name: bitcoin-hardware-multi-vendor-multisig
description: |
Multi-vendor multisig: combining HW wallets from different vendors
(Trezor + Ledger + Coldcard) for diversification. Coordinator-mediated
setup, descriptor sharing, threat model.
USE WHEN: designing multi-vendor custody, implementing 2-of-3
multisig with diverse hardware.
allowed-tools: Read, Grep, Glob
Multi-Vendor Multisig
Using HW wallets from different manufacturers for the same
multisig. Defense against single-vendor compromise (firmware bug,
supply chain).
Why multi-vendor
If all 3 keys are on Ledger devices and Ledger has a critical bug:
- All 3 keys potentially compromised.
- 2-of-3 = full theft.
Multi-vendor 2-of-3 (e.g., Trezor + Coldcard + Ledger):
- One vendor's vulnerability doesn't compromise majority.
- Need 2 simultaneous vulnerabilities + access.
- Substantially harder to attack.
Trade-offs
- Multi-vendor signing UX harder: each vendor has different
flows.
- Coordinator complexity: must speak multiple HW protocols.
- Recovery complicated: must remember which vendor goes where.
Setup
- Generate seeds on each device independently.
- Get xpubs at standard multisig path (e.g.,
m/48'/0'/0'/2' for
P2WSH; m/48'/0'/0'/2' for Tapscript variant).
- Use coordinator (Sparrow / Specter / Caravan) to:
- Combine xpubs into descriptor.
- Generate addresses.
- Verify each device shows the same multisig address.
- Register wallet policy on each device (Ledger especially needs
this).
- Test with small amount before full deposit.
Common configurations
2-of-3 with Trezor + Ledger + Coldcard:
- Trezor: hot signer (everyday use).
- Ledger: secondary signer.
- Coldcard: deep cold (airgapped, signed only for large txs).
3-of-5 with diverse vendors:
- Trezor + Ledger + Coldcard + BitBox02 + Jade.
- Higher availability + diversification.
Descriptor format
wsh(sortedmulti(2,
[trezor_fp/48h/0h/0h/2h]xpub_trezor.../<0;1>/*,
[ledger_fp/48h/0h/0h/2h]xpub_ledger.../<0;1>/*,
[coldcard_fp/48h/0h/0h/2h]xpub_coldcard.../<0;1>/*
))#chk
Or Taproot-multisig:
tr(KEY_AGGREGATE,
multi_a(2,
[fp1/86h/0h/0h]xpub1.../<0;1>/*,
[fp2/86h/0h/0h]xpub2.../<0;1>/*,
[fp3/86h/0h/0h]xpub3.../<0;1>/*))#chk
For Taproot, key-path can be a MuSig2 of all three (cooperative
spend). Less HW support currently.
Coordinator wallets
| Coordinator | Strengths |
|---|
| Sparrow Desktop | Cleanest cross-vendor; native PSBT |
| Specter Desktop | Web UI; multi-device flow |
| Caravan | Web-based, no install |
| Bitcoin Core + HWI | Most flexible, scriptable |
Recovery
- Backup descriptor along with seeds. Without descriptor, can't
reconstruct addresses without all 3 xpubs.
- Recovery contact info: where each backup lives.
- Document vendor + path explicitly.
Threat model considerations
- Common-mode failure: even multi-vendor doesn't help against
attacks on the wallet UX (e.g., compromised desktop coordinator
showing wrong address).
- Address verification on device is critical: each HW wallet
must independently confirm the full multisig address before
funds deposit.
Common pitfalls
- Coordinator-only address generation without verifying on each
device → all devices lie about their actual key contribution.
- Path mismatch: BIP48 path used inconsistently across devices.
- Wallet policy missing on Ledger → signing fails.
- Forgetting xpub backup → can't reconstruct without all 3
devices.
See also