You set up a 2-of-3 multisig wallet. You, your wife, and your lawyer each hold one key. You think it is bulletproof—if you die, your wife and lawyer can work together to move the funds.
A leading global cryptocurrency platform,suitable for both beginners and experienced traders.
New user benefit: 20% off trading fees upon registration!！
Then your wife loses her key. Your lawyer changes firms, and the old key cannot be found.
2-of-3 becomes 2-of-2. Lose one more person and the money is stuck. The assets are locked in the contract, and nobody can move them.
This is the real face of unavailability risk in multisig inheritance. A higher threshold makes assets safer. But a higher threshold also makes it harder for heirs to gather enough signatures. This article is not about concepts. It is about the numbers: How much unavailability risk do 2-of-3 and 3-of-5, the two most common thresholds, actually carry?
First, do the math: how signer loss affects asset access
Multisig inheritance is essentially redundancy against people becoming unavailable.
2-of-3: You need 2 signers to cooperate. If one person is unavailable, such as through death, memory loss, a lost device, or refusal, the remaining 2 people can still reach 2 signatures—barely enough, but the safety margin is gone. Lose one more and the wallet is permanently locked.
3-of-5: You need 3 signers to cooperate. If 1 person is unavailable, the remaining 4 can still reach 3 signatures. The assets are safe. If 2 people are unavailable, the remaining 3 can still reach 3 signatures. Still safe. Only when a third person is unavailable does the wallet lock permanently.
The simple takeaway: Both can survive 1 unavailable signer. But 2-of-3 has already used up all its fault tolerance, while 3-of-5 still has 2 extra people as a buffer.
That is why Bitkey, made by Block, and Casa, which offer multisig plans designed for inheritance, generally use 3-of-5 or higher. It is not because they like complexity. It is because they have done the math: inheritance can span 10 or 20 years. You cannot guarantee that 3 people will all still be reachable 20 years later.
The security of a multisig wallet does not depend on how many people are available today. It depends on how many people can still sign in the worst case. Once you understand this, you will know how many keys to set up.
One table to see it clearly: how both thresholds behave when people go missing
| Unavailable signers | 2-of-3 status | 3-of-5 status |
|---|---|---|
| 0 unavailable | ✅ Normal use | ✅ Normal use |
| 1 unavailable | ⚠️ Barely usable, only 2 signers left and no room for error | ✅ Normal use, 4 signers left and still able to make 3 signatures |
| 2 unavailable | ❌ Permanently locked, only 1 signer left and cannot reach 2 signatures | ⚠️ Barely usable, 3 signers left and just enough for 3 signatures |
| 3 unavailable | ❌ Permanently locked | ❌ Permanently locked, only 2 signers left and cannot reach 3 signatures |
The key point in this table is: 3-of-5 has one extra layer of buffer compared with 2-of-3. When 1 person is unavailable, 2-of-3 is already at the edge of one more problem and it is over. Meanwhile, 3-of-5 still has 4 signers and much more room to breathe.
Why is this difference bigger in inheritance?
In daily use, unavailability is rare. But inheritance timelines stretch over decades, so the chance of someone becoming unavailable rises sharply:
Life risk: A signer may die, become seriously ill, move abroad, or become unreachable.
Device risk: A hardware wallet is lost, a PIN is forgotten, or a seed phrase is damaged.
Relationship risk: A trusted friend or relative may refuse to sign because of a family dispute.
Institution risk: If one signer is a law firm or custodian, it may close, change systems, or make old keys invalid.
Research has pointed out that the biggest weakness of traditional multisig in inheritance is exactly that inheritance is an off-chain problem. Private key distribution and inheritance instructions live off-chain. If all executors lose their credentials, the assets are permanently locked. 2-of-3 pushes fault tolerance to the limit and leaves no room for surprises.
So should you always choose 3-of-5?
Not necessarily. The security advantage of 3-of-5 comes at a cost:
More management work: All 5 people need a hardware wallet and must store their seed phrase carefully. Every extra person is another potential leak point, and management complexity grows.
Higher operational friction: To send a transaction, you need to contact 3 people and get each to sign. If the 3 people are in different time zones and are not familiar with the process, a transaction can easily take days.
Higher setup cost: Gas fees and setup work are usually higher for 3-of-5 than for 2-of-3. Security is not free.
So the real question is not which one is safer. It is which failure you can handle.
| Your situation | Recommended threshold | Reason |
|---|---|---|
| Large assets over 1 million USDT and a long inheritance period over 10 years | 3-of-5 | You need enough redundancy against long-term unavailability risk |
| Medium assets, signers are close family, and relationships are stable | 2-of-3 | Simple and sufficient, with lower management cost |
| Signers include institutions such as a law firm or custodian | 3-of-5 or higher | Institutions change often, so extra redundancy is needed |
| Signers have very different technical skills | 2-of-3 | Fewer people means easier practice and better execution |
An often ignored backup mechanism: time locks and signer rotation
If you choose 2-of-3 but worry about unavailability risk, there is a remedy: rotate signers regularly.
For example, replace one signer every year. Remove the old signer and add a new one. That way, if someone becomes unavailable, you have a chance to add a replacement before the safety margin is gone. The catch is that you have to do this while you are still alive. Some setups allow preset signer replacement rules at the smart contract level, such as giving a backup address automatic signing power after one year.
If your chosen setup does not even support rotation, then the long-term risk of 2-of-3 is permanent lockup. There is no middle path.
A leading global cryptocurrency platform,suitable for both beginners and experienced traders.
New user benefit: 20% off trading fees upon registration!！
How to verify your setup
After setting up multisig, run a stress test:
Simulate 1 unavailable signer: Make one signer temporarily unreachable, for example by telling them not to reply this week.
Start a small test transaction: See whether the remaining signers can reach the threshold and sign within a reasonable time.
Record the time: If a 2-of-3 with 1 unavailable signer takes the remaining 2 people 3 days to finish, your process needs improvement. In an emergency, that would be too slow.
Every 12 months, reconfirm all signers status. Are their devices usable? Are seed phrases intact? Is contact information still valid? This is not optional maintenance. It is a required part of multisig inheritance.
