Key Takeaways
- Multivendor multisig combines hardware from different manufacturers to reduce the risk of a single point of failure.
- Hardware wallet makers and multisig providers could gain customers as security concerns grow.
- Greater security comes with added costs and complexity, potentially pushing some users toward custodial solutions.
Technically savvy bitcoiners have been using multivendor multisig hardware wallet setups for years. Now, following the Coldcard crisis this summer and the problems affecting Ledger and its users this month, the approach is gaining the attention of the wider audience. It combines hardware from different manufacturers in a multisignature wallet setup.
For example, in a 2-of-3 setup, three keys are created on three different devices, and two of them are needed to sign a transaction. If one device is compromised, criminals hold only one key and still cannot steal your bitcoin, though you should still replace that key. This would have protected users in both the Coldcard and Ledger cases, as long as the other devices came from other manufacturers and, as the Ledger case shows, through different sales channels.
Compromising all the devices in order to move bitcoin from a multisig wallet would require a highly coordinated attack. For example, an attacker might target three devices bought from the same reseller, which could have tampered with the wallets itself or fallen victim to a supply chain attack. Compromised Ledger reseller Cryptobilis also sold Trezor, Tangem, Safepal and other devices. So far, only Ledger devices have been confirmed as tampered with. That is why the safest practice is considered to be buying hardware wallets directly from the manufacturer. However, while this reduces the risks, it does not eliminate them.
‘Should Become the Standard’
“Rolling dice wouldn’t have helped the victims of the Ledger supply chain attacks. Multivendor multisig would, again,” Kevin Loaec, CEO of Wizardsardine, the developer of the Bitcoin wallet Liana, posted on X.
“Multi-vendor multisig should become the standard. Each signer should have a completely independent hardware/software stack from the other signers,” developers of the Nunchuk wallet added, noting that “any setup that relies on a single hardware/software stack or a single vendor should be considered at risk.”
Both Liana and Nunchuk are developing their own multisig solutions to help users combine different devices. However, these solutions do not yet support all the hardware wallets available on the market.
Payers and Gainers
If multivendor multisig does become the standard, single-device users could face additional expenses, but the investment could pay off in the long term. For example, Ledger wallets currently retail for $59-399, Trezor wallets for $59-249, and BitBox devices for $167-196. Another option is Block’s Bitkey device, which costs $250 and offers a multisig solution without seed phrases.
Bitkey distributes three keys among its hardware wallet, the user’s mobile device, and a Bitkey server. While this is safer than a single-signature setup, users still need to trust that the solution from a single vendor works as intended.
If people rush to create multivendor multisig setups, hardware wallet manufacturers could see a direct boost in sales. Bitcoin.com News has already reported that some manufacturers saw a spike in sales following the Coldcard crisis. The trend could also change competition among manufacturers, as users would no longer look for a single “best hardware wallet.”
Other potential beneficiaries include multisig solution providers such as Liana and Nunchuk. Companies such as Casa and Unchained, which offer collaborative multisig solutions, could also see their user bases grow. They could even become more important sales channels for hardware wallet manufacturers. Casa does not specify which wallets it offers to subscribers of its Premium and Private Client plans, which cost $2,100-7,500 per year. Ledger previously said they “worked closely with Unchained to validate and improve our approach to multisig, in an open-source collaboration.”
Fear of Multisig vs. Fear of Losing Your Bitcoin
However, following the Coldcard crisis, Ledger CTO Charles Guillemet warned that “Multisig is not automatically the right answer” because it adds complexity, increasing the risk of losing funds. Guillemet advocated for a miniscript solution instead, which would allow users to set simple rules for how their bitcoin can be spent, including through multisig transactions. At the time of writing, Guillemet had not posted anything about the Cryptobilis incident.
Multivendor multisig might therefore seem even more complex to most bitcoin and crypto users. How popular the trend becomes will depend on multiple factors. A key factor will be whether repeated attacks heighten users’ fear of losing bitcoin enough to force those who still want to self-custody their BTC to learn how to set up multivendor multisig wallets.
Another question is how the Bitcoin and broader crypto asset industries will help these users with better, more user-friendly, and less risky solutions. Alternatively, users could turn increasingly to custodial solutions or investment vehicles such as ETFs.
Ultimately, as the adage goes, there is no single best bitcoin custody solution or hardware wallet. There are only trade-offs, and the right choice depends on your needs and technical abilities.
