How Safe Is My Multisig?

01Abstract

It's intuitive that not all multisig setups are created equally (a 10-of-10 feels more dangerous than a 1-of-1); however, to our knowledge, no one has put forth a framework for modeling the survivability of an m-of-n bitcoin custody setup. The goal of this research is to establish said framework. We start with two primary observations.

First, the survivability of a multisig wallet depends on the joint distribution of its individual keys' lifetimes, & "joint" is the operative word: keys don't die alone. They can die together (same house burns, same person disappears). For the uninitiated, the Marshall–Olkin exponential distribution [1] is the classic way of modeling component lifetimes in systems where components suffer individual or joint shocks; accordingly, it will be our main tool. Second, losing a single key is memoryless & usually the product of one or more rare events; we therefore model key loss as a Poisson process. We define & categorize three types of key loss (individual loss, person events, location events), each tied to historical or actuarial data (Appendix A.2).

From these two observations the whole framework falls out, & it lands on two plain takeaways. Takeaway #1: check-ins are the name of the game. A check that finds & repairs damage resets the wallet to day zero, so the only number that matters is the chance that one period goes fatally wrong; projecting out any horizon is then trivial (Eq. 3, §05). Takeaway #2: more than one key per person is almost always a bad idea. Spare keys multiply safety, but only while keys fail separately; put two keys on one person & no check frequency can save you from their one bad day. §06 treats both sides of this, the multiplier & everything that quietly destroys it.

02The simulation

How often does a 2-of-3 fail? Assume one key per holder & zero check-ins — what most people actually run. Below, a live Monte Carlo estimate of P(stranded within 10 years), converging inside its 95% band.

A multisig has exactly one job: make sure no single event can move or freeze the money. The industry measures that job by counting signatures; we're going to measure it the way an actuary would, by asking what actually kills quorums. Keys die three ways: individually (a misplaced seed, a dead device with no backup; _{2%/yr for a diligent holder), through person events (death, incapacity, estrangement, departure;} 1%/yr in a family, far higher in a business), & through location events (fire, flood, seizure; ~0.3%/yr). Notice that none of these care how many signatures your script demands.

03The model

A quorum's life is a random walk on its live-key count: losses push it down, rotations reset it to n. But a rotation is itself an m-signature transaction, so recovery only exists while a quorum survives; the moment the count falls below m, the quorum is lost for good. No future transaction, including the re-key itself, can ever be signed.

Keys die by three independent Poisson clocks: one per key (λ_key), one per person (λ_per), one per location (λ_loc); §04 opens the hood on each. Key k dies at the first ring among its own clock, its holder's & its place's:

Equation (1) is precisely the Marshall–Olkin multivariate exponential [1]: each key's marginal lifetime is exponential with rate λ = λ_key + λ_per + λ_loc, so over a detection window of d months every key faces the same marginal death probability

— but all dependence between keys is carried by the shared shocks A & B, that is, by the layout maps π & ℓ. Two keys on one person are perfectly coupled in the person channel: one arrival of A kills both, in the same instant. Keys on distinct people in distinct places are independent. "Independence is a property of the layout, not the script" is therefore not a slogan; it is the algebraic structure of Eq. (1) — in reliability terms, a k-out-of-n system under common-cause failure [2,3].

Figure 2 animates the chain for a 3-of-5. The process spends nearly all of its time at full strength; occasionally a key is lost & a rotation (gold arc) restores the state to five — a check detecting the loss while five, four, or three keys can still sign. The chain is absorbed by exactly one route: sufficiently many losses inside a single detection window to cross below M before any rotation occurs. The detection interval, not the holding horizon, is therefore the natural unit of risk.

Everything now reduces to p_f. Layout lives inside p_f (shared shocks make multi-key jumps possible); cadence lives in the exponent's denominator; slack s sets how many losses one window must contain to be fatal. It's also why this page can run _{40,000 lifetimes per interaction in your browser: p}f~ is one cheap Monte Carlo (or, under independence, the exact binomial tail of Eq. 4) & the decades are closed form. That is the whole model; the rest of the article is convincing you it's right, & showing what it says about your wallet.

