on-chain. For an organization managing significant treasury funds, this is an unacceptable risk profile.

Case Study: The Ronin Bridge Hack ($625M)

In March 2022, the Ronin Network bridge was exploited for approximately $625 million in ETH and USDC. The bridge used a 5-of-9 validator multi-sig scheme, but the attacker (later attributed to North Korea's Lazarus Group) was able to compromise 5 of the 9 private keys. Four keys were held by Sky Mavis employees whose infrastructure was breached through a social engineering attack involving a fake job offer PDF with embedded malware. A fifth key was compromised through an Axie DAO node that had granted Sky Mavis temporary signing authority that was never revoked. The breach went undetected for nearly a week. This incident demonstrates that a multi-sig is only as strong as its key management practices -- concentrating too many keys within a single organization and failing to revoke temporary access destroyed the security model.

Case Study: Wintermute Hot Wallet Exploit ($160M)

In September 2022, Wintermute's hot wallet was drained of approximately $160 million. The exploit targeted a vanity address generated using the Profanity tool, which had a known vulnerability that allowed private key recovery. The compromised address was a single EOA used as an admin on Wintermute's DeFi vault. Because there was no multi-sig protection on this critical admin function, the attacker gained full control of the vault with just one key. A multi-sig requirement on the vault's admin role would have completely prevented this exploit, as compromising one key would not have been sufficient.

What multi-sig protects against

  • Single key compromise: An attacker must compromise multiple independent keys simultaneously, exponentially increasing the difficulty of an attack.
  • Insider threats: No single team member can unilaterally move treasury funds, preventing rogue employees or compromised insiders from draining assets.
  • Phishing attacks: Even if one signer falls victim to a phishing attack that compromises their key, the remaining signers serve as a safety net.
  • Physical coercion: With geographically distributed signers, physically coercing the required threshold of signers becomes impractical.
  • Operational mistakes: Multi-signer review acts as a natural double-check on transaction details, catching errors in addresses, amounts, or contract calls before execution.
Industry Standard

Leading DeFi protocols like Uniswap, Aave, and Compound all use multi-sig wallets (often combined with timelocks and governance systems) to manage their treasuries. The Ethereum Foundation itself uses a multi-sig for fund management. If your organization holds crypto assets of any significant value, a multi-sig is not optional -- it is a baseline security requirement.

Choosing your configuration

Selecting the right m-of-n configuration is a balancing act between security and operational efficiency. A higher threshold provides better protection but requires more coordination to execute transactions. A lower threshold is more operationally convenient but offers fewer safeguards.

ConfigurationSecurity LevelOperational OverheadBest ForRisk Tolerance
2-of-3ModerateLowSmall teams (2-5 people), startups, lower-value treasuriesTolerates 1 compromised or unavailable key
3-of-5HighModerateMid-size teams (5-20 people), DAOs, treasuries over $1MTolerates 2 compromised or unavailable keys
4-of-7Very HighHighLarge organizations, protocol treasuries, funds over $50MTolerates 3 compromised or unavailable keys
5-of-9MaximumVery HighCritical infrastructure, bridge contracts, $100M+ fundsTolerates 4 compromised or unavailable keys

Recommendations by organization size

Startups and small teams (2-5 members): A 2-of-3 configuration is a practical starting point. Assign keys to the CEO/founder, CTO/technical lead, and a trusted third party such as a legal counsel or advisory board member. This provides basic protection while keeping operations nimble. Upgrade to 3-of-5 as soon as the team and treasury grow.

Growing organizations (5-20 members): A 3-of-5 is the most widely recommended configuration and is considered the industry standard for organizations managing meaningful treasury assets. It provides a strong security guarantee while remaining operationally feasible. Distribute keys across departments -- for example, one to the CEO, one to the CFO, one to the CTO, one to a board member, and one to a security officer.

