Cooperative Custody
A custody model where user and service provider jointly control keys, combining self-custody security with professional recovery support.
Key Takeaways
- Cooperative custody (also called collaborative custody) distributes key control between the user and a service provider using a 2-of-3 multisig setup: the user holds two keys, the provider holds one, so the provider can never unilaterally move funds.
- It eliminates the main weakness of pure self-custody: if a user loses one key, they can recover funds using their remaining key plus the provider's key, without sacrificing sovereign control during normal operation.
- Cooperative custody bridges the gap between full self-custody (where the user bears all risk of key loss) and full third-party custody (where the custodian controls the keys), offering a middle path for individuals and institutions that want security with a recovery safety net.
What Is Cooperative Custody?
Cooperative custody is a Bitcoin custody model in which the user and a service provider jointly manage a set of cryptographic keys, typically through a 2-of-3 multisig wallet. The user holds two of the three keys (often on separate devices or in separate locations), while the provider holds the third. Any transaction requires two signatures, meaning the user can transact independently using their two keys, or can involve the provider if one key is lost or unavailable.
The model was popularized by companies like Unchained (formerly Unchained Capital) and Casa, which offer cooperative custody services for Bitcoin holders who want the sovereignty of self-custody without bearing the full risk of key loss alone. The provider acts as a backup signer and recovery partner, not as a custodian: they cannot move funds without the user's participation.
This approach reflects a core principle of Bitcoin key management: eliminate single points of failure. If the user loses one key, the provider helps them recover. If the provider disappears or is compromised, the user still controls two keys and can move funds independently. Neither party alone can lose or steal the Bitcoin.
How It Works
Cooperative custody is built on Bitcoin's native multisig capabilities. The standard implementation uses a 2-of-3 multisig address where two signatures from any of the three keys are required to authorize a transaction.
Key Distribution
In a typical cooperative custody setup, three keys are generated and distributed:
- Key 1 (user primary): held by the user on a hardware signing device such as a cold storage wallet. This is the key used for day-to-day transactions.
- Key 2 (user backup): held by the user in a separate, geographically distinct location, often on a second hardware device or stored as a seed phrase backup. This key is the user's recovery key.
- Key 3 (provider): held by the cooperative custody provider in their secure infrastructure, typically protected by hardware security modules. This key is only used when the user requests co-signing assistance.
Transaction Signing
Because the wallet requires 2-of-3 signatures, there are three possible signing combinations:
| Scenario | Keys Used | When |
|---|---|---|
| Normal transaction | User primary + user backup | User signs independently without provider involvement |
| Assisted transaction | User primary + provider | User needs convenience of a single device; provider co-signs after verification |
| Recovery | User backup + provider | User primary key is lost, damaged, or compromised |
Transactions are typically coordinated using Partially Signed Bitcoin Transactions (PSBTs), which allow each party to add their signature independently without exposing private keys. The user creates the transaction, signs with one key, and passes the PSBT to the second signer (either their backup key or the provider).
Vault Setup Example
A cooperative custody vault is a standard Bitcoin multisig address. The following illustrates the conceptual structure:
// 2-of-3 multisig cooperative custody setup
// User generates two keys, provider generates one
const userPrimaryXpub = "xpub6C..."; // Hardware wallet A
const userBackupXpub = "xpub6D..."; // Hardware wallet B (offsite)
const providerXpub = "xpub6E..."; // Provider's HSM-backed key
// Bitcoin descriptor for the multisig wallet
const descriptor = `wsh(sortedmulti(2,
${userPrimaryXpub}/0/*,
${userBackupXpub}/0/*,
${providerXpub}/0/*
))`;
// Any 2 of the 3 keys can authorize a spend
// Provider alone can NEVER move fundsFor a deeper look at how PSBTs enable this workflow, see the PSBT multisig workflow guide.
Cooperative Custody vs. Other Models
Understanding cooperative custody requires comparing it to the two extremes it sits between: full self-custody and full third-party custody.
| Feature | Self-Custody | Cooperative Custody | Third-Party Custody |
|---|---|---|---|
| Key control | User holds all keys | User holds 2 of 3 keys | Custodian holds all keys |
| Can provider move funds alone? | N/A | No | Yes |
| Recovery if key lost | No recourse | Provider assists recovery | Custodian manages recovery |
| Counterparty risk | None | Minimal (provider cannot steal) | Full (custodian failure = loss) |
| Regulatory compliance | User responsibility | Provider may assist | Custodian manages |
| Inheritance planning | Complex | Provider can facilitate | Custodian manages |
Cooperative custody also differs from MPC wallets, which split a single private key into shares using cryptographic protocols. In cooperative custody, each key is a complete, independent private key stored on its own device. For a detailed comparison of these approaches, see the MPC vs. multisig custody analysis.
