Multisig wallets

A normal wallet has one coldkey. If that key leaks or is lost, everything it holds is at risk. A multisig wallet removes that single point of failure.

A multisig is an address controlled by a group of keys and a threshold. A 2-of-3 multisig has three keys, and any two of them must approve before anything happens.

That protects you both ways. If one key is stolen, the attacker can propose a transfer but cannot complete it, and you simply never approve it. If one key is lost, the other two can still move the funds to a new wallet.

The keys can belong to different people, such as a team's shared funds, or to one person on separate devices.

There is no single multisig key to steal. The address is worked out from the member keys and the threshold, so the same keys and threshold always give the same address.