Lost a Multisig Signer's Device? Check the Remaining Quorum

If a multisig signer's device is lost, first determine whether its key is recoverable and whether the remaining authorized signers still meet the threshold. Device loss and permanent key loss are different problems. Do not reset working signers, disclose their backups or assume that support can lower the wallet's signing requirement.

Count independent signing authority, not devices

A threshold describes how many authorized signers must approve an action. Safe's setup explanation makes the difference between total owners and the required threshold explicit. Having three registered signers is not the same as requiring all three, and having several copies of one key does not create several independent authorized signers.

Start an inventory using public signer identifiers and access status. Which signer remains usable? Which device is merely unavailable? Does the correct recovery material exist? Treat a stolen device as a possible compromise as well as an availability problem. A familiar wallet label or a person saying they can help is not evidence that they hold an authorized key.

Broken hardware and exposed key material need different responses

A replacement device can sometimes restore the same signer rather than create a new one. Unchained's hardware-migration guide describes restoring existing recovery material and checking that the recovered key can sign. That is a product example; follow the actual manufacturer's supported recovery process for the device and backup format you use.

After restoration, compare the signer identity with the original wallet configuration before signing. A newly initialized device with a new seed represents a different key unless the wallet's authorized policy is changed to include it. Restoring one signer also does not, by itself, recreate all the other signers or supply their signatures.

If the device was stolen or key material exposed, merely restoring the same key does not revoke the other copy. Unchained's lost-or-stolen hardware guidance treats that as a key-replacement issue in its custody setup. Assess the actual exposure and use an authorized rotation process; do not assume the threshold makes every single-key compromise harmless in every configuration.

Wallet configuration is another part of recovery

For Bitcoin multisig, recoverability involves the spending policy and the relevant signer information as well as enough private signing capability. A public-only configuration or descriptor can help reconstruct the wallet and locate its outputs. It cannot manufacture a missing private signature. Do not confuse successfully viewing a balance with possessing the required spending authority.

Unchained's third-party recovery explanation describes using a wallet configuration file when recovering its vault in supported external tools. Configuration data can expose the wallet's financial history, and exports differ. Keep it protected rather than posting the complete file in a forum or assuming every export contains only harmless public labels.

Sparrow's best-practices guide emphasizes securing multiple devices and their backups separately for multisig. Do not dismantle the remaining working setup to experiment with recovery. Preserve original files and document the current policy before making changes that could remove another route of access.

Safe owner changes and Bitcoin policy changes are different

Safe's owner-management guide states that owner changes and signing-policy updates enter the confirmation queue like other transactions. If enough current authorized signers remain, they can use the supported process. Connecting one owner wallet does not automatically authorize it to change a higher threshold alone.

Bitcoin outputs already locked to a multisig policy do not become governed by a different key set merely because a coordinator displays new settings. A key replacement with funded outputs generally involves an authorized spend into the new policy. Unchained's replacement example describes a sweep requiring the existing quorum in its 2-of-3 vault.

These are product and protocol distinctions, not instructions to use one platform for every recovery. Review the destination policy, signer identities and required approvals before signing any proposed replacement. A transaction labelled recovery can still move assets, so the amount and destination deserve the same scrutiny as an ordinary spend.

An existing recovery mechanism is not a universal override

Safe's RecoveryHub explanation describes recovery arrangements configured beforehand, including conditions and delays. If the ordinary threshold is unavailable, check whether such a mechanism was actually installed and what it authorizes. Its existence in a help article is not evidence that it is active on your account.

Do not copy a default recovery delay from an old guide or assume notifications will arrive automatically. Inspect the actual configured recovery and monitor its status through trusted sources. A person cannot create missing authority merely by calling themselves support, a recoverer or the wallet manufacturer.

Work through the access problem without widening it

1. Record the network, wallet or Safe address, current policy and public signer identifiers. Keep private backups out of the inventory shared with support.
2. Classify the incident: broken device, unavailable device, lost backup or suspected compromise. These can require different actions.
3. Determine which distinct authorized signers can still approve and whether their number meets the current threshold.
4. If restoring a signer, use its correct backup through the trusted supported process and verify the resulting identity.
5. If rotating authority, inspect the actual owner-change or fund-transfer proposal, destination and required signatures before approval.
6. After the authorized change completes, verify the new policy and receiving details, then update protected recovery records.

If neither a sufficient quorum nor a usable preconfigured recovery route can be established, do not promise an immediate recovery. Preserve the remaining material and seek help through independently verified product support. A demand for all remaining seed phrases or an upfront transfer to 'remove multisig' is not a substitute for authorized signing.

For the underlying model, read multisig wallets explained. If funds later need a no-account swap, restore ordinary authorized access before preparing the payment. The how-it-works page describes an exchange process; an exchange service does not replace your multisig quorum or authorize a change to its signers.