Journal

Why a Written Device Register Outlasts Memory

When a family establishes a three-of-five multisig reserve, each signer memorizes their role. The eldest sibling knows the derivation path. A cousin in another city holds the backup device. Passphrase hints live in someone’s notes app.

This works until it does not.

The Failure Modes We See Repeatedly

Firmware drift. One signer updates their Ledger firmware without telling others. Derivation paths shift. A coordinated signature fails during an urgent withdrawal.

Geographic Key Distribution for Family Reserves

A family multisig arrangement with five signers sounds resilient. If all five devices and their recovery phrases sit in the same Seoul apartment, a fire, flood, or burglary compromises the entire arrangement at once.

Geographic distribution spreads risk across locations — but introduces coordination challenges that documentation must address.

Mapping Custodian Locations

During registration, we record each signer’s city, country, and the physical location of their device and recovery materials. Common patterns we document:

Offline Balance Verification Without Exposing Keys

Families often ask: how do we know our documented derivation paths still match our actual holdings without connecting hardware wallets to the internet?

The answer lies in extended public keys — xpubs — recorded during device registration.

What an Xpub Fingerprint Proves

During registration, each signer’s device exports an xpub for the documented derivation path. The register records this fingerprint. Later, using an air-gapped computer or a dedicated offline verification device, you can derive receive addresses from the xpub and compare them against blockchain records.

Choosing Hardware Wallets for Family Multisig

Not every hardware wallet supports every multisig configuration. Before purchasing devices for a family reserve, consider compatibility, firmware update practices, and the manufacturer’s track record for long-term support.

Multisig Compatibility

Bitcoin multisig through standards like BIP48 and output descriptors requires wallets that export xpubs in compatible formats. Ledger, Coldcard, and Keystone devices each handle descriptor export differently. Mixing models within one quorum is possible but adds documentation complexity.

We advise families to standardize on one or two models unless geographic availability forces variation.