Crypto treasury security: multisig policy, thresholds and timelocks

Who can move funds, how many of them it takes, and which transactions have to wait.

The threshold

Treasury funds sit behind a multi-signature wallet. No single key can move value, and no single person holds enough keys to reach the threshold alone. Signers are separated by role and by device, so compromising one workstation does not compromise a quorum.

Two design points matter more than the specific numbers. First, the threshold has to be high enough that collusion is hard and low enough that a lost key or an unavailable signer does not lock the treasury — a scheme nobody can operate under pressure gets bypassed the first time it is inconvenient, and the bypass becomes the real policy. Second, key diversity matters as much as key count. Five signers all using the same hardware model, the same firmware and the same laptop image is one failure away from a single point of failure wearing a quorum's clothing.

Classes of transaction

Not every movement carries the same risk, so not every movement follows the same path:

• Operational — recurring, budgeted payments below a fixed ceiling. Quorum only.
• Discretionary — anything above that ceiling, or to a new destination. Quorum plus a timelock, so the transaction is visible before it can execute.
• Structural — changing signers, the threshold, or the timelock itself. Longest delay, and announced.

Class	Trigger	Requirement	Visibility
Operational	Budgeted, recurring, under ceiling	Quorum	On-chain after execution
Discretionary	Over ceiling, or a new destination address	Quorum + timelock	Visible before execution
Structural	Signer set, threshold or timelock change	Quorum + longest timelock	Announced in advance

The "new destination" trigger does a disproportionate amount of the work. Most treasury losses are not exotic cryptographic failures; they are a payment to an address that looked right. Treating a first-time destination as discretionary regardless of amount catches address-substitution attacks that quorum alone does not.

Why a timelock, and what it cannot do

A timelock does not stop a bad transaction. It makes a bad transaction visible while there is still time to react to it.

Be clear-eyed about the limits. A timelock is only a control if someone is watching, and only useful if there is a mechanism to intervene during the delay. A delay with no monitoring and no cancellation path is a waiting period, not a safeguard. The prerequisites are alerting on every queued transaction, at least one signer whose job is to review the queue, and a documented cancellation procedure that has been rehearsed rather than merely written.

The structural class is where the timelock earns its keep. An attacker who reaches quorum will try to change the signer set — that is how a one-off theft becomes permanent control. A long, announced delay on signer changes is the difference between an incident and a takeover.

Why publish this

Treasury policy is only a control if outsiders can check that it is being followed. Publishing the classes, the ceilings and the delays means an observer watching the wallet can tell whether a movement matched the stated policy — which is a far stronger guarantee than a promise that funds are held responsibly.

It is the same argument as not showing a presale progress bar. An unverifiable claim about our conduct is worth approximately nothing; a verifiable one is worth something precisely because you can catch us breaking it. Publishing the policy is what converts a promise into a testable statement.

Both commitments are written into our terms of service rather than living only in a blog post, which is the point at which they stop being marketing.