Multisig
Also called: multi-signature, multisignature, m-of-n, 2-of-3 multisig, multisig wallet, OP_CHECKMULTISIG.
Multisig (multi-signature) locks bitcoin so that M of N chosen keys must sign to spend it, for example any 2 of 3 keys kept in different places.
Multisig, short for multi-signature, is a spending rule that needs signatures from several keys instead of one. It is written "M-of-N": a 2-of-3 wallet has three keys and any two can spend, so no single lost or stolen key can move the funds.
How it's built
The classic form uses OP_CHECKMULTISIG, as in 2 <key1> <key2> <key3> 3 OP_CHECKMULTISIG. BIP 11 made bare M-of-N scripts standard for up to 3 keys; because of an off-by-one bug, the spender must add an extra dummy value. Today multisig is usually wrapped:
| Wrapper | Max keys | Address |
|---|---|---|
| P2SH (BIP 16) | 15 compressed (520-byte limit) | starts with 3 |
| P2WSH (BIP 141) | 20 | bc1q, 62 characters |
| Tapscript (BIP 342) | 999 in multi_a() descriptors |
bc1p |
Tapscript replaces OP_CHECKMULTISIG with OP_CHECKSIGADD. With MuSig2 (BIP 327), all N signers can instead produce one Schnorr signature that looks like an ordinary single-key P2TR spend.
Wallet standards
BIP 67 sorts public keys so every co-signer gets the same address. BIP 48 and BIP 87 define derivation paths, BIP 129 describes a secure setup procedure, sortedmulti() output descriptors (BIP 383) record the whole wallet, and PSBTs carry transactions between signers.
Back up every co-signer's xpub (or the descriptor) as well as the seeds: in a 2-of-3, two seeds alone can't rebuild the addresses without the third public key. Read the multisig guide.