Holding the keys to your Bitcoin in a multisig wallet eliminates single points of failure. If a key is lost, destroyed, or compromised, your funds remain accessible due to fault tolerance. However, maintaining a healthy wallet requires timely action. Replace a compromised key immediately—but avoid unnecessary replacements to mitigate risks.
How Multisig Key Replacements Work
The Digital Safe Analogy
Imagine your multisig wallet as a digital safe. For a 2-of-3 setup, the safe has three keys but only two are needed to unlock it. If one key is compromised, you can't just generate a new key for the existing safe. Instead:
- Use the two secure keys to move funds to a new safe.
- The new safe is controlled by the original two keys plus a new replacement key.
Steps to Replace a Key
- Generate a new key (e.g., Key 4 to replace compromised Key 3).
- Construct a new multisig wallet with Keys 1, 2, and 4.
- Transfer all funds from the old wallet to the new one.
- Update whitelisted addresses and backup the new wallet config file.
👉 Learn more about multisig security best practices
When to Replace a Key
1. Compromised Seed Phrase
- Digital Exposure: If stored online or photographed, assume compromise.
- Lost/Destroyed/Stolen: Replace the key immediately.
2. Compromised Hardware Wallet
- Lost or Stolen Device: Even with a PIN, assume the seed is compromised.
- Hardware Failure: No replacement needed if the seed phrase is secure.
3. PIN Issues
- Forgotten PIN: Restore the seed on a new device—no key replacement.
- Compromised PIN: Only replace if the device was physically accessed.
When Not to Replace a Key
- Hardware Upgrades: Restoring the seed on a new device suffices.
- Minor Software Issues: No action needed if the seed is secure.
Risks of Unnecessary Replacements:
- Transaction fees.
- Errors during large transfers.
- Config file and whitelist updates.
👉 Explore advanced multisig strategies
How to Replace a Key
For Unchained Vault Users:
- Use the dashboard to generate a new key.
- Follow the guided replacement process.
For Self-Custody Wallets:
- Generate a new hardware wallet key.
- Back up the seed phrase offline.
- Build a new multisig wallet.
- Test with a small transaction.
- Transfer all funds.
Preventing Future Key Replacements
- Geographically distribute seed backups.
- Use metal backups for durability.
- Regularly audit device security.
FAQ
Q: Can I reuse addresses after a key replacement?
A: No—new wallet, new addresses.
Q: How long does a key replacement take?
A: Typically 1–2 hours, including testing.
Q: What if I lose two keys in a 2-of-3 setup?
A: Funds are irrecoverable. Diversify backups.
Need help? Consult Bitcoin experts for personalized guidance.