04The results

Every configuration from 2-of-2 to 9-of-9, quarterly checks, typical layout. §02 predicted the terrain; here it is. At m = n a single lost key makes re-keying impossible & monitoring useless, & each key of slack you keep buys roughly an order of magnitude. Hover any cell.

Typical layout, defined. Throughout this page "typical" means the empirically common pattern: N keys spread over N−1 holders, with exactly one holder (the group's most-trusted member) doubled up & everyone else holding one; each key is stored where its holder lives, so ℓ = π up to relabeling. "One key per person" is the injective layout: π & ℓ both one-to-one. Every cell below is the converged Monte Carlo of Eqs. (1)–(3) at the family rates of §04; along the M = N diagonal the doubled holder is irrelevant (s = 1 makes any single death fatal), which is why the diagonal is catastrophic in every layout.

Thirty years out

Bitcoin held for your kids is a thirty-year problem, & thirty years is where the exponents finish their work. Same funds, four regimes. An unmonitored typical 2-of-3 is more likely than not to strand before anyone inherits; a checked 3-of-5 with one key per holder stays under one percent.

05Losing keys

Where does p_f actually come from? Keys die three ways, & each way is its own Poisson clock. Here are the three, the rates we use, & where those rates come from. Every rate carries a ×0.5–×2 sensitivity band, & every ordinal conclusion in this article survives the band (Appendix A.2).

04.1 · Individual key loss · λ_key = 2%/yr

A misplaced seed backup, a device dead with no backup, a passphrase half-remembered. Nobody publishes a clean per-key loss rate, so we anchor from the aggregate: UTXO-age & forensic analyses (Chainalysis' money-supply work is the best-known) put roughly 3–4M BTC (a double-digit share of early supply) beyond recovery, which implies population-average loss rates far above 2%/yr across the sloppy majority. We take 2%/yr as the floor for a diligent holder: someone who made a backup & still occasionally fumbles a move, a reformat, a passphrase. The ×0.5–×2 band spans "very careful" through "average."

04.2 · Person events · λ_per = 1%/yr (family)

Death, incapacity, estrangement, departure. Mortality is the measurable core: the SSA period life table gives annual death probabilities of ≈0.2% at age 40 rising to ≈1.6% by 65, so a mixed-age family quorum sits near 0.5–1%/yr on mortality alone; incapacity & estrangement (divorce, feuds, silent exits) at least match it, landing us at ≈1%/yr per person for families. Groups with churn run hotter: partner & founder-departure data put business separations near 5%/yr, funds _{4%, volunteer clubs} 10%. This is the clock that kills concentrated layouts: when one person holds several keys, one ring takes them all.

04.3 · Location events · λ_loc = 0.3%/yr

Fire, flood, seizure. NFPA's fire-loss series counts ≈350k home structure fires per year against ≈130M US households, about 0.27% per household-year. Adding flood (FEMA claim rates run ~0.1–0.3%/yr in exposed areas) & the small-but-real tail of destructive burglary & seizure rounds us to 0.3%/yr per location. Two keys in one house share this clock exactly the way two keys on one person share theirs.

06Takeaway #1: checking-in resets it all

A check that finds & repairs damage puts the wallet back at day zero. That's the entire trick: risk stops accumulating & starts compounding at one small fixed rate instead (Eq. 3). A quarterly calendar reminder takes the typical 2-of-3 from 22.8% to 12.8%; with a sane layout, to 0.79%.

Same three keys, five ways to hold them. The two red bars are the point: you can verify your quorum continuously & a doubled-up keyholder still puts a hard floor under your risk. Moving one key to its own person does more than any amount of checking.

Stretch the same fact over thirty years & you get the curve shapes of §03. The monitored curves are memoryless: by Eq. (3) the wallet faces the same small per-quarter risk forever. The unmonitored curve ages: nothing ever resets, dead keys pile up silently, & every year is more dangerous than the last. Reliability theory makes this exact (a k-out-of-n system of components with increasing failure rate is itself IFR; the Barlow–Proschan closure theorem [2]). The two regimes differ in kind, not degree: one is a renewal process; the other is a slow countdown nobody is watching.