Large organizations and protocols (20+ members): Consider a 4-of-7 configuration. With seven signers, you have significant redundancy, and the requirement of four approvals makes it extremely difficult for an attacker to accumulate enough keys. Some organizations implement a tiered system, using a 3-of-5 for routine operational spending and a 4-of-7 for treasury movements above a defined threshold.

The Golden Rule

Your threshold (m) should always be greater than half of the total signers (n). A 2-of-5, for example, is dangerously permissive because an attacker only needs to compromise 2 keys out of 5. Additionally, always have at least n - m + 1 backup recovery plans for lost keys, since you need at least m available signers to make any changes to the wallet, including adding new signers.

Setting up Safe{Wallet}

Safe (formerly Gnosis Safe) is the most widely adopted multi-sig wallet in the Ethereum ecosystem. It secures over $100 billion in assets across hundreds of chains and is used by leading protocols, DAOs, and institutions. This section walks through deploying a new Safe multi-sig step by step.

Prerequisites

  • Each signer must have their own Ethereum wallet (hardware wallet strongly recommended)
  • The deploying signer needs enough ETH to cover the Safe creation gas fee
  • Collect the Ethereum addresses of all signers beforehand
  • Agree on the m-of-n configuration before starting

Step 1: navigate to Safe{Wallet}

Go to app.safe.global in your browser. Always verify the URL carefully -- phishing sites frequently impersonate Safe. Bookmark the official URL and never access it through search engine links or links shared in messages.

Verify the URL

The only legitimate Safe application URL is app.safe.global. Watch for lookalike domains like app-safe.global, safe-app.global, app.safe.finance, or any domain that adds extra words. Check for the SSL certificate and confirm it is issued to the correct domain. Consider using a DNS-over-HTTPS resolver to prevent DNS spoofing.

Step 2: connect your wallet

Click "Create New Safe" and connect your wallet. If you are using a hardware wallet (which you should be), ensure it is plugged in and unlocked. Safe supports WalletConnect, MetaMask, Ledger, Trezor, and most major wallet providers.

Step 3: select the network

Choose the blockchain network where you want to deploy the Safe. Most organizations start with Ethereum mainnet. If your treasury spans multiple chains, you will need to deploy separate Safe instances on each chain. Safe supports Ethereum, Polygon, Arbitrum, Optimism, BNB Chain, Avalanche, Gnosis Chain, and many others.

Step 4: name your Safe

Give your Safe a descriptive name. This name is stored locally in your browser, not on-chain, so choose something meaningful for your team such as "Metron Treasury" or "Protocol Revenue Fund." You can change this later.

Step 5: add signers (owners)

This is the most critical step. Add the Ethereum address of each signer. For each signer:

  1. Enter the signer's Ethereum address. Double-check every character. A wrong address here means someone unintended has signing authority, or a signer is locked out.
  2. Give each signer a human-readable name (e.g., "Alice - CEO - Ledger").
  3. Verify addresses through a secondary channel. For example, have each signer send you their address via a separate encrypted messaging platform, and cross-reference it against the address shown in their connected wallet.
// Example signer configuration for a 3-of-5 setup Signer 1: 0x71C7...4a2F // CEO - Ledger Nano X Signer 2: 0x8B3e...9c1D // CFO - Trezor Model T Signer 3: 0x2F9a...7e5B // CTO - Ledger Nano S Plus Signer 4: 0xA4d1...3f8C // Board Member - Ledger Nano X Signer 5: 0x6E2c...1b9A // Security Officer - Trezor Model T Threshold: 3 of 5 required to execute

Step 6: set the threshold

Choose how many signers must approve a transaction. For a 3-of-5 setup, set the threshold to 3. Remember the golden rule: the threshold should always be greater than half the total number of signers.

Step 7: review and deploy

Review all details carefully -- signer addresses, threshold, and network. Deploying the Safe is a blockchain transaction, so you will need to confirm it in your wallet and pay the gas fee. Once confirmed, your Safe contract is deployed and ready to receive funds.

