What If Bitcoin Cosigner Disappears

Cosigner Disappearance in Multisig Arrangements

This memo is published by CustodyStress, an independent Bitcoin custody stress test that produces reference documents for individuals, families, and professionals.

How Multisig Creates Dependency

Multisig arrangements distribute control among multiple keyholders, creating security through required cooperation. But cooperation requires that all necessary parties remain available and willing to participate. The question what if bitcoin cosigner disappears addresses a vulnerability built into these arrangements: a cosigner can vanish from the holder's life with no consequence to themselves while the holder loses access to funds that required that cosigner's signature. This asymmetry creates risk that operates in one direction only.

This assessment considers cosigner disappearance and its effects on multisig custody. Disappearance takes many forms—death, relocation without forwarding information, relationship breakdown, simple neglect of responsibilities that carry no penalty for neglect. Each form removes a cosigner from availability while leaving the holder dependent on participation that can no longer be obtained. The arrangement that provided security through distribution becomes a trap when a required participant is no longer present.

---

How Multisig Creates Dependency

Multisig arrangements require multiple signatures to move bitcoin—commonly two of three, three of five, or similar configurations. This requirement protects against single points of failure: no one person's key compromise or loss eliminates access. But the same structure that prevents single-point failures creates dependency on the ongoing availability of enough signers to meet the threshold. Protection against one threat introduces vulnerability to another.

Dependency operates asymmetrically among participants. The holder whose bitcoin sits in the multisig wallet has everything at stake—their funds are locked until sufficient signatures are obtained. A cosigner who holds a key but owns none of the bitcoin has nothing personal at stake if they disappear. Their key matters only to the holder, not to them. Walking away from the arrangement costs the cosigner nothing while potentially costing the holder everything held in that wallet.

This asymmetry is not apparent when the arrangement is created. At setup, everyone is present, willing, and cooperative. The cosigner agrees to participate; the holder trusts them to remain available. Neither party is thinking about what happens if the cosigner simply stops being reachable, because at the moment of agreement, reachability seems assured. The arrangement locks in dependency on future cooperation without locking in that cooperation.

---

Forms of Disappearance

Death represents the most complete form of cosigner disappearance. A cosigner who dies takes their signing capability with them unless they made arrangements to pass their key to someone else—arrangements the holder may know nothing about. Even if the cosigner's key can be recovered from their estate, doing so requires locating it, establishing legal authority over it, and coordinating with the cosigner's heirs or executor, all of which introduce delays and complications. The holder's ability to access their bitcoin now depends on navigating someone else's estate situation.

Geographic relocation can sever contact without any dramatic event. A cosigner who moves to another country, changes phone numbers, and does not maintain the prior relationship gradually becomes unreachable. The holder may not realize this has happened until they need a signature and discover that all their contact methods fail. No one intended the relationship to dissolve; it simply faded through the ordinary drift of lives moving in different directions. By the time the holder needs the cosigner, the cosigner is effectively gone.

Relationship breakdown creates disappearance even when the cosigner remains physically locatable. A friend who becomes an enemy, a family member who becomes estranged, a business partner who becomes a litigant—each represents someone who might technically be findable but who cannot be counted on to cooperate. The cosigner exists but their willingness to participate has evaporated. Locating them accomplishes nothing if they refuse to sign or demand conditions the holder finds unacceptable.

---

The Absence of Consequences for the Cosigner

Nothing typically compels a cosigner to remain available or to cooperate when asked. Unlike formal fiduciary relationships with legal obligations, informal cosigner arrangements rest on goodwill and continued relationship. If the goodwill fades or the relationship ends, the cosigner's obligations evaporate. They can decline to sign, ignore messages, move without notice, or simply lose interest, and nothing bad happens to them as a result. The consequences fall entirely on the holder.

Formal agreements between cosigners and holders are rare. Most personal multisig arrangements operate on informal understandings: "I'll help you if you need me to sign something." This informality felt sufficient when the arrangement was created because everyone trusted everyone else. But informal agreements provide nothing when the relationship sours. The holder cannot sue a friend for failing to fulfill an oral promise to maybe someday sign a bitcoin transaction. There is no contract to enforce, no duty to breach.

Even when cosigners want to help, they may have moved on from the capability to help. A cosigner who agreed years ago may no longer have the signing device, may not remember where they stored their key, or may have lost materials in a move. Their willingness persists but their capability has degraded through the same entropy that affects any custody materials. They cannot sign even though they would, and the holder cannot recover something the cosigner no longer possesses.

---

Threshold Mathematics Under Disappearance

Multisig thresholds determine how many signatures are required to move bitcoin. A two-of-three arrangement requires two signatures from among three keyholders. If one keyholder disappears, the remaining two can still transact—the arrangement survives single-cosigner disappearance. But what survives one disappearance may not survive two. If a second cosigner disappears from a two-of-three setup, the sole remaining keyholder cannot meet the threshold alone. The buffer has been exhausted.

Higher thresholds reduce redundancy more quickly. A three-of-five arrangement can tolerate two disappearances before becoming non-functional, but as signers disappear, the margin shrinks. Each disappearance moves the arrangement closer to the edge where one more departure would be catastrophic. The holder may not notice this gradual erosion if they are not tracking cosigner availability over time. They set up a five-person arrangement and assume five people remain available without checking whether that remains true years later.