But look at the two red bars: checking has a limit, & the limit is the layout. That's Takeaway #2.

07Takeaway #2: one person, many keys

Spare keys multiply safety, but only while keys genuinely fail separately. Concentrate two keys on one person, or let keys quietly share a household, a bank, an estate, & the multiplier evaporates. This section runs from the promise to the fine print.

The promise: spare keys multiply safety

Here's how fast the math moves underneath a setup. For independent keys a fatal window needs s = n−m+1 near-simultaneous losses, so p_f scales as the s-th power of the per-key hazard. Slack isn't padding; it's the exponent on your luck. Drag the slider & watch the same ×2 shock hit five configurations ×2, ×4, ×8, ×16 & ×32.

Two ways to read this chart. The optimist's: you don't need to know your true hazard rate precisely; you need to buy slope. A 3-of-5 tolerates being wrong about the world ~100× better than a 2-of-2. The auditor's: the cells under the chart report each configuration at your slider's hazard, & the ×-per-doubling column is the fragility number no vendor publishes. A quorum's quality isn't its risk at today's rates; it's the derivative of its risk with respect to being wrong.

The fine print, part 1: one person, many keys

Why is the floor so stubborn? Turn each hazard off & re-run the monitored typical 2-of-3. Removing individual key loss barely moves the number (12.5% → 12.2%); monitoring already handles slow, one-at-a-time attrition. Removing person events collapses it (12.5% → 3.2%). So the residual risk is almost entirely the simultaneous kind: one event that takes two keys at once. Detection is a race against the second failure, & a doubled-up holder makes the first & second failure the same event; you can't win a race of length zero.

This pattern deserves a name. We call it the 2-of-3 fallacy: mistaking a wallet's script parameters (m, n) for its redundancy, when redundancy actually lives in the layout (π, ℓ). A "2-of-3" whose three keys rest with two people is, against the dominant hazard, a 1-of-1.

& this isn't a simulation artifact; it's a one-line bound. If a single holder carries enough keys to break quorum, one person event is a fatal window all by itself, so no cadence can push p_f below the person-event rate. Proposition 2 below makes it formal: the floor for the typical 2-of-3 works out to 12.2% per decade, at any cadence. That's 96% of the full 12.8%; monitoring was never the problem.

The fine print, part 2: hidden correlation

Proposition 1 assumed independent losses. Reality rarely cooperates: keys share households, safe-deposit habits, disasters & estates. So we borrow the machinery credit-risk desks use for correlated defaults (a one-factor Gaussian copula) & watch what a hidden correlation ρ does to every configuration at once. Short version: it dissolves slack.

The copula couples each key's fate to a common latent factor F: key i is lost in a window when √ρ·F + √(1−ρ)·ε_i falls below its hazard threshold (Eq. 7). At ρ = 0 losses are independent & the slack law (Prop. 1) holds exactly. As ρ increases, the distribution of losses per window develops a heavy tail: windows cease to remove keys singly & begin to remove them in clusters, against which the slack exponent provides no protection. The dial below varies ρ; the copula toggle substitutes a heavier-tailed dependence structure at the same ρ.

Effective slack

Equation (6) identifies the log–log slope with the slack under independence. The effective slack exponent is the same slope evaluated under the copula:

Evaluating the model by quadrature at the calibrated family rates (q = 0.0083 per quarter) gives, for a 3-of-5 with one key per person & place:

ρ = 0

s_eff 2.99 (nominal s = 3) · P(stranded, 10y) 0.02%

ρ = 0.1

s_eff 2.50 · P(stranded, 10y) 0.14%

ρ = 0.2

s_eff 2.15 · P(stranded, 10y) 0.54%

ρ = 0.3

s_eff 1.87 · P(stranded, 10y) 1.4%

ρ = 0.4

s_eff 1.66 · P(stranded, 10y) 3.1%

ρ = 0.6

s_eff 1.36 · P(stranded, 10y) 8.8%

ρ = 0.8

s_eff 1.15 · P(stranded, 10y) 17.6%

A moderate & easily unobserved ρ = 0.3 (shared households, a common safe-deposit institution, a common estate attorney) converts a nominal s = 3 design into an s ≈ 1.9 design & multiplies its ten-year risk by a factor of approximately 65. Correlation changes neither m nor n; it lowers the exponent you actually own. (For a 2-of-3 the same computation takes s_eff from 1.99 at ρ = 0 to 1.11 at ρ = 0.8.)

