What is a multisig wallet?
A multisig wallet is an account that several keys share, so no single person can move the funds. Each key holder is an owner. The wallet stores a ThresholdIn a multisig, the threshold is how many of the owners must approve before a transaction goes through.See it in the glossaryRead the explainer, the number of owners who must approve before anything leaves.
The rule is written “M-of-N”. N is the number of owners and M is the threshold. A 2-of-3 wallet has three owners and needs two signatures. A 3-of-5 wallet has five owners and needs three.
Picture a vault with three keyholders where the lock needs two keys turned together. No keyholder can open it alone, and it still opens when one is away.
Why a single key is risky
A normal crypto WalletA wallet is the app or device that holds your keys and lets you sign transactions and view your assets.See it in the glossary is controlled by one secret key, so whoever has the key has everything. If the key is lost or stolen, the funds are gone. If its holder is unavailable or acts badly, nobody else can step in.
For a team treasury that is a single point of failure. A multisig removes it by requiring agreement between several people.
How a Safe transaction gets signed and executed
Safe, formerly Gnosis Safe, is the most widely used multisig on Ethereum. A Safe transaction goes through three steps: proposed, signed by enough owners, then executed onchain.
- Proposed. One owner drafts the transaction in the Safe app: who gets paid, how much, and which contract to call. Nothing has happened onchain yet.
- Signatures collected. Each owner reviews the draft and signs with their own key. Safe’s Transaction Service keeps these SignatureA signature is proof, made with your private key, that you approved a specific message or transaction.See it in the glossaryRead the explainer offchain, so signing costs no GasGas measures the computing work a transaction needs, and you pay for it in small amounts of ETH.See it in the glossaryRead the explainer, the network’s transaction fee.
- Executed. Once the threshold is met, one person, usually an owner, submits the transaction with all collected signatures. The Safe contract checks them and runs the transaction. Only this step pays gas.
Every payment follows the same rule, whether it sends ETH, moves a token or changes a setting. The Safe counts valid signatures from distinct owners and checks that the count reaches the threshold.
The nonce stops replays
The nonce is a counter inside the Safe that goes up by one each time a transaction executes. Each transaction is signed over its details plus the nonce it expects. After it executes, the nonce is higher, so the same signed payload cannot run again.
The nonce also orders the queue. A Safe at nonce 8 expects its next transaction to carry nonce 8, then 9, and so on. If two proposals both use nonce 8, only one can execute and the other becomes stale.
Choosing a threshold: 2-of-3, 3-of-5 and the trade-offs
No threshold is right for everyone. Each choice trades two risks against each other.
- Lost keys. A higher threshold needs more keys to be available. In a 3-of-3 wallet, one lost key locks the funds for good. A 2-of-3 wallet survives losing one.
- Collusion or theft. A lower threshold needs fewer keys from an attacker or from insiders. In a 1-of-3 wallet, one compromised key empties the wallet.
A 2-of-3 setup is the usual small-team choice. It survives one lost key and needs two parties to agree. A 3-of-5 setup suits larger treasuries: it survives two lost keys and requires a majority to collude. Set the threshold above half of N, so two rival groups cannot both get a transaction through.
Keep each key on a different device, held by a different person, ideally on a hardware wallet. Three keys in one drawer are one key in practice.
A multisig does not protect against a signer who approves without reading. Each owner should check the recipient and the amount on their own device. The post what am I signing explains how to read what a signature authorises.
A Safe is a smart contract
A Safe is not an address with a private key. It is a Smart contractA smart contract is a program stored at an address on the blockchain that anyone can call and that runs exactly as written.See it in the glossaryRead the explainer that holds the funds and enforces the signing rules in code. The network sees a normal-looking address, but a program behind it checks your signatures.
That is why anyone can read the owners, threshold and nonce directly from the contract with getOwners(), getThreshold() and nonce(). It is also an early case of accounts that run their own rules, covered in the account abstraction explainer. Changing the owners or the threshold is itself a transaction that enough current owners must sign.
Multisigs appear wherever one person should not control the money alone: DAO treasuries, protocol admin keys and company reserves.
See it on a real contract
The card reads the threshold and owner count of the Safe at 0x0DA0C3e52C977Ed3cBc641fF02DD271c3ED55aFe, the same one we use in our developer guide.
Signatures needed, out of all owners
Reading live from Ethereum
Inspect this Safe in the Gnosis Safe Inspector
Show the query
string(formatUnits(safe.getThreshold(), 0)) + " of " + string(size(safe.getOwners()))The Gnosis Safe Inspector also lists every owner address and the nonce, which was 8 on 2026-11-11 at block 26391461.
Common mix-ups
-
“More owners always means safer.” Not by itself. A high threshold lets one lost key lock the funds, and a low threshold lets a few stolen keys empty them.
-
“A multisig cannot be tricked.” It can. If each owner signs without reading, the threshold only collects approvals for a bad payment.
-
“Every owner pays gas to sign.” Only the final submission pays gas. Signatures are gathered offchain and cost nothing.
-
“The owners are fixed forever.” They are not. Changing owners or the threshold is a transaction that enough current owners must sign.
Summary
- A multisig wallet needs M approvals from N owners before it moves funds, so no single lost or stolen key decides the outcome.
- Safe is the most widely used multisig on Ethereum. It is a smart contract that checks signatures, and a counter called the nonce stops old approvals from being reused.
- A 2-of-3 setup suits small teams and 3-of-5 suits larger treasuries. A higher threshold risks locked funds and a lower one risks theft.
For developers
You can read a Safe’s owners, threshold and nonce with one evmquery request. The Gnosis Safe API guide shows the full query, and the Safe owner and threshold change alert sets up a Slack message when they change.