Lower thresholds trade security for resilience. A one-of-three arrangement could survive two complete disappearances, but it also means any single keyholder can move the bitcoin without others' agreement—defeating much of the security purpose of multisig. The holder choosing their threshold implicitly chooses how much disappearance risk they accept in exchange for how much protection against single-signer compromise. Neither choice eliminates risk; each choice selects which risks to prioritize.

---

Warning Signs and Their Absence

Cosigner disappearance often proceeds without clear warning. The cosigner does not announce their departure; they simply become harder to reach. Messages go unanswered for longer periods. Phone numbers change without notification. Life changes—new jobs, new relationships, new locations—accumulate until the connection has functionally dissolved. The holder may sense the relationship cooling without recognizing that their bitcoin accessibility is cooling along with it.

Periodic check-ins might reveal erosion before it becomes total, but such check-ins rarely occur. Reaching out to a cosigner solely to verify they remain available feels awkward, unnecessary, and potentially insulting—as if the holder doubts the cosigner's reliability. So the holder does not reach out, the cosigner does not think to volunteer status updates, and both parties proceed in ignorance of how the other's circumstances have changed. Years pass without contact until the holder needs a signature and discovers the relationship no longer exists.

By the time the holder realizes a cosigner has disappeared, options for correction may be limited. Moving bitcoin out of the current multisig wallet into a new arrangement requires enough signatures to meet the current threshold. If the holder cannot reach sufficient cosigners to execute that transaction, they cannot escape the arrangement that has become problematic. They are locked into a configuration that depends on participants who are no longer available, with no way to migrate to a healthier configuration without the very signatures they cannot obtain.

---

Scenarios of Disappearance Impact

A holder set up a two-of-three multisig years ago with their spouse and a close friend. The friendship faded over time—nothing dramatic, just lives diverging. When the holder now needs to move bitcoin and asks the friend to sign, they receive no response. Follow-up messages go unanswered. The friend has effectively disappeared, leaving the holder and spouse as the only available signers. The two of them can still transact, but they have lost all redundancy. If either of them becomes unavailable now, the remaining person cannot act alone.

In another situation, a holder's cosigner dies unexpectedly. The holder attends the funeral but does not think to ask the cosigner's family about bitcoin-related materials. Months later, when the holder needs a transaction signed, they realize they never established how to obtain the deceased cosigner's participation posthumously. The cosigner's estate has been settled; personal effects were distributed or discarded. Whether the signing key still exists, and who possesses it if it does, is now a mystery that may have no answer.

A third scenario involves intentional non-cooperation. A business partnership dissolves acrimoniously. One partner holds bitcoin in a multisig that requires both partners' signatures. The departing partner refuses to sign transactions as leverage in the dispute, or simply out of spite. The holder's bitcoin is frozen not because the cosigner is unreachable but because the cosigner is actively refusing to participate. The relationship that made the arrangement sensible has inverted into a relationship that makes the arrangement destructive.

---

The Asymmetry as Structural Feature

Cosigner asymmetry is not a flaw in how particular arrangements were constructed; it is inherent in how multisig works. Any arrangement that requires cooperation from multiple parties depends on those parties being available and cooperative. When they are not, whoever owns the underlying assets suffers while those whose keys are merely required suffer nothing. This asymmetry exists regardless of how carefully the arrangement was designed or how well the participants were chosen. It is a property of distributing control rather than a mistake in implementation.

Recognizing this asymmetry reframes how cosigner relationships function. What feels like shared participation is actually asymmetric dependency. The holder depends on the cosigner in a way the cosigner does not reciprocate. The cosigner can exit the relationship at will; the holder cannot exit without the cosigner's cooperation. This power imbalance exists beneath the surface of cooperative arrangements and emerges only when cooperation fails to materialize.

Institutional cosigners—companies providing multisig services—modify this asymmetry somewhat by having contractual obligations and business reputations at stake. But even institutional cosigners can discontinue services, go bankrupt, or change terms. The structural asymmetry between owners and required signers persists regardless of whether signers are individuals or institutions; it merely takes different forms in different contexts.

---

Assessment

The question what if bitcoin cosigner disappears identifies a vulnerability inherent in multisig custody. Disappearance—through death, relocation, relationship breakdown, or simple neglect—removes a cosigner from availability while leaving the holder dependent on participation that can no longer be obtained. The cosigner's departure costs them nothing personally, as they have no stake in the bitcoin they were helping to protect. All consequences flow in one direction, toward the holder whose funds now require signatures that cannot be collected.

This asymmetry exists as a structural feature of distributing control. Any arrangement that requires cooperation from multiple parties creates dependency on those parties remaining available and willing. When dependency fails, the holder discovers that the security provided by distribution has transformed into a trap created by distribution. The same threshold that prevented unauthorized transactions now prevents authorized ones because insufficient signers remain.

Warning signs of cosigner disappearance often go unnoticed until the holder needs a signature. Relationships fade without dramatic endings, cosigners relocate without notification, and years pass without contact or verification that the arrangement remains functional. By the time the holder recognizes the problem, corrective options may require the very signatures that have become unavailable, leaving the holder locked in a configuration they cannot escape.

---

System Context

Examining Bitcoin Custody Under Stress

Bitcoin Multiple Signers Coordination

Bitcoin Inheritance Behavior When a Spouse Does Not Understand Bitcoin

← Return to CustodyStress