08Conclusion: recommended configurations

If you remember one row, make it yours. The pattern across group types: m ≈ ⌈(P+1)/2⌉, one notch lower for high-churn groups, one higher if you're a target. One key per holder, checked quarterly, always.

That's the framework: model the joint lifetimes (Eq. 1), compound one window (Eq. 3), then defend the exponent: spread the keys, check on a calendar, & never let m = n. The appendix holds the code, the error analysis & the references.

09Appendix — calibration, secondary channels, error

The apparatus behind the figures: every symbol, every rate with its source, the secondary risk channel, & the error analysis for everything simulated. All of it reproducible from quorum_model.py.

A.1 · Notation

𝒞 = (M, N, π, ℓ)

custody configuration: threshold, key count, layout maps π : keys → people, ℓ : keys → places (Def. 1)

s = N − M + 1

slack: deaths one window must contain to be fatal

λ_key, λ_per, λ_loc

Poisson rates of the three failure channels; λ their sum (Eq. 1–2)

d · q

check cadence in months · per-key marginal death probability per window (Eq. 2)

p_f · τ

fatal-window probability · stranding (hitting) time (Eq. 3)

ρ · F · s_eff

latent correlation · systemic factor · effective slack exponent (Eqs. 7–8)

Φ, φ

standard normal CDF & density

A.2 · Calibration & sensitivity

Rates & their anchors are stated inline in §04; each carries a ×0.5–×2 band. Sensitivity, formally. Under independence, Eqs. (2) & (4) give the elasticity ∂ ln p_f / ∂ ln λ_j ≈ s · λ_j/λ: errors in any one rate are damped by its share of the total hazard & then amplified by slack. For typical layouts the floor term of Prop. 2 dominates instead: elasticity ≈ 1 in λ_per, near 0 in λ_key — which is exactly the ablation §06 reported (removing key loss: 12.5% → 12.2%; removing person events: 12.5% → 3.2%). The ablation is the discrete version of these derivatives. Every ordinal claim on this page — the fallacy, the exponent law, the cliff, the correlation collapse — is checked at the corners of the box [λ̂/2, 2λ̂]³ in the companion report & survives; point estimates are for calibration, the geometry is the result.

A.3 · Theft & collusion — the secondary channels

External theft is modeled as targeted campaigns arriving at rate λ_camp/yr; conditional on a campaign, each person is independently compromised with probability c, & the attacker succeeds iff the compromised people jointly hold ≥ M keys — a threshold coverage problem over the layout, computed by exact enumeration over the 2^|𝒫| person subsets:

Note the layout appears again: a doubled-up holder is one phishing victim away from two keys. Insider collusion is handled by a deliberately simple heuristic: an annualized pairwise-collusion rate, discounted geometrically for each additional conspirator a coalition of M requires. This component is explicitly illustrative, the least-calibrated in the model; the load-bearing comparison (stranding dominates theft by roughly an order of magnitude across configurations) survives a tenfold error in either theft channel.

A.4 · The simulation: code & error

The entire engine fits in a screenful. This is the page's own Figure-1 loop, lightly annotated (quorum_model.py mirrors it):

function trial() {                              // one ten-year lifetime, monthly steps
  const alive = [true, true, true];
  for (m = 1; m <= 120; m++) {
    personDown = people.map(() => rand() < p_per);   // person events   (Eq. 1: A)
    locDown    = places.map(() => rand() < p_loc);   // location events (Eq. 1: B)
    for (k of keys)
      if (alive[k] && (personDown[holder[k]] || locDown[place[k]] || rand() < p_key))
        alive[k] = false;                            // individual loss (Eq. 1: E)
    if (count(alive) < m_required) return STRANDED;
    if (checking && m % 3 === 0) alive.fill(true);  // check-in: reset the clock
  }
  return SURVIVED;
}
P̂(10y) = stranded / trials                           // Fig. 1(b) · closed form: Eq. (3)

