Family money has an old disease that crypto doesn't cure on its own — it just makes it sharper. One account, one access point, one person who effectively holds veto power over the shared future. A bank at least blunts this a little: joint accounts need both signatures, there's a paper trail, someone to complain to. A wallet with a single private key has none of that. There's the person who holds the key, and there's everyone else, whose stake in the family's savings exists only for as long as that person stays honest, alive, and free of pressure.

This isn't hypothetical. Couples divorce and one partner drains the wallet an hour before the call to a lawyer. Adult children pressure aging parents into handing over "for safekeeping." A relative in a bad stretch empties what took a decade to build. A hacker who phishes one seed phrase doesn't take a family's share — they take everything at once, because the whole family was stored behind one lock. Multisig isn't tech for tech's sake. It's a way of making sure no single person in the family — including you — can unilaterally decide the fate of shared money.

What's actually wrong with one key

A single key isn't convenience — it's concentrated power dressed up as convenience. It's simultaneously too fragile (steal it, and everything is gone) and too centralized (the holder can act without anyone else's consent, by accident or on purpose). A family that keeps its savings behind one key — a husband's wallet, a wife's phone, one exchange login — doesn't actually own the money jointly. It owns it sequentially: for as long as the keyholder decides otherwise doesn't happen.

Our record: the Maat system isn't about one person's morality — it's engineering, arranging the process so that one node's parasitism can't take down the whole. The Scales of Maat weigh the heart against the feather not because no heart can be trusted, but because no single heart can be trusted alone, without a counterweight. Multisig is the Scales implemented as protocol: the fate of the savings gets decided not by one heart, but by the agreement of several.

How it actually works, no magic

A multisig wallet requires not one key to confirm a transaction, but several from a pre-designated set — an M-of-N scheme. A 2-of-3 wallet means: three keys exist, and any two of them together can move funds, while any single one cannot. A 3-of-5 wallet is the same idea with five keys and a threshold of three. Neither the theft of one key nor the loss of one key can compromise or freeze the whole thing.

This is a fundamentally different architecture from "a shared password on one account," where everyone just knows the same secret. In multisig, each person holds their own key, and the wallet's math — not anyone's trust or permission — decides how many approvals a transfer needs. No one can quietly cut the others out of the process, because without the required number of signatures the transaction simply doesn't sign.

Assign roles, not just keys

This is where most families do everything technically right and still fail: they hand out keys without thinking through roles. A key isn't a job description. You need to decide who proposes transactions, who confirms them, and what happens when there's no consensus.

The working setup for most families is 2-of-3: one key with each parent, and a third with a neutral party — an adult child both parents trust, a family attorney, or simply a second, physically separate device such as a hardware wallet kept in a safe-deposit box. Neither parent alone can drain the savings — a divorce, a fight, or a mistake would need either the other's agreement or a third party asking the obvious "why." For families with larger balances and older kids, 3-of-5 works better: both parents, one or two adult children, and one outside keeper — a threshold of three survives even two keyholders being unreachable at once.

Separately, settle a practical question: not everything needs the same level of rigor. Small day-to-day family spending can live in a separate, less-guarded single-signature wallet under a firm cap. Multisig is for guarding savings, not every grocery run — mixing the two layers is the surest way for a family to either abandon the system out of sheer friction, or start routing around it "just this once for speed." And routing around it is exactly the single point of failure you set the whole thing up to avoid.

What this actually guards against

People set up multisig thinking mostly about hackers. But for a family, the second threat is just as real — not an outside enemy, but internal pressure: divorce, addiction, manipulation, one family member panicking on a bad day. Multisig holds against both equally well, because it doesn't distinguish the source of the pressure — it simply requires several parties to agree, regardless of who's asking to open the lock alone and why.

It's inconvenient exactly to the degree it should be. Someone proposing to move half the family's savings one evening without talking to anyone else first is precisely the scenario the threshold exists for. A good multisig doesn't stop a family from agreeing and acting together. It stops one person from acting for everyone.

Setting it up: the steps you can't skip

  1. Agree on the threshold and the keyholders before you create the wallet. Who holds keys, what threshold (2-of-3 for most families, 3-of-5 for more complex ones), and what happens when keyholders disagree — this conversation is harder than the technical setup, and it's where most plans quietly fail.
  2. Physically and technically separate the keys. Different devices, different locations, ideally different storage types — a hardware wallet, an encrypted file, a paper backup held by a third party. One compromised phone shouldn't put two keys at risk at once.
  3. Write down the consent protocol. Not just "who holds which key" but "how do we agree to act" — a shared thread, a three-way call, a fixed rule like "large amounts get at least a day of discussion." The technology gives you the threshold; the family has to supply the process.
  4. Test it with a small amount. Run a real transaction through the real signature threshold before trusting the setup with anything that matters. A wallet that "should work" is not the same as a wallet you've watched work.
  5. Revisit the keyholders as the family changes. Kids grow up, trust in third parties shifts, relationships end. Multisig isn't a set-it-once decision — it's a living structure you rebuild as life moves.

Do this today

Don't build the whole wallet today — start with the conversation the setup is pointless without. Gather the people you share savings with and ask one question out loud: "If any one of us could drain this right now, alone, would we be okay with that?" If the answer is no, you already know why you need a 2-of-3 or 3-of-5 threshold — and from that conversation, today, you can start the actual list: who holds which key.