How do you choose the signers and threshold for a multisig?
Safe says there is no single best setup: it depends on how the account will be used.1 A threshold above 1 stops one stolen key moving funds, and a threshold below the number of signers stops one lost key locking everyone out.1
Three decisions
Safe's help centre lists three decisions when setting up a Safe.1
It says there is no single best answer, and no single best setup.1 It depends on how the Safe will be used.1
The two ends of the dial
| Threshold | Strength | Weakness |
|---|---|---|
| 1 of n | Any one signer can act alone2,1 | One stolen key is enough to move funds1 |
| n of n | Nobody can act without everyone2 | One lost key can lock everyone out1 |
Safe's advice is to pick a threshold above 1, so no single account can move funds.1 It also calls it good practice to keep the threshold below the number of signers.1 Then, if one signer loses access, the others can still act and replace that signer.1
Common setups
Safe describes some common setups. They are examples, not rules.1
- An individual. Three signers with a threshold of 2. Two are used day to day. The third is locked away in case one of the others is lost.1
- A group. One signer per person, with a threshold of 3. No single person can act, and every transaction is double-checked by two others.1
- Different Safes for different jobs. Some organisations keep different assets in different Safes, each with its own signers and threshold.1
ethereum.org notes that 3-of-5 and 4-of-7 are commonly used.3
More keys, more doors
NIST, the US standards agency, makes a general point about threshold schemes. Using more shares spreads the attack surface across all of them.4 What matters is how hard it is to compromise enough of them to break the scheme.4 For a multisig, that means enough keys to reach the threshold.3
When keys are not really separate
The Ronin bridge relied on nine validator keys to approve withdrawals.5 One company, Sky Mavis, ran 4 of the 9 validators. Ronin says that alone was not enough to fake withdrawals.5
On 23 March 2022, an attacker got control of 5 of the 9 keys: Sky Mavis's 4, plus 1 from the Axie DAO.5 Ronin says its staff faced constant phishing attacks, and one employee was compromised.5
The fifth key came through an old arrangement. In November 2021, the Axie DAO let Sky Mavis sign on its behalf. That stopped in December 2021, but the access was never removed.5 About 173,600 ETH and 25.5 million USDC were drained.5 The theft was only found on 29 March. Ronin says it had no proper system for watching large outflows.5
- If a signer leaves or loses a key, how quickly can we replace them?
- Could two of our keys be stolen in the same way, for example from the same office or device?
- Who can reach the backup key, and how?
- Does anyone outside the team still have access we have forgotten about?
- What Safe setup should I use?. Safe Help Center (Safe Knowledge Base).
- Concepts: owners, threshold, signature verification and transaction flow. Safe documentation.
- Introduction to smart contracts (multisig contracts). ethereum.org developer docs, page updated 25 February 2026.
- NISTIR 8214: Threshold Schemes for Cryptographic Primitives. L. Brandão, N. Mouha and A. Vassilev, US National Institute of Standards and Technology (NIST), March 2019.
- Back to Building: Ronin Security Breach Postmortem. Ronin Network (Sky Mavis), read through the Internet Archive's Wayback Machine, 27 April 2022.
General education built from the publicly available sources listed above. Not financial, legal, tax or investment advice. Naming a company, project or regulator is not an endorsement either way. Last checked 2026-10-22. Terms and disclaimer.