Wherever simulation is used, the estimator is the sample proportion p̂_f = X/n over i.i.d. windows, with the decade figure obtained through Eq. (3). Standard errors propagate by the delta method:

Worked instance: the copula race bars run n = 120,000 windows per configuration; at p̂_f = 0.0034 (typical 2-of-3), SE(p̂_f) = 1.7×10⁻⁴, so the decade estimate carries a 95% CI of ±1.2 pp — invisible at the scale of the effects shown, which span two orders of magnitude. The §01 tally displays its CI live (it is the one estimator on the page that starts small). Figure 4 is exact (Eq. 3) & carries no simulation error; the heatmap values are converged sweeps from the companion report. Rare-event caveat: for cells below ~10⁻⁴ the relative error of naive Monte Carlo is large even when the absolute error is tiny — those cells are reported as <0.01% rather than as point estimates.

A.5 · Related work & contribution

Threshold cryptography [6] makes M-of-N enforceable & studies adversarial signers; it is silent on whether honest signers survive. Reliability theory has studied k-out-of-n systems since the 1960s [2], the common-cause-failure literature [3] arose precisely because independence assumptions failed in engineered systems whose redundancy proved only nominal, & credit-portfolio theory [4,5] contributes the factor-copula machinery for correlated ruin. Bitcoin custody guidance, meanwhile, recommends quorum scripts without survival probabilities. The contribution of this report is the bridge: treating the custody layout — not the script — as the reliability object, & deriving the design rules (the layout floor, the slack exponent, the M = N boundary) that follow.

A.6 · References

• [1] Marshall, A.W. & Olkin, I. (1967). A multivariate exponential distribution. J. American Statistical Association 62(317), 30–44.
• [2] Barlow, R.E. & Proschan, F. (1975). Statistical Theory of Reliability & Life Testing. Holt, Rinehart & Winston.
• [3] Mosleh, A., Rasmuson, D.M. & Marshall, F.M. (1998). Guidelines on Modeling Common-Cause Failures in Probabilistic Risk Assessment. NUREG/CR-5485, U.S. Nuclear Regulatory Commission.
• [4] Vasicek, O. (2002). The distribution of loan portfolio value. Risk 15(12), 160–162.
• [5] Li, D.X. (2000). On default correlation: a copula function approach. J. Fixed Income 9(4), 43–54.
• [6] Desmedt, Y. & Frankel, Y. (1989). Threshold cryptosystems. Advances in Cryptology — CRYPTO '89, 307–315.

A.7 · Citation & version history

Draft v2.0, September 2026. v1.0: initial interactive article. v1.1 (Aug 2026): formal apparatus added; §05 re-engined with an effective-slack readout & a Student-t dependence stress; front matter restructured. v1.2 (Sep 2026): apparatus pruned to the results that carry the argument; equations renumbered (1)–(10). v1.3 (Sep 2026): retitled "How Safe Is My Multisig?"; the compounding rule demoted from proposition to prose (Eq. 3), remaining Propositions 1–3; front-matter & prose lightened. v1.4 (Sep 2026): the interactive quorum designer removed, to reappear as a standalone piece; liveness dropped from the surfaced model accordingly; the fatal-window probability renamed to p_f; Figure 1 fixed to the base case (one key per holder, unmonitored) with its toggles removed. v1.5 (Sep 2026): abstract & connective prose rewritten in the author's voice; formal statements, equations & data unchanged. v2.0 (Sep 2026): restructured for the long-form video treatment — hook, model, results, loss channels (calibration moved into the body), then two named takeaways & a conclusion; figures, propositions & equations renumbered; simulation code added to A.4. Suggested citation:

@misc{cofund2026rr04,
  author       = {{Cofund Research}},
  title        = {How Safe Is My Multisig? An Exercise in Modeling p(lose quorum)},
  year         = {2026},
  month        = sep,
  howpublished = {Cofund Research Report RR-04, interactive article},
  note         = {Draft v2.0}
}

Companion report: What Is an Economic Node? (RR-03).