Multisig Wallet Signing Ceremony

Wallet Fleet

Total signers N 5

Signature threshold M 3

Trusted-display devices T 2

Attack

Ceremony Status

Idle — press Run

Valid signatures

0 / 3

Attack refusals

True destinationbc1q_true_recipient_9f2a…c71e

How it works

A multisig wallet requires M of N independent keys to sign before a transaction is valid — no single compromised device can move funds:

Ceremony succeeds ⇔ |{ i : sig_i valid ∧ verifies(tx) }| ≥ M

Each hardware device receives the raw, unsigned transaction bytes and must decide whether to sign. Two device tiers behave very differently under an address-poisoning attack, where host-side malware swaps the destination address shown to the user while leaving (or altering) the bytes actually sent for signing:

Trusted-display device — independently decodes the destination address from the raw transaction on its own secure screen, unreachable by host malware. It compares that decode against the address the user actually intended and refuses to sign on any mismatch.
Blind-signing device — has no independent display; it trusts whatever the (possibly compromised) host software tells it to sign, and produces a cryptographically valid signature for the attacker's transaction anyway.

So the real security property is not just M-of-N — it's how many of those M signers can independently verify what they're signing:

Attack is blocked ⇔ (N − T) has too few honest blind signers left
                     to still reach M once T trusted devices refuse
                  ⇔ N − T < M   (i.e. T > N − M)

Slide T below that line and the malicious transaction still collects M valid signatures from blind-signing devices even though every trusted device correctly refused — the ceremony completes, but on the attacker's transaction. This is the exact reasoning behind requiring hardware wallets with a secure, independent display for any signer in a high-value multisig quorum, and why "blind signing" is flagged as a risk by every major wallet vendor.

Verified & signed Refused (attack caught) Signed blind (compromised) Pending

⚠ Couldn't load the 3D engineThree.js failed to load from the CDN. Check your connection and reload.