How does Blockstream Green's multisig security work?

Blockstream Green wallets use Bitcoin multisig to provide extra security to your assets. Multiple keys are required to send a transaction, making it harder for thieves and hackers to steal your assets. The first key is on your device protected by a PIN code and is backed up with a 24-word mnemonic. The second key is held on the Blockstream Green servers protected by two-factor authentication (2FA). 

Multisig Account Types

You can create two types of multisig accounts in your Blockstream Green wallet. You can also have multiple accounts of different types in the same wallet.

Standard Accounts (2-of-2)

This is the default account you get with all new Bitcoin and Liquid wallets in Blockstream Green. Both keys are required to send a transaction.

2-of-3 Accounts

This is a special type of account in Blockstream Green that can currently only be created within the desktop app. It is currently available for Bitcoin wallets only, not Liquid wallets.

Transactions are still sent in the same way as standard accounts. 2-of-3 accounts only provide an alternative option for recovery.  

Whenever you create a new 2-of-3 account, the app will provide a third key in the form of secondary mnemonic backup (in addition to your mnemonic backup for key 1). Each 2-of-3 account will have a separate secondary mnemonic backup.

Tip: For extra security, you can set up a new Blockstream Green wallet using a hardware wallet, with one key stored on the hardware wallet instead of your mobile device or desktop.

Multisig and Sending a Transaction

When sending funds from your wallet, you require a signature from two keys:

• Key 1: On your device, protected by PIN.
• Key 2: On the Blockstream servers, protected by 2FA.

If you do not have 2FA set up in your wallet, key 2 will automatically sign any transactions signed by key 1.

Note: You must make at least one transaction every 12 months (depending on your timelock settings) to ensure that your account is secured by 2FA. 

Multisig and Recovering an Account

If you lose access to your 2FA method, or the Blockstream Green service becomes unavailable, then the account recovery process is different depending on the type of account you are using:

Bitcoin Standard Account Recovery (nLockTime)

The recovery process for Bitcoin standard accounts requires pre-signed nLockTime transactions. If you have set an email address for recovery in your wallet’s settings, these nLockTime transactions will be emailed to you whenever you make a transaction.

Note: You must set an email address in advance to be able to recover a Bitcoin 2-of-2 account.

If you have not made any transactions within the timelock period (default 12 months), then the nLockTime transactions can be used to move your funds without requiring a signature from key 2 on the Blockstream servers.

To ensure that your wallet is always secured by 2FA, the app will request a redeposit for any funds that haven’t moved for the duration of the timelock period. 

Liquid Standard Account Recovery (CheckSequenceVerify)

Liquid Standard account recovery is similar to Bitcoin standard accounts, except that no emailed nLockTime transactions are required.

After the timelock period expires, if you have not made any transactions from your account, you can recover your funds using only the key on your device.

Bitcoin 2-of-3 Account Recovery (Backup Key)

With 2-of-3 accounts, at any time you can immediately access your bitcoins without 2FA by combining your third backup key with the key on your device. There is no timelock period.

Unlike standard accounts, 2-of-3 accounts do not require regular redeposits.