How Multi-Signature Setups Actually Fail

Multi-signature is the correct answer to company custody and it fails regularly. The failures are operational, not cryptographic. Against a corporate crypto wallet, which operates these controls by obligation, the gaps elsewhere become obvious.

Failure one: the untested recovery

The setup is documented. The recovery procedure is written. Nobody has ever performed it.

When it is needed, the documentation turns out to assume software versions that changed, a derivation path nobody recorded, or a step the author knew and did not write down.

The fix is to rehearse it annually with real signatures, on a small amount, from backups rather than from the live devices.

Failure two: the threshold that no longer works

A two-of-three arrangement among three founders. One leaves. Now two people hold the only usable keys and the third key is with someone who has no reason to cooperate.

Worse: a three-of-five where two holders have left and a third is unreachable. The threshold cannot be met and the funds are locked.

Key sets need rotating when holders change, and that requires moving funds to a new arrangement, which people defer because it costs fees and attention.

Failure three: keys in the same place

Three keys, all in the same office safe, or all backed up to the same cloud account.

The arrangement provides no protection because the threshold can be met by one event: a burglary, an account compromise, a fire. Property transactions are where this costs the most, and a provider serving funds and family offices exists for that corridor.

Separation is the point. Different people, different locations, different backup mechanisms.

Failure four: the knowledge left with a person

One person understood the setup. They left. The remaining team has the keys and does not know how to combine them, which wallet software to use, or what the derivation path was.

This is the most common failure and the least dramatic. The funds are technically accessible and practically are not.

Failure five: signing what was not intended

Signers approve a transaction without independently verifying the destination, because the person who created it is trusted.

A compromised creator can then construct a transaction that signers approve without reading. Multi-signature protects against a single compromised key, not against several people signing carelessly.

Each signer should verify the destination against a registered record, on their own device, not against what the interface shows.

What good looks like

Keys with separate people in separate places. Backups tested annually with real signatures. A written procedure that someone other than the author has followed successfully. A rotation triggered by any holder change. And signers who verify independently.

None of this is difficult. All of it is ongoing, which is why it decays.

The honest comparison

A company that will not do this work is not more secure with multi-signature than with a regulated provider that does the work for them. It is less secure, because it has the appearance of a control without the operation of one. If you want to see these protections operating rather than described, a support channel with a named contact is bound by them.

Choose based on what your organisation will actually maintain every quarter, not on what sounds most robust.