Multi-signature wallet security?
Hoosat Network4 min read·Just now--
Multi-signature wallets require M amount of signatures to send transactions out of the wallet.
Multisig wallets are usually configured as M-of-N:
- N = total number of signers (private keys).
- M = minimum number of signatures required to send a transaction.
Popular examples as m-of-n:
- 2-of-3: Any 2 out of 3 signers must approve.
- 3-of-5: Any 3 out of 5 must approve.
- 2-of-2: Both must approve (very secure, both parties need to agree).
This is the typical process to send coins from a multisignature wallet:
- Any private key holder of the wallet creates a unbroadcasted transaction and signs the transaction with their own private key.
- The partially signed transaction is then shared with the other signers (via wallet app, email, etc)
- Signers who decide to accept the transaction sign the transaction and share their partially signed transaction.
- The transaction is broadcasted to network when enough signers sign the transaction.
This means if something uses for example 2-of-3 method, mostly used by escrows where you want either seller & escrow to release the funds or buyer & escrow to release the funds. Then when buyer and seller disagree the third party escrow can decide which direction the funds are released.
Basically in dispute situation the escrow would receive partially signed transaction from both the buyer and seller and both would most likely show proof to the escrow that they are right on getting the funds from the wallet. The escrow decides which partially signed transaction he signs and broadcasts to the network.
This method has a draw back, it requires that all the 3 parties of the escrow wallet are different participants.
Then comes something like Cryptix Decentralized Exchange
Cryptix Networks so called decentralized exchange. The so called DEX acts as escrow of the trade. Utilizing 2-of-3 multisignature wallet.
This means if Cryptix Network developer Cryptis decides he can impersonate the buyer or seller and then he has access to two private keys of the trade and can scam the exchange user by having the keys for himself to broadcast the transaction without the users consent.
This scam process by the exchange that has access escrow private key, following the fact that two assets are traded in both directions.
- Seller of coin sends transaction to wallet S.
- Buyer of coin should send transaction to wallet B.
- Now the buyer creates transaction out of wallet S and partially signs with their private key.
- Now the escrow signs partially transaction out of wallet S and broadcasts the transaction out of the wallet.
- Seller did not receive anything on wallet B and his original coin was stolen from wallet S, because the escrow acted as the buyer.
Sure, Cryptis most likely has not done this, as he would lose too much for scamming his exchange users at the moment if he is looking to do same anonymous dump as some other cryptocurrencies. I’m just explaining that this is possible because of the design of his exchange. This displays the fact that his decentralized exchange is nowhere decentralized. It is closed source and has centralized authority which could scam you as user of the exchange like any centralized exchange can, even if he utilizes user runnable wallet daemon and partial exchange system to do stuff decentrally.
Worth noting that he is breaking Europe MiCa for advertising his exchange to European users in their native languages and the fact that he is acting autonomously as the escrow of the trades. His exchange can be shut down any day by European legislation as his server is hosted in Germany by Prepaid hoster.
Real decentralized L1 exchange code is open source and does not require escrow, but allows third party escrows. The difference with L2 DEX escrow is that it’s autonomous public code. Cryptix Network DEX escrow is closed source and can not be openly peer reviewed, so he does this in a way that is spreading false security to his users, and may be partly because of his egoistical fallacies in cryptocurrencies.
As in this exchange is created by a anonymous developer who copied Kaspa in 2025 and thinks Kaspa 10 BPS is impossible and the blocks are processed in single line, which is why he has also invented fast-chain where transactions are lazy loaded, which sacrifice security another blog post about that coming.
The only good side his exchange code seems to have is the fact that users are not required to hold their assets in the exchange. If Cryptis was real crypto savior, he would have created his decentralized exchange without this escrow decision functionality and removing the ability from himself scamming his own users, because using two 2-of-2 wallets is sufficient and secure to do trades. It would also force handling disputes between trade parties in a manner that both would be happy, instead of escrow ruling in favor of either one.
This is only to display to you that mutlisignature wallets can actually be used for theft when they are incorrectly used. As in falicitiator of trade should not act as the escrow.
