A multi-signature (multisig) account in the Blockstream app requires two signatures to spend, so a copy of your recovery phrase is no longer enough to drain your wallet. The app offers two multisig account types: a 2FA Protected account (2-of-2) and a 2-of-3 account. Both add Blockstream as a co-signer behind two-factor authentication (2FA). The 2-of-3 account also adds a recovery key you control, so you never depend on Blockstream to spend.
This article explains how each account type handles single-signature custody risks and how the two compare. For the technical parameters behind each type, see 2FA multisig protection explained. To add either account to your wallet, see Set up a 2FA Protected or 2-of-3 account.
The Two Account Types
| 2FA Protected (2-of-2) | 2-of-3 | |
| Keys | Yours and Blockstream's | Yours, your recovery key, and Blockstream's |
| Needed to spend | Both | Your key plus either of the other two |
| Blockstream's role | Required co-signer | One of three signers |
| If Blockstream is unavailable | A timelock releases the funds to your key alone | You spend with your key and your recovery key |
| Extra backup to hold | None | A second recovery phrase |
Note: 2-of-3 accounts are available for Bitcoin accounts only. Liquid accounts support the 2FA Protected type.
2FA Protected Accounts (2-of-2)
Two keys exist. You hold one on your device, protected by your PIN and backed up by your recovery phrase. Blockstream holds the other. Both signatures are needed, so every spend passes through a check.
Your key signs on your device. Blockstream's key signs after you enter a 2FA code from a method you registered: an authenticator app, email, SMS, or phone call. Register more than one. With two or three methods active, you almost always have one to hand, which keeps you out of the reset process described below. You can also set a spending threshold, and payments below it go through without a code.
A thief who copies your recovery phrase holds one of two required keys, and the second one answers to your 2FA.
If Blockstream Becomes Unavailable
Every deposit into a 2FA Protected account carries a timelock. After it expires, your key alone can spend those funds, with no 2FA code and no Blockstream involvement. You choose the timelock period: 6, 12, or 15 months. The clock runs per deposit from the time it arrives, and moving the funds restarts it. Blockstream can delay you for at most the period you chose, and can never block you permanently.
Note: Liquid 2FA Protected accounts use a fixed timelock of about 45 days.
To keep all of your funds under 2FA protection, the app prompts you to move deposits that are approaching expiry. See Perform a redeposit.
If You Lose Every 2FA Method
You can request a two-factor reset with a new email address. The reset completes after a minimum of 12 months, plus any time remaining on the timelock of the funds you want to spend. During that window, anyone still holding an active 2FA method for the wallet can cancel the reset and spend right away, which is what stops a thief from using a reset to take your funds.
This is why it’s a good idea to register several 2FA methods on day one. For the reset steps, see Lost access to 2FA method. If you find a lost method after requesting a reset, see Cancel 2FA reset.
2-of-3 Accounts
A 2-of-3 account has three keys: yours, a recovery key you also control, and Blockstream's. Any two signatures can spend: your key with Blockstream's, or your key with your recovery key.
Day to day, it behaves like a 2FA Protected account, with the same 2FA check and the same spending threshold.
The difference is the recovery key. You hold it separately from your main recovery phrase and leave it unused in normal operation. It removes your dependence on Blockstream: if Blockstream's servers are unavailable, or you have lost every 2FA method, your key and your recovery key spend directly. Because the recovery key already gives you a way out, 2-of-3 accounts carry no timelock and never need a redeposit.
When you create a 2-of-3 account, you can generate a new recovery phrase for the recovery key, import one you already hold, or supply only its public key and keep the private key material outside the app entirely.
The recovery key also changes what losing your 2FA methods costs you. On a 2FA Protected account, you wait out a 12-month reset. On a 2-of-3 account, you spend today with your key and your recovery key. The reset remains available as a last resort for the case where the recovery key is gone too.
Failure Scenarios Compared
| Singlesig | 2FA Protected (2-of-2) | 2-of-3 | |
| Phone lost or destroyed | Restore from your recovery phrase | Restore from your recovery phrase | Restore from your recovery phrase |
| Recovery phrase stolen | Funds drained | The thief holds one of two keys and cannot spend | The thief holds one of three keys and cannot spend |
| Blockstream unavailable | Not applicable | Wait out the timelock, then spend with your key alone | Spend now with your key and your recovery key |
| All 2FA methods lost | Not applicable | Request a 12-month reset, or wait out the timelock | Spend now with your key and your recovery key |
Multisig Accounts in the App
Both types are accounts inside your existing wallet. You add one when you create a new account, alongside your singlesig accounts, and use the same balance screen and the same send flow. The only visible change is a 2FA step before the transaction broadcasts.
To add or change your 2FA methods, see Update 2FA method.