A multisig wallet is supposed to require several signatures per transaction — say, two out of three. In practice, plenty of exchangers break that rule on day one: the same set of devices sits in the same safe, controlled by the same person. Here are five mistakes that turn multisig into expensive theater, and what to do instead.
What multisig actually is, and why an exchanger needs it
Multi-signature means a wallet can't move funds with a single signature. You set a threshold in advance — say, 2-of-3 — and any two of the three key holders must sign together. Think of a bank safe deposit box that only opens when two different employees turn their keys at the same time; one person alone gets nowhere.
For an exchanger this isn't a luxury, it's insurance. A cashier's laptop gets hacked — without the second signature, funds don't move. A team member disappears overnight — the company doesn't lose access, as long as there are enough independent holders left. The catch is that the insurance itself often gets set up in a way that quietly disables it.
Mistake 1: all the keys sit with one person
The most common case: the owner holds two of three keys “for speed” — on a personal laptop and phone. On paper it's multisig. In practice it's a regular single-controller wallet, because no second, independent person is actually needed to move money.
If that laptop picks up an infostealer, the attacker gets both keys in one evening. Multisig doesn't protect against one person being compromised — it protects against one device or one point of failure being compromised. Those are not the same thing.
Mistake 2: no offboarding procedure for signers
A cashier or a CTO leaves, and their key stays an active signer. Six months later, someone who hasn't worked at the company in ages still has the technical ability to help authorize a transaction.
A working process looks different: the key gets rotated the same day someone leaves or changes role, with a backup signer already defined in advance — not improvised in a panic afterward.
Mistake 3: key backups sit next to each other
Splitting custody across several keys loses its point if the seed-phrase backups for all of them sit in the same office safe, or the same cloud folder “just in case.” A fire, stolen hardware, or one compromised admin account, and the whole setup collapses to a single key.
- Different physical locations for holders and for backups
- Separate access channels — not one shared cloud account holding every copy
- Dedicated cold storage for the reserve threshold that isn't used in day-to-day operations
Mistake 4: confusing multisig with MPC — and picking the wrong one
Multisig and MPC (multi-party computation) solve a similar problem in different ways, and the terms aren't interchangeable. Multisig uses several distinct keys, and the threshold is visible in the transaction or wallet structure itself. MPC mathematically splits a single key between parties and signs without ever assembling it in one place — from the outside it looks like an ordinary single-key signature.
Multisig is easier to verify independently: the structure is visible on-chain, and it has a long track record with open implementations. MPC is more compact and doesn't reveal the signing scheme to outsiders, but the quality of protection depends entirely on one vendor's implementation — where multisig is a protocol, MPC is somebody's software product, and that trust needs checking separately.
How to check your multisig actually protects anything
Taking “we have multisig set up” at face value isn't enough. Worth checking the setup in practice from time to time.
- Are key holders physically separated — different people, different devices, different locations
- Was the holder list updated after the last departure or role change
- Is the threshold high enough for the hot operational wallet (usually 2-of-3 or more), and higher still for the cold reserve
- Is there a plan for when one holder is unavailable — on vacation, lost a device, or has left
Conclusion
Multisig only works when every key is a genuinely independent point of failure — its own person, its own device, its own location. Break any one of those conditions and you get the illusion of protection instead of the real thing. For an exchanger holding client funds, that difference is worth real money. If you're deciding what to build custody on for your own exchanger, take a look at iEXWallet — a proprietary exchanger wallet with no middleman fee.
