Are three keys three times as safe?
A multisignature (multisig) wallet requires a set number of keys, out of several, to approve a transaction. If two of three keys must sign, it is called a 2-of-3 setup. Because losing or leaking one key does not immediately put funds at risk, multisigs are widely used for DeFi treasuries and corporate holdings.
More keys do not automatically mean more safety. If the keys are stored in the same place, or the signers can all be fooled the same way, several can fail at once. This guide explains signing thresholds, how keys fail together, a hypothetical operating scenario, and how to check permissions and recovery procedures.
What a signing threshold means
Safe's documentation explains that its smart accounts require a threshold of owners to confirm a transaction before execution, providing a secure default without trusting additional contracts. Unlike an ordinary wallet, where one private key controls everything, a multisig is a smart contract that counts signatures and executes only when the condition is met.
The threshold balances security and convenience. A 2-of-3 setup keeps working if one key is lost, and a single stolen key cannot move funds alone. A 3-of-5 setup requires more keys to be compromised, but gathering three signers takes longer. A 1-of-N setup is effectively several single-key wallets and adds little security.
A hypothetical 2-of-3 scenario
The table shows situations a hypothetical team running a 2-of-3 multisig might face, and what happens in each.
| Situation | Healthy keys left | Can funds move? | Risk |
|---|---|---|---|
| One key lost | 2 | Yes, by the two remaining signers | Remaining keys become more critical |
| One key stolen | 2 | Not by the attacker alone | Stolen key must be replaced quickly |
| Two keys leaked from the same cloud backup | 1 | Yes, by the attacker alone | Funds can be drained |
| Two signers unreachable | 1 (usable) | No one can move funds | Assets are stuck |
A multisig's security depends less on the number of keys than on whether each key is stored and operated independently.
When signers fail together
Many signers sharing the same company laptops, the same cloud backup, or the same wallet app can be compromised in a single attack. And if signers approve out of habit without reading what they are signing, a malicious transaction can still reach the threshold.
Incidents have occurred in which multisig signers approved transactions after being shown a tampered interface. Ethereum.org's smart contract security documentation stresses verifying the signing process as well as designing access control. Signers should check transaction details on the hardware wallet's own screen, not only in the app.
Checking permissions and change history
Because a multisig is an on-chain contract, anyone can look up its owner list, threshold, and full history of transactions and configuration changes. If a DeFi project says its treasury is controlled by a multisig, you can check on the actual address how many signatures are required and whether owners changed recently.
Adding or removing owners and lowering the threshold are themselves multisig transactions. A sudden drop in the threshold, or most owners being replaced within a short period, is a warning sign. If changes pass through a timelock and take effect only after a delay, users have time to react.
Number of signers is not independence
Five signers, four of whom work for the same company, may move together under internal pressure. When judging how decentralized a project's control is, look at whether signers are independent of one another and whether their identities are known, not just how many there are.
Publishing every signer's identity can also make them targets for social engineering. Practices vary, but it should at least be possible to confirm that signers hold keys in different organizations on different devices.
Evaluating recovery as well
Whether you run a multisig yourself or rely on a service controlled by one, work through these checks.
- Look up the multisig address in a block explorer and record the number of owners, the threshold, and recent configuration changes.
- Confirm that each key is held independently, on different devices, in different places, by different people.
- Check that signers compare transaction details (target address, amount, function called) on the hardware wallet screen before approving.
- Document in advance how remaining signers would replace a lost or stolen key.
- Plan for several signers becoming unreachable so that funds cannot be locked permanently.
What a multisig does not solve
A multisig reduces single-key risk but does not prevent signer mistakes, collusion among signers, or bugs in the contracts the multisig controls. Risks in connected contracts remain.
The operating scenario above is hypothetical. When using or evaluating a multisig, rely on official documentation and on-chain records, checking how recent each one is, and focus on key independence and recovery procedures rather than the number of keys.