Step 8: verify the deployment

After deployment, verify the Safe contract on a block explorer such as Etherscan. Confirm the list of owners and the threshold match your intended configuration. Share the Safe address with all signers and have each of them add the Safe to their own Safe{Wallet} dashboard.

Post-Deployment Checklist

After deploying your Safe, complete these steps: (1) Have every signer add the Safe to their dashboard and verify the owner list. (2) Send a small test transaction to confirm the full signing flow works. (3) Document the Safe address, the full list of signers, and the threshold in your organization's secure internal records. (4) Set up transaction monitoring and alerting (see Operational Security section below).

Key management best practices

Your multi-sig is only as strong as the keys that control it. The Ronin Bridge hack proved that a multi-sig with poor key management is barely better than a single-key wallet. This section covers the essential practices for keeping signer keys secure.

Hardware wallets are non-negotiable

Every signer on a treasury multi-sig must use a dedicated hardware wallet. Software wallets (MetaMask, Rabby, etc.) store private keys on internet-connected devices, making them vulnerable to malware, browser exploits, and clipboard hijacking. Hardware wallets keep keys in a secure element that never exposes the private key to the host computer.

  • Each signer uses a dedicated hardware wallet (Ledger or Trezor)
  • Hardware wallets are purchased directly from the manufacturer, never secondhand
  • Each signer uses a unique, dedicated derivation path or account for the multi-sig
  • Hardware wallet firmware is kept up to date
  • Hardware wallets are stored in secure, tamper-evident locations when not in active use

Geographic distribution

Signers should be distributed across multiple physical locations, and ideally across multiple jurisdictions. This protects against:

  • Physical threats: An attacker cannot physically coerce multiple signers if they are in different cities or countries.
  • Natural disasters: If signers and their hardware wallets are all in the same office, a fire, flood, or earthquake could destroy the required threshold of keys simultaneously.
  • Jurisdictional risk: Government seizure or legal actions in one jurisdiction cannot freeze the entire treasury if signers are distributed across multiple legal frameworks.
  • Network infrastructure: Localized internet outages or infrastructure failures will not prevent the required threshold of signers from accessing their keys.
Distribution Example

For a 3-of-5 multi-sig, distribute signers across at least 3 different cities. For example: Signer 1 in New York, Signer 2 in London, Signer 3 in Singapore, Signer 4 in Zurich, and Signer 5 in Dubai. This ensures that no single geographic event or jurisdictional action can compromise the threshold of keys needed.

Backup procedures

Each signer is responsible for securely backing up their seed phrase. The organization should also have a recovery plan that accounts for signers becoming permanently unavailable (departure from the company, incapacitation, or death).

  • Seed phrase storage: Use metal seed phrase backups (steel plates or capsules) stored in secure locations such as bank safe deposit boxes. Never store seed phrases digitally -- no photos, no cloud storage, no password managers.
  • Redundant backups: Each signer should maintain at least two geographically separated copies of their seed phrase backup.
  • Dead man's switch: Establish a documented legal process for accessing a signer's backup in case of incapacitation. This might involve sealed instructions with a law firm that are only opened under specific conditions.
  • Regular verification: Signers should periodically verify that their hardware wallet functions correctly and that their backup seed phrase matches by deriving the address from the backup and comparing it to the known signer address.
Never Do This

Never allow a single person or entity to hold backups for multiple signer keys. If your company's HR department has a "secure vault" containing seed phrase backups for 3 of your 5 signers, you have effectively reduced your multi-sig to a single point of failure. Each signer must independently manage their own key security.

Signing policies

Technical controls alone are insufficient. Your organization needs documented policies that govern how the multi-sig is used, what transactions require elevated review, and how edge cases are handled.

