Bitcoin Multisig Vaults for Families, Teams and Treasuries

Custodial "institutional" rails buy convenience with freeze and counterparty risk. Single-key company setups buy speed with one leak away from empty. Seed phrases in a group chat are not a control framework.

Multisig vaults split authority without handing Bitcoin to a bank.

What is multisig

Multisig (multi-signature) is a Bitcoin security model where M out of N keyholders must approve a transaction before it can broadcast. A 2-of-3 vault means three people hold keys and any two of them can authorize a spend. A 3-of-5 means five keyholders, three required.

Standard Bitcoin accounts use a single private key. Whoever has that key controls the funds. One phishing link, one compromised device, one rogue employee with the seed phrase, and the account is empty. There is no undo button on Bitcoin.

Multisig removes the single point of failure. No individual signer can move funds alone. A stolen key is worthless without the remaining signatures. A lost key does not lock everyone out as long as enough other signers remain above threshold.

This is not new to Bitcoin. Multisig scripts have existed since 2012. What is new is having it built into a self-custodial platform where signers co-sign from their own devices without touching raw scripts or passing files around.

What multisig guards against

Single point of compromise. One leaked seed phrase, one malware infection, one insider with access. With a single-key account, any of those is a total loss. With multisig, an attacker needs to compromise M separate devices or people independently.

Internal theft. A team member with sole access to a company treasury can drain it at 3am on a Saturday. Multisig makes that impossible without collusion from enough co-signers to meet threshold.

Key loss. If one signer loses their device or seed phrase, the remaining signers can still move funds to a new vault. A 2-of-3 setup means one key can be lost without locking everyone out. Single-key accounts have no equivalent safety net.

Coercion. A $5 wrench attack against one person cannot empty a vault that requires two or three signatures. The attacker would need to coerce multiple people in different locations simultaneously.

The tradeoff is speed. Every transaction needs coordination. That is the cost of removing trust from a single pair of hands.

How it works in Xverse

1. Open the account dropdown in Xverse, tap Add account, then select Multisig vault and create the vault.
2. Invite co-owners by sharing an invite code. Each owner joins using any one of their Bitcoin, Stacks, or Starknet addresses. A vault supports up to 20 co-owners.
3. Set the threshold: M-of-N. Three of five. Two of three. Whatever fits the desk.
4. Once every owner has joined and addresses are cross-checked on each device, the vault activates.
5. Any owner can propose a transaction through the normal Send, Swap, or Earn flows. Co-signers receive a push notification or see the request in Inbox.
6. The proposer can cancel the request while signatures are still coming in. Once threshold is reached, the proposer broadcasts. Vaults can also be configured to let any co-owner broadcast once enough signatures are collected.

Coordination stays in Xverse. No external tool. No email chain of PSBTs.

What happens under the hood

Each signer claims their slot with a signed proof that they control the address they registered. The vault derives a new set of addresses once every slot is filled. Bitcoin uses a P2WSH sortedmulti script for payments and a taproot script path for ordinals. Stacks uses SIP-027 non-sequential multisig. Starknet deploys the Argent multisig contract on the vault's first transaction.

The coordination service holds shared state and routes signature requests. It never holds key material. Partial signatures below threshold are worthless. A compromised server cannot forge a valid transaction.

Chains

Bitcoin is always included. Stacks and Starknet addresses are optional per vault. One vault, one invite, addresses on every chain the signers choose.

Signers

Members can be Xverse software accounts or Ledger hardware devices, mixed however the owners want. Each signer contributes their extended public keys at claim time. The same set of owners can run multiple vaults without address collisions.

Managing a vault

Vault owners can rename the vault, download a recovery kit or BSMS file, export a viewing key for watch-only access, restore a vault from an address, or delete the vault while a transaction is still pending. These controls live inside the vault settings in the extension and mobile app.

dApps

When a dApp asks a vault to sign, the popup creates the request and the initiator signs. The popup stays open while other members approve from their own devices. The dApp gets the transaction ID once the request is broadcast, or a rejection if a co-signer declines or the window runs out.

Who it is for

Treasuries that need two or more approvals before a spend. Funds and DAOs coordinating signers across time zones. Founders separating personal keys from operations keys. Teams moving off one mobile seed in a chat thread.

Families who want to manage Bitcoin together without one person holding all the keys. A 2-of-3 between two parents and an adult child means no single family member can move funds alone, and losing one device does not lock the family out.

Secure Account vs Multisig vaults

Xverse ships two products for multi-party signing. Pick the one that fits.

Secure Account is a 2-of-2 between your own extension and phone. Two existing accounts pair into a new empty Secure Account with no third seed. Best for individuals who want device co-approval on every spend. Inbox carries approvals for your other device.

Multisig vault is M-of-N for teams. Signers use their own accounts under vault policy. Best for treasuries, funds, and any desk that needs shared control. Inbox carries approvals across all invited signers.

Same self-custody stance. Different jobs. Secure Account is for you. Multisig vaults are for business.

Why Xverse

Bitcoin-first self-custodial neobank surface operators already use. Mobile app and extension so signers are not stuck on one desktop ritual. Ledger support so hardware signers can participate alongside software accounts. Push notifications and Inbox for pending signatures so nothing gets lost in a side channel. Clear split from consumer Secure Account so buyers are not sold the wrong product.

The tradeoff

Multisig is slower than a hot account. That is the point.

Threshold too high and the vault locks up when someone is on a plane. Threshold too low and one compromised signer drains everything. Pick M-of-N for the real desk, not for a hypothetical one.

If a signer loses a device, policy and recovery planning matter more than slogans.

Run Bitcoin treasury without a custodian

Download Xverse to set up a Multisig vault.
‍

FAQ

Is this the same as Xverse 2FA Secure Account?

No. Secure Account is the consumer 2-of-2 (extension plus phone). Multisig vault is M-of-N for teams.

Does Xverse custody company Bitcoin?

No. Self-custodial vaults. Signers you control authorize spends. Xverse cannot freeze or move funds unilaterally. The coordination service never holds key material.

Which networks?

Bitcoin is always included. Stacks and Starknet addresses are optional per vault.

How many co-owners can a vault have?

Up to 20. This applies to all networks and is set by the P2WSH OP_CHECKMULTISIG limit on Bitcoin.

How do signers approve?

Through Xverse flows on extension and mobile. Pending requests show in Inbox and trigger push notifications. Each approval uploads a partial signature. At threshold the broadcaster's device combines them locally and sends the transaction.

Can Ledger devices participate?

Yes. Members can be Xverse software accounts or Ledger hardware devices, mixed in any combination.

Can families use Multisig vaults?

Yes. A 2-of-3 between two parents and an adult child means no single family member can move funds alone, and losing one device does not lock the family out.

Is a separate treasury portal included?

Not in this launch. Multisig vaults live inside Xverse first.