Use Cases
Individual Bitcoin Holders
Long-term Bitcoin holders who want to secure significant savings without the stress of being a single point of failure. Cooperative custody provides peace of mind: a lost hardware wallet does not mean lost Bitcoin, because the provider holds a recovery key.
Inheritance and Estate Planning
One of the hardest problems in self-custody is ensuring heirs can access funds. Cooperative custody providers offer inheritance protocols where a designated beneficiary can work with the provider to access funds using the backup key after the owner's death, typically with identity verification and a waiting period.
Institutional Treasury
Companies holding Bitcoin on their balance sheet benefit from cooperative custody because it provides professional key management infrastructure while keeping the organization in control of the majority of keys. This satisfies both internal security policies and external audit requirements. For more on institutional approaches, see the Bitcoin custody solutions comparison.
Bitcoin-Collateralized Lending
Some cooperative custody providers offer Bitcoin-collateralized loans where the borrower's Bitcoin remains in a multisig vault during the loan term. The lender (or provider) holds one key, the borrower holds two. The borrower retains control of the collateral and can verify on-chain that funds have not been rehypothecated.
Major Cooperative Custody Providers
Several companies have built businesses around the cooperative custody model, each with different approaches to key management, client support, and additional services:
- Unchained: pioneered the cooperative custody model for Bitcoin. Offers 2-of-3 multisig vaults, inheritance planning, trading services, and Bitcoin-collateralized lending, all with the client maintaining majority key control.
- Casa: provides cooperative custody with a focus on user experience. Offers tiered plans from 2-of-3 to 3-of-5 multisig, mobile key management, and a health check system that monitors key accessibility.
- Nunchuk: offers collaborative multisig wallet software that supports cooperative custody setups, with both assisted and fully self-sovereign key configurations.
Why It Matters
Cooperative custody addresses the most common objection to Bitcoin self-custody: the fear of permanent loss. Studies have estimated that millions of Bitcoin may be permanently lost due to mismanaged keys. By providing a recovery partner who cannot independently access funds, cooperative custody makes self-sovereign Bitcoin ownership accessible to a much broader audience.
This model is particularly relevant as Bitcoin adoption grows beyond technically sophisticated early adopters. New users, families, and businesses need custody solutions that do not require them to become security experts. Cooperative custody achieves this without surrendering the fundamental principle that separates Bitcoin from traditional finance: the user remains in control.
For users exploring modern custody architectures on Bitcoin Layer 2 networks, Spark offers a self-custodial approach where users maintain sovereign control over their Bitcoin and stablecoins without relying on a third party to hold keys. See the self-custodial vs. custodial wallets comparison for more on how different custody models compare in practice.
Risks and Considerations
Provider Dependency
While the user can always transact independently using their two keys, the recovery benefit depends on the provider remaining operational. If the provider shuts down, the user must ensure they have both of their own keys accessible. Reputable providers mitigate this by publishing key recovery documentation and using open standards like output descriptors so wallets can be reconstructed with any compatible software.
Privacy Tradeoffs
The cooperative custody provider holds one of the three keys and participates in wallet creation, which means they know the wallet addresses and can observe on-chain activity. Users who require maximum financial privacy may find this visibility unacceptable. Some providers mitigate this with privacy policies and data minimization, but the structural exposure remains.
Cost
Cooperative custody services charge annual fees, typically ranging from a few hundred to several thousand dollars depending on the provider and tier. This is a recurring cost that pure self-custody does not incur. Users must weigh the cost against the value of the recovery safety net and professional support.
On-Chain Multisig Footprint
Traditional 2-of-3 multisig transactions are larger on-chain than single-signature transactions, resulting in higher fee rates. However, Taproot and MuSig2 are changing this: key-path spends in a Taproot multisig look identical to single-signature transactions on-chain, improving both privacy and cost efficiency. For more on multisig techniques, see the multisig wallets deep dive.
Not a Substitute for Security Practices
Cooperative custody reduces single points of failure but does not eliminate the need for sound security practices. Users must still store their keys securely, protect their seed phrases, and verify transactions before signing. A user who stores both of their keys in the same location gains little benefit from the multisig structure.
This glossary entry is for informational purposes only and does not constitute financial or investment advice. Always do your own research before using any protocol or technology.