Transaction limits and tiered approvals

Not all transactions carry the same risk. A $500 operational expense should not require the same level of scrutiny as a $5 million treasury rebalance. Implement tiered approval policies based on transaction value:

Transaction ValueRequired ApprovalsTimelockAdditional Requirements
Under $10,000Standard threshold (3-of-5)NoneStandard review process
$10,000 - $100,000Standard threshold (3-of-5)24-hour delayWritten justification required
$100,000 - $1,000,000Elevated threshold (4-of-5)48-hour delayBoard notification, written justification
Over $1,000,000Maximum threshold (5-of-5)72-hour delayBoard approval, legal review, written justification

Timelock delays

A timelock is a mechanism that introduces a mandatory waiting period between when a transaction is approved and when it can be executed. Timelocks serve as a critical safety net: if a transaction is approved through compromised keys or under duress, the delay provides a window for the compromise to be detected and the transaction to be cancelled.

Timelocks can be implemented through Safe modules such as the Delay Module, or through dedicated timelock contracts like those used in governance systems (e.g., OpenZeppelin's TimelockController). For treasury management, implement timelocks on any transaction above your routine operational threshold.

// Example: OpenZeppelin TimelockController integration // Minimum delay of 48 hours for high-value transactions contract TreasuryTimelock is TimelockController { constructor( uint256 minDelay, // 172800 (48 hours in seconds) address[] proposers, // Multi-sig address address[] executors, // Multi-sig address address admin // address(0) - no admin ) TimelockController(minDelay, proposers, executors, admin) {} }

Escalation procedures

Define clear escalation procedures for different scenarios:

  1. Routine transactions: Any signer can propose. Other signers review and approve through the normal Safe interface. No escalation needed.
  2. High-value transactions: Proposer must submit a written request through the organization's internal system (e.g., Notion, Jira, or a dedicated governance tool) with full justification. All signers are notified via a dedicated communication channel.
  3. Emergency transactions: In case of an active exploit or time-sensitive situation, invoke the emergency procedure (see Operational Security below). This may temporarily lower time requirements but should never lower the signer threshold.
  4. Disputed transactions: If a signer believes a proposed transaction is fraudulent or inappropriate, they should immediately alert all other signers through the emergency communication channel and document their concerns. The transaction must not proceed until the dispute is resolved.
Social Engineering Warning

Attackers will attempt to exploit urgency. A common tactic is to create a fake emergency scenario ("We're being exploited! Sign this transaction immediately to save the funds!") to pressure signers into approving a malicious transaction without proper review. Your policy should explicitly state that urgency is never a reason to skip verification steps. Even under genuine time pressure, every signer must independently verify the transaction details before signing.

Operational security

Setting up a multi-sig is the starting point, not the finish line. Ongoing operational security practices are essential to maintain the integrity of your multi-sig over time as team members change, threats evolve, and the organization grows.

Signer rotation

Signer rotation is the process of replacing one or more signers on the multi-sig over time. This should be done:

  • When a signer leaves the organization: This is the most critical trigger. The moment a signer departs -- whether through resignation, termination, or any other separation -- their key must be removed from the multi-sig. Do not wait. Initiate the signer removal transaction immediately.
  • On a regular schedule: Even without personnel changes, rotate at least one signer every 6-12 months. This limits the window of exposure for any potentially compromised key and ensures that the rotation process is well-practiced.
  • After any suspected compromise: If there is any indication that a signer's key may have been compromised -- suspicious activity, a security incident on a signer's device, a phishing attempt that may have succeeded -- rotate that key immediately.
  • After organizational changes: Mergers, restructurings, or changes in leadership should trigger a review of the signer list to ensure it still reflects the appropriate set of trusted individuals.
// Signer rotation process via Safe{Wallet} // This is a multi-sig transaction itself, requiring existing threshold approval Step 1: Current signer proposes "Add new owner" transaction addOwnerWithThreshold(newOwnerAddress, threshold) Step 2: Required signers review and approve the new owner addition Step 3: Once executed, propose "Remove old owner" transaction removeOwner(prevOwner, oldOwnerAddress, threshold) Step 4: Required signers review and approve the removal // IMPORTANT: Always add the new signer BEFORE removing the old one. // Removing first could temporarily drop below the required threshold.

Emergency procedures

Document and rehearse emergency procedures for the following scenarios:

  • Active exploit detected: Establish a war room protocol. All signers are contacted through a pre-agreed emergency channel (not Discord or Telegram, which can be compromised -- consider a phone tree or Signal group). Assess the situation, and if necessary, move remaining funds to a pre-deployed emergency Safe with a different set of signers.
  • Signer key compromised: Immediately initiate a signer rotation to replace the compromised key. If the compromise could affect the threshold (e.g., 2 of 3 keys compromised in a 2-of-3), treat this as a full emergency: move all funds to a new Safe with entirely new signers.
  • Multiple signers unavailable: If enough signers become unavailable that the threshold cannot be met, invoke the dead man's switch or legal recovery process documented in your backup procedures. This scenario should be extremely unlikely if you have proper geographic distribution and redundant backups.
  • Safe contract vulnerability: While rare, if a vulnerability is discovered in the Safe contract itself, monitor official Safe communications channels for guidance. Do not attempt to self-migrate without coordination from the Safe team.
Emergency Drill

Run a simulated emergency drill at least once per quarter. This ensures all signers know the procedures, have working hardware wallets, and can be reached through the emergency communication channel. Document the drill results, including response times and any issues encountered. Treat these drills as seriously as you would a real incident.

Monitoring and alerting

Set up real-time monitoring on your Safe to detect unusual activity immediately:

  • Transaction monitoring: Use services like Tenderly, OpenZeppelin Defender, or Forta to monitor all transactions proposed to and executed from your Safe. Set up alerts for any transaction above your routine threshold.
  • Owner change alerts: Configure alerts for any proposal to add or remove owners, or to change the threshold. These are the most sensitive operations and should always be expected.
  • Balance monitoring: Track the total value held in the Safe. Unexpected decreases should trigger an immediate investigation.
  • Approval monitoring: Track when signers approve transactions. An approval from a signer at an unusual time or for an unexpected transaction is a red flag.
  • Real-time transaction alerts via Tenderly or OpenZeppelin Defender
  • Owner/threshold change notifications to all signers
  • Balance change alerts for movements over $10,000
  • Weekly security review of all Safe activity
  • Quarterly emergency drill conducted and documented
  • Annual comprehensive security audit of all operational procedures

Real-world transaction flow

The following diagram illustrates the complete lifecycle of a multi-sig transaction, from initial proposal through final execution. Each step involves independent verification and deliberate action by authorized signers.

Proposal
Review
Sign 1
Sign 2
Sign 3
Execute

Detailed flow breakdown

  1. Proposal: A signer creates a new transaction in the Safe interface, specifying the recipient, value, and data (for contract interactions). The transaction is submitted on-chain or stored off-chain in the Safe Transaction Service, depending on the configuration.
  2. Review: All signers are notified of the pending transaction. Each signer independently verifies the transaction details: Is the recipient address correct? Is the amount expected? Does the contract call match what was agreed upon? Signers should verify these details against the original request (e.g., an approved proposal in the governance system).
  3. Sign 1 (Proposer): The proposer signs the transaction, contributing the first approval toward the threshold.
  4. Sign 2: A second signer reviews the transaction independently and adds their approval. They should not simply trust that the first signer already checked -- every signer has a duty to verify independently.
  5. Sign 3 (Threshold Met): The third signer (in a 3-of-5 scenario) reviews and approves. With the threshold now met, the transaction is ready for on-chain execution.
  6. Execute: Any signer (or an authorized executor) submits the transaction to the blockchain. The Safe smart contract verifies that the required number of valid signatures has been collected before processing the transaction. The executor pays the gas fee.
Key Takeaway

Every step in this flow is an opportunity to catch errors, detect fraud, or prevent unauthorized transactions. The strength of a multi-sig is not just in the cryptographic requirements -- it is in the human review process that each signing step represents. Train your signers to treat every signing request as a security-critical action that demands their full attention and independent verification.

Back to HomeNext: Smart Contract Auditing