How a Safe Multisig Works With Hardware Wallets

A Safe multisig is a smart contract account that moves funds only when a set number of its owners sign the same transaction. Each owner holds a separate key, and putting each key on a hardware wallet keeps it off an internet-connected computer. The arrangement handles a lost or stolen key very well. It does nothing about every owner approving the same misleading payload, and the clearest proof of that cost about $1.5 billion.

That was the Bybit loss of February 21, 2025. Roughly 401,000 ETH left a Safe whose signers, according to shattered.io's reconstruction, all used hardware wallets and all followed procedure. The contract did what it was told. What failed was the screen. That distinction shapes every choice in a setup: how many owners, which devices, and what each signer checks before approving. The same source puts Safe's holdings at about $35.25 billion across more than 61 million accounts as of September 2026, so the question is not academic.

A Safe has a list of owner addresses and a threshold: the number of owner signatures a transaction needs before it can execute. In a 2-of-3 Safe, any two of three owners suffice. Shattered.io treats 2-of-3 as the minimum for meaningful value and recommends 3-of-5 for active treasuries.

A transaction starts as a proposal from one owner. Each other owner then reviews it and signs on their own device. When enough signatures have been collected to meet the threshold, the transaction executes. The hardware wallet's job is narrow. It keeps the private key on the device and signs whatever is presented to it. The device can only protect a signer as far as its screen tells the truth about what is being signed.

Two device features matter here. Ledger's Ethereum Signer Kit includes a verifySafeAddress method that shows the Safe's contract address on the device itself, independent of the web page. Clear signing, now the open standard ERC-7730, decodes the transaction on the device. According to Ledger's write-up of the Bybit case, that includes whether the operation is a plain CALL or a DELEGATECALL, which runs foreign code inside the Safe itself, and the true destination address. Changes to the Safe's own rules, such as adding or removing an owner or changing the threshold, are rendered the same way.

The threshold fixes what a single key can do. One compromised owner in a 2-of-3 Safe can propose a transaction but cannot complete one alone. One lost key leaves the other two owners able both to move funds and to replace the missing owner. Losing two of three leaves no quorum at all. The protection also assumes the keys really are separate. Humanity Protocol lost $36.4 million in June 2026, by shattered.io's account, because its multisig keys sat on a single compromised laptop.

Bybit, February 2025. Attackers compromised a Safe{Wallet} developer's machine and injected JavaScript into the front end. Signers were shown a routine transfer. What they actually signed was a DELEGATECALL that upgraded the Safe's implementation with hidden sweep functions. Ledger's Philippe Hébrard put the failure plainly: "the lack of a human-readable format for the delegatecall data makes it easier for signers to make a mistake." The threshold was met honestly, by people who were deceived.

A Safe module, September 15, 2026. A Safe holding a leveraged rsETH position lost 2,882.37 rsETH, around $7.7 million, without any owner signing. The owners had earlier enabled a module, a contract that, once added, can transact on the Safe's behalf without signatures. This module had an unprotected public entry point. CryptoTicker notes an earlier module exploit on May 25, 2026, which hit more than 86 Safes for $3.2 to 4 million.

Coldcard, July 2026. This was a Bitcoin device, not a Safe signer. It is relevant because it shows what one vendor's firmware flaw can do. A build error cut seed entropy from 128 bits to as little as 40, and TRM Labs counts about 1,816 BTC taken from more than 5,200 addresses without physical access to any device. A Safe whose owners all carried the same affected model would have had one key in effect, copied several times.

A Safe multisig is not MuSig2, the scheme Ledger promotes that combines several keys into one aggregated signature. Safe enforces its threshold in a smart contract that anyone can inspect on-chain. Nor is a module the same thing as a token approval. Both grant standing authority, but they are separate permissions and have to be checked separately. A hardware wallet cannot stop a token approval that has already been granted, and it cannot stop a module either.

The strongest objection comes from Ledger's chief technology officer, Charles Guillemet. Writing after the Coldcard breach, he warned that "adding complexity to a wallet setup can introduce new risks rather than eliminate old ones", and said a properly backed-up single-signature hardware wallet remains the sensible choice for most holders. For an individual with a modest balance, that is largely right. More devices mean more backups to lose and more steps to get wrong. It does not apply to a shared treasury. There the whole point is that no single person can move the funds, and a single-signature wallet cannot provide that.

For anyone who does run a Safe, the practical checks follow from the cases above. Device support for decoded, readable transactions is uneven:

• Under Ledger Enterprise Multisig, full clear signing works only on the Stax and Flex. The Nano X and Nano S Plus can view pending requests but cannot sign them with clear signing.
• Trezor enabled ERC-7730 on the Safe 7, Safe 5, Safe 3 and Model T on September 8, 2026, after a firmware update. The Model One is excluded.
• When no descriptor exists for a contract, Trezor falls back to blind signing and shows a warning. A Safe signer should treat that warning as a reason to stop, not to proceed.

Mixing vendors across owners limits the damage from a single firmware flaw. Checking the Safe's enabled modules, under Settings and then Modules, takes about five minutes and costs nothing. Removing a module costs a full threshold vote plus gas.

A threshold counts signatures, not understanding. The check that protects a Safe is whether each owner's device, on its own screen, shows the Safe address, the operation type and the real destination before anyone signs.