Timechain Wiki

Collaborative custody services

17 min read

Collaborative custody is 2-of-3 (or 3-of-5) multisig where one key is held by a business partner whose role is technical expertise, recovery support, and inheritance assistance — without ever being able to move funds unilaterally. The partner holds one of three keys; the holder retains spending authority with their own two keys. What is outsourced is complexity management: descriptor backup, configuration expertise, and documented recovery and inheritance procedures. The major 2026 providers are Unchained (white-glove, inheritance-focused, attorney-coordinating), Casa (multi-key architecture, tools-first), Nunchuk (sovereignty-minimized), and The Bitcoin Adviser (estate-planning-bent); Bitkey (Block, Inc.) is a structurally similar consumer hardware-wallet product. Trade-offs are real — the partner knows the holder holds Bitcoin, counterparty longevity matters (mitigated by sovereign-recovery commitments), service fees apply. For Tier 2+ holders who recognize themselves as their largest threat and prefer outsourcing complexity to building operational discipline from scratch, collaborative 2-of-3 is often the right answer.

Why this note matters

Collaborative custody is the practical answer for a large fraction of substantial holders who would otherwise be exposed to single-sig risk or overwhelmed by DIY multisig complexity. The note matters because:

  • It corrects the “collaborative custody is not real self-custody” framing that the strongest sovereignty advocates sometimes use. The partner cannot move funds; the holder retains spending authority. This is structurally distinct from custodial