The destruction of $90 million from Iran’s Nobitex exchange on June 19, 2025, by the Predatory Sparrow group has reignited discussions about the inadequacy of single-key cryptocurrency storage for anything beyond small amounts. With Bitcoin at $104,684 and Ethereum at $2,521, even moderate holdings represent significant value that warrants institutional-grade security. Multi-signature wallets, which require multiple independent parties to authorize transactions, provide a level of protection that no single-key setup can match. This tutorial walks through the complete process of configuring a production-grade multi-signature wallet.
The Objective
This guide will walk you through setting up a 3-of-5 multi-signature Bitcoin wallet using open-source tools. In this configuration, three out of five key holders must sign any transaction before it can be broadcast to the network. This means that up to two keys can be lost or compromised without losing access to the funds. The setup is suitable for small teams, family offices, or organizations managing cryptocurrency treasuries valued from tens of thousands to millions of dollars.
We will use a combination of hardware wallets for key generation and an open-source coordinator to manage the multi-signature policy. The approach ensures that no single device or person ever has complete control over the funds, eliminating the single point of failure that led to catastrophic losses at exchanges like Nobitex.
Prerequisites
Before beginning, you will need five hardware wallets from at least two different manufacturers. Using devices from multiple manufacturers eliminates supply-chain risk from a single vendor. You will also need five separate seed phrases, each generated independently on its respective hardware wallet. Never reuse a seed phrase across devices or import seeds that were previously used for single-signature wallets.
You need a dedicated, air-gapped computer for the coordinator setup. This machine should run a fresh installation of a privacy-focused operating system, have no wireless networking capabilities, and be used exclusively for wallet management. A Raspberry Pi with Wi-Fi and Bluetooth physically disabled works well for this purpose. Additionally, you will need five fireproof metal plates for recording seed phrases and five tamper-evident bags for hardware wallet storage when not in active use.
Designate five key holders who are geographically distributed and available for signing sessions. Each key holder should understand their responsibilities and have a secure location for storing their hardware wallet and seed phrase. Establish a clear protocol for how signing requests are communicated and verified, including out-of-band verification through a separate communication channel.
Step-by-Step Walkthrough
Begin by initializing each hardware wallet individually. On each device, generate a new wallet using the device’s built-in random number generator. Write down the seed phrase on a metal plate and verify it by entering it back into the device during the confirmation step. Store each metal plate in a separate physical location such as a bank safe deposit box, a home safe, or with a trusted legal representative.
Next, on your air-gapped coordinator machine, install a multi-signature wallet coordinator. Popular open-source options include Sparrow Wallet for Bitcoin and Safe for Ethereum-based assets. Create a new multi-signature policy specifying the 3-of-5 quorum. The coordinator will generate an extended public key descriptor for each participant.
Register each hardware wallet as a signer by connecting it to the coordinator and importing its extended public key. The coordinator will compute the multi-signature address and display it for verification. Each hardware wallet should independently verify that its key is included in the policy by confirming the address matches what the coordinator displays.
Create a backup of the wallet configuration file, which contains the extended public keys and policy parameters but no private keys. This file is necessary for recovery and should be stored in multiple secure locations. Without this file, recovering the multi-signature wallet requires regenerating it from the individual extended public keys, which is possible but more complex.
Test the setup by sending a small amount of cryptocurrency to the new multi-signature address. Then initiate a test transaction requiring three signatures. Have three key holders sign the transaction on their respective hardware wallets, verifying each signing request independently. Broadcast the signed transaction and confirm it on the blockchain. Only after this successful test should you transfer larger amounts to the wallet.
Troubleshooting
If a signing session fails because a hardware wallet cannot connect to the coordinator, first verify that the coordinator software is up to date and that the correct wallet policy is loaded. Connection issues often stem from USB cable problems or incompatible firmware versions. Try a different cable and port before attempting more complex troubleshooting.
If a key holder is unavailable for a signing session, the multi-signature policy allows the transaction to proceed with the available signers as long as the quorum threshold is met. This is by design and should not cause concern. However, if you find that key holders are frequently unavailable, consider adjusting the quorum or adding an additional signer to improve operational flexibility.
If you suspect a hardware wallet has been compromised, immediately stop using it for signing. You can replace the compromised key by rotating the multi-signature policy. This involves creating a new policy that excludes the compromised key and includes a freshly generated replacement. Transfer all funds from the old wallet to the new one. While this process requires coordination among key holders, it is far preferable to leaving a compromised key in a position of trust.
Mastering the Skill
Once you have a working multi-signature wallet, establish regular operational practices to maintain security over time. Schedule quarterly reviews of your key holder list, verifying that all key holders still have access to their hardware wallets and seed phrases. Rotate the wallet configuration annually by creating a new multi-signature policy with fresh extended public keys and migrating funds to the new address.
Implement spending policies within your coordinator that limit transaction amounts and destinations. Many multi-signature coordinators support rules such as daily spending limits, whitelisted addresses, and time-locked transactions. These policies add layers of protection beyond the raw multi-signature requirement, making it harder for a compromised quorum of key holders to drain funds without detection.
Document your complete wallet setup including the quorum policy, key holder identities, recovery procedures, and spending limits. Store this documentation alongside but separate from the wallet configuration backup. In a crisis, clear documentation can mean the difference between a swift recovery and a prolonged, stressful process.
Disclaimer: This article is for educational purposes only and does not constitute financial or security advice. Always test security configurations with small amounts before committing significant funds, and consult with a qualified security professional for high-value setups.
Finally a guide that doesn’t just skim the surface of m-of-n setups. The section on cold-storage signing ceremonies is absolute gold for anyone trying to move beyond basic hardware wallets. It’s high time we treat institutional security as the standard rather than the exception in this space.
cold storage signing ceremonies sound overkill until you realize the $90M nobitex hack could have been prevented with a simple 2-of-3 setup
key master is underselling it. a 2-of-3 wouldnt have stopped predatory sparrow since they had inside access. you need geographic distribution of key holders too
signing ceremonies sound dramatic but once youve done a few they take 10 minutes. the first time is always nerve-wracking though
Great technical breakdown, but I wonder if the complexity of this configuration might actually lead to more human error during recovery. While the security benefits are obvious, the operational overhead for a small team seems massive. Still, definitely the most comprehensive walkthrough I’ve seen on the topic so far!
the $90M nobitex destruction wasnt even a hack in the traditional sense. preditory sparrow had inside access. multi-sig would have slowed them down
valid point on recovery complexity. we ran a drill with our 3-of-5 setup and it took 45 minutes to sign a simple transfer. operational overhead is real but its better than losing everything to a single compromised key
45 minutes for a 3-of-5 signing drill is actually fast. our first drill took 2 hours because one key holder was on a different timezone and we had to walk them through the whole process