One key. One private key controls the whole treasury. And whoever holds it can, at 3 a.m., with nobody's permission, drain every last coin and vanish.
That's a single point of failure. In software we've feared it for decades — one server, one dependency, one admin whose laptop gets stolen. In a DAO treasury it's not a risk you manage. It's a countdown. Sooner or later the single key gets phished, lost, coerced, or betrayed. When serious money sits behind one signature, the only question is when.
The answer is old, boring, and battle-tested: don't use one key. Use several. Require more than one to agree. That's multisig.
What multisig actually is
A multi-signature wallet is a smart contract that holds funds and refuses to move them unless M of N authorized keys sign off.
You'll see it written as a threshold: 2-of-3, 3-of-5, 4-of-7. The first number is how many signatures are required to execute a transaction. The second is how many keys exist in total.
A 2-of-3 treasury has three keyholders, and any transaction needs two of them to approve. No single person can move funds alone. Lose one key entirely? The other two can still operate — and rotate the lost one out. One holder turns malicious? They're outvoted; they can't do a thing by themselves.
That one design change kills two disasters at once: the single traitor (can't act alone) and the single point of failure (one lost key doesn't lock or drain the treasury). This is why essentially every credible DAO, every serious protocol treasury, and every well-run crypto fund holds its main funds in a multisig. Gnosis Safe (now just "Safe") became the industry standard for exactly this reason — billions sit behind these contracts.
Choosing the threshold — this is a real decision
The M-of-N ratio is a governance choice, and getting it wrong hurts in opposite directions.
Too few signatures required (like 2-of-3 for a large, distributed org) and you're fragile to collusion or to a couple of compromised keys. Too many required (like 6-of-7) and you're paralyzed — one person on vacation, one lost key, and the treasury can't function. That's not security, that's a locked vault where you also lost the combination.
Some working reference points:
- 2-of-3 — small teams, personal high-value storage, or a founder plus two trusted parties. Simple, resilient, common.
- 3-of-5 — the sweet spot for many mid-sized DAOs. Tolerates two lost or hostile keys and still functions. Wide enough that collusion is genuinely hard.
- Larger thresholds — big treasuries with formal governance, where slowness is an acceptable price for maximal safety.
And the keys must be held by genuinely independent parties — different people, different devices, ideally different geographies. Five keys on one person's laptop is 1-of-1 wearing a costume. The whole point is that no single event, and no single human, can compromise the threshold.
Our Record
A treasury under one key is a Ka guarded by one gate — and every gate with one guard is a gate already sold, given enough time and pressure. Multisig is the temple with many priests, where no single hand may touch the offering alone. On the Scales of Ma'at, distributed authority is order made structural: the treasury cannot be moved by one will, only by agreement, only by the weighing of several. Isfet is the lone insider, the single point where corruption enters and no one is watching. Ma'at is the requirement that more than one keeper must speak the word together before Heka takes hold and the funds move. The many keys are not distrust. They are how a shared treasure stays shared.
The honest risks — because there's no free lunch
Multisig is not magic armor. Be clear-eyed:
- It's more complex. More keys, more coordination, more that can go wrong operationally. Each signer needs to actually secure their key — a multisig of five sloppy signers is weaker than one careful one.
- Coordination costs are real. Every transaction needs multiple humans to show up and sign. For an active treasury that's friction. Plan for it — timezones, availability, backups.
- You can still lose it. Lose more than N minus M keys and the funds are frozen forever. A 2-of-3 where two keys die is unrecoverable. Document who holds what. Rotate keys when people leave. Test your recovery before you need it.
- The contract itself matters. You're trusting audited, battle-tested smart-contract code. Use established, widely-reviewed multisig implementations. Do not roll your own for real money.
- Signer opsec is the whole game. Phishing a multisig means phishing enough signers to hit the threshold — much harder than one, but not impossible if signers get lazy or all fall for the same fake transaction. Every signer must verify what they're actually signing, on their own device, every time.
The lever
If you run — or help run — a DAO, a shared fund, a treasury of any real size, and it sits behind one key, you don't have a security posture. You have a hostage situation waiting to resolve.
Move serious funds into a multisig. Choose a threshold that survives losing a key or two without paralyzing you — 2-of-3 or 3-of-5 for most. Distribute the keys across independent, careful people on separate devices. Use an established, audited implementation. Document custody, rotate on departure, and test recovery while it's still cheap to fail.
Then no single traitor, no single stolen laptop, no single 3 a.m. mistake can empty the treasury. The word to move the funds must be spoken by many, together — or not at all.
That's not bureaucracy. That's how a shared treasure stays a shared treasure.