Module 2: Wallets, Custody, and Security
Advanced Custody: Multisig, Smart Accounts, and Inheritance
Chapter 13 of 14 · about 7 minutes
13.1 One secret is a single point of failure
Everything in this module so far has revolved around one fact: a single seed phrase controls everything. Lose it, and your funds are gone. Expose it, and your funds are taken.
Hash had been holding crypto for years and finally explained the setup behind it. "For most of my savings, there's no single secret that can move the money. I need two out of three keys, kept in three different places. If I lose one, I'm fine. If someone steals one, they're stuck."
This chapter covers custody setups that remove the single point of failure: multisig wallets, smart accounts, and the related problem of inheritance. These are more advanced, so treat this chapter as a map of what's possible when your holdings grow.
13.2 Multisig: several keys, one wallet
A multisig (multi-signature) wallet requires approval from several keys before a transaction can happen. It's described as M-of-N: M approvals needed out of N total keys.
Think of a bank vault that needs two managers turning their keys at the same time. No single manager can open it alone, and if one manager is on holiday, the other two can still open it together.
The most common personal setup is 2-of-3. Here's Hash's arrangement:
| Key | Where it's kept |
|---|---|
| Key 1 | Hardware wallet at home |
| Key 2 | Hardware wallet in a safe deposit box |
| Key 3 | Hardware wallet held by a trusted family member, or a professional key-holding service |
And here's what happens in different scenarios:
| Scenario | Single seed phrase wallet | 2-of-3 multisig |
|---|---|---|
| One device or backup is lost | Lost if it was the only backup | Safe: two keys remain, and the lost key can be replaced |
| One key is stolen | Funds stolen | Safe: the thief needs a second key |
| A fire destroys everything at home | Lost if backups were only at home | Safe, if keys are in separate locations |
| Owner passes away | Family may have no access | Family can recover with two keys, if they know how |
On Bitcoin, multisig is built into the protocol. On Ethereum and EVM networks, multisig wallets are smart contracts. Many organisations, project treasuries, and businesses use multisig wallets to manage large amounts, so that no single person can move funds alone.
13.3 Multisig isn't magic
Node, as usual, looked for the weak spot. "What can go wrong?"
"Plenty, if you set it up badly," said Hash.
Keys that aren't really independent. In March 2022, attackers stole over $600 million from the Ronin bridge, which required 5 of 9 validator signatures. Several of those keys were effectively controlled by the same organisation, so compromising one organisation gave attackers most of what they needed. A multisig is only as strong as the independence of its keys.
Signers who don't read. As Chapter 6 described, the 2025 Bybit theft involved a multisig. Several signers approved a malicious transaction because the interface they used had been compromised and showed them something that looked routine. Multisig protects against a single stolen key, not against every signer being deceived in the same way.
Complexity. Setting up and using multisig takes more steps. Mistakes in setup, or forgetting how to use it, can lock you out. You also need to back up the wallet's configuration, such as the list of all participating keys, not just the individual seed phrases. Without it, recovery can be difficult.
Smart contract risk. On EVM networks, a multisig wallet is a smart contract, so its security depends on the contract's code. Well-established multisig contracts have long track records, which matters.
13.4 Smart accounts
Chapter 2 introduced smart account wallets: accounts that are smart contracts, rather than being controlled directly by a single private key. Because they're programmable, they can build security rules into the account itself.
| Feature | What it does | How it helps |
|---|---|---|
| Social recovery | Trusted contacts or devices can help restore access if you lose your key | Removes the "lose one seed phrase, lose everything" problem |
| Spending limits | Caps how much can be moved in a day without extra approval | Limits damage if a key is compromised |
| Multiple signers | Requires extra approval for large transactions | Combines everyday convenience with multisig protection |
| Session keys | Gives an application limited, temporary permissions | Lets you use applications without signing every action, within boundaries |
| Batching | Combines several actions, like approve and swap, into one transaction | Fewer signatures, fewer lingering approvals |
| Gas sponsorship | Lets fees be paid in other tokens or by an application | Avoids getting stuck without the native gas coin (Chapter 9) |
| Time delays | Adds waiting periods before large or unusual transactions | Gives you time to cancel if something is wrong |
Ethereum has added standards that make smart accounts more widely available, including the 2025 upgrade mentioned in Chapter 7, which lets regular accounts adopt smart account features. As that chapter warned, the same power can be abused if you approve a delegation to a malicious contract.
"So smart accounts could make seed phrases less scary?" Mint asked.
"That's a big part of the goal," said Hash. "Self-custody that's forgiving, without handing your keys to a company. It's still maturing, but it's one of the most important directions in wallets."
13.5 Splitting backups properly
Chapter 4 warned against cutting a seed phrase in half. The proper alternatives are:
Shamir backups, supported by some hardware wallets, which split a secret into several shares where, for example, any 2 of 3 shares can recover it, but any single share reveals nothing.
Multisig, where each key is a full, independent seed phrase, and several are needed to move funds.
The difference: with a Shamir backup, there's still a single secret when the wallet is in use, just backed up in pieces. With multisig, there's never a single secret at all.
13.6 Inheritance
Chapter 4 introduced the inheritance problem. Advanced custody makes structured solutions possible.
Multisig with a trusted party. In a 2-of-3 setup, a family member or a lawyer holds one key. While you're alive, they can't move funds without a second key, which you control. If something happens to you, they can combine their key with one of yours, following instructions you've left.
Professional key holders. Some services hold one key in a multisig as a backup, without being able to move funds alone, and follow agreed procedures for inheritance.
Time-based recovery. Some smart accounts allow a designated recovery address to take control only after the account has been inactive for a set period, such as a year. If you're active, nothing happens. If you're not, your heir can recover access.
Whatever method you use, the human part matters most: clear, simple written instructions, someone who knows where to find them, and regular reviews.
13.7 Is advanced custody right for you?
| Situation | Suggested approach |
|---|---|
| Learning, small amounts | A single well-backed-up software wallet |
| Meaningful savings | Hardware wallet with a solid backup, possibly with a passphrase |
| Large holdings | Consider 2-of-3 multisig or a smart account with recovery and limits |
| Shared or business funds | Multisig with independent signers and clear procedures |
| Concern about inheritance | Multisig with a trusted party, professional service, or time-based recovery |
"Don't jump to multisig on day one," said Hash. "It adds complexity, and complexity causes its own mistakes. Learn the basics first, then upgrade when your holdings justify it."
13.8 Try it yourself
On a testnet, create a multisig or smart account wallet using a well-known provider that supports test networks. Set it up as 2-of-3 using three different testnet wallets you control. Send test funds into it, then make a transaction that requires two of the three signatures.
Afterwards, write down everything you'd need to recover this wallet if you lost one of the keys. That list is your multisig backup plan.
Key takeaways from this chapter
- A single seed phrase is a single point of failure. Advanced custody can remove it.
- Multisig wallets require M-of-N approvals. A 2-of-3 setup survives one lost or stolen key.
- Multisig keys must be truly independent, and every signer must still read what they approve.
- Back up the multisig configuration as well as each key.
- Smart accounts add programmable protections like social recovery, spending limits, batching, and time delays.
- Shamir backups split one secret safely. Multisig avoids having a single secret at all.
- Multisig and smart accounts enable structured inheritance, but clear human instructions are still essential.
- Upgrade to advanced custody when your holdings justify the added complexity.