Most Monero wallets are single-signature: one person holds the spend key, and that person alone can move the funds. Multisignature, usually shortened to multisig, changes that. A 2-of-3 multisig wallet needs any two of three participants to sign a transaction before the network accepts it. The third party can be offline, uncooperative, or dead, and the other two can still spend.
In Monero this is not a smart contract feature bolted on top. It is built into the protocol the same way ordinary signatures are, and a completed multisig transaction is indistinguishable on-chain from any other Monero transaction. No external observer can tell a multisig spend from a normal one. That is unusual among cryptocurrencies that advertise multisig, and it is worth understanding before you use it.
How Monero multisig actually works
A multisig wallet starts with an exchange of key material. Each participant generates a wallet and then exports a string called multisig info from it. Every participant imports everyone else’s multisig info. This is round one, and after it the participants jointly derive the shared multisig address.
Before any transaction can be built, there is a second exchange: each participant prepares and shares a set of partial signing keys. Every wallet needs a partial key from each other wallet in the group. This is sometimes described as the key exchange round, and it is the step people most often get wrong. If one participant’s keys are missing or stale, signing fails with errors that are confusing if you have not seen them before.
Spending then works like this. One wallet initiates a transfer and produces a partially signed transaction file. That file is passed to the next participant, who adds their signature, and so on until the threshold is met. For a 2-of-3 wallet, two signatures are enough: the third participant never needs to see the transaction. The final signer broadcasts it like any other transfer.
Two practical consequences follow. First, the signing order does not matter, but everyone must sign with the same prepared inputs, which means the transaction file must travel between wallets without being modified. Second, receiving requires no coordination at all: anyone can send to the shared address at any time, and every participant’s wallet sees the balance once synced.
What people actually use it for
Escrow without an escrow company. A buyer and a seller agree on a 2-of-3 setup with a mutually trusted third party holding the third key. If the trade goes smoothly, buyer and seller sign the release together and the third party is never involved. If they dispute, the arbiter sides with one party and provides the second signature. The arbiter can never steal the funds alone, because they hold only one of three keys. If you trade XMR for BTC, atomic swaps remove even the need for an arbiter, and our atomic swaps explainer covers that route separately.
Shared treasury. A small organization holds funds in a 2-of-3 or 3-of-4 wallet so that no single member can empty it. Because Monero hides balances and counterparties from the public, the arrangement stays private, which for some groups is the entire point of using Monero rather than a transparent chain.
Backup and succession. A 1-of-2 setup sounds strange but has a real use: you hold one key, a sealed backup or a family member holds the other, and either can spend alone. It trades some security for resilience against a lost seed. It also means either holder can take everything without the other’s consent, so the trust assumption is total. Understand that before choosing it.
The workflow in the CLI wallet
Multisig is fully supported in the official command line wallet, monero-wallet-cli. The command sequence for a 2-of-3 wallet:
- Each participant runs
make_multisigwith the threshold (2), the total signer count (3), and the multisig info strings from the other two wallets. - Each runs
exchange_multisig_keys, passing around the new info each round produces. For an N-of-M wallet you need N-1 rounds in total. The final round prints the shared address. - When spending, the initiator runs
transferand the wallet writes amultisig_transaction_descfile instead of broadcasting. - The file is copied to the next signer, who runs
sign_multisigon it. Repeat until the threshold is met; the last wallet signs and submits.
GUI wallet support exists and has improved, but the CLI remains the reference path, and if you hit an error mid-setup, searching the exact CLI error text will find far more results than GUI equivalents.
Costs, limits and honest warnings
Setup friction is real. You need a secure channel to exchange multisig info strings, and those strings must never be tampered with, because a corrupted exchange can produce a wallet none of the participants can spend from. There is no on-chain recovery, no support desk, and no undo. Test the entire arrangement with a small amount before moving real funds: send in, spend out once, confirm every participant can sign, and only then fund it properly.
Hardware wallet support is partial. Some devices handle multisig key exchange poorly or not at all, and the practical pattern for high-value setups is participants running dedicated, offline machines. That raises the operational bar considerably compared with a normal wallet, where a hardware device plus a written seed is enough.
Multisig interacts with proofs in ways worth knowing. If you need to demonstrate a payment left the shared wallet to an external party, transaction and reserve proofs work from the wallet that initiated the spend, which we explain in our guide to Monero transaction and reserve proofs. Other participants in the multisig group may not be able to generate the same proof, so agree in advance who keeps records.
Finally, remember what multisig does not do. It does not add privacy; the privacy comes from the protocol regardless of signature scheme. It does not enforce conditions, amounts or time locks, because Monero has no scripting for that. It does exactly one thing: it requires several parties to cooperate to spend. If your problem is really “can I trust this counterparty”, read the counterparty’s incentives first, because no key scheme fixes a counterparty who walks away with the goods after a clean 2-of-2 release.
When it is worth it
For amounts you would not carry in cash through a strange city, multisig is reasonable insurance against a single point of failure, whether that failure is a compromised machine, a coerced individual, or a lost seed. For everyday amounts, the setup cost and the coordination overhead usually outweigh the benefit. The dividing line is personal, but deciding it before you fund a shared wallet, in writing, with the other participants, is the part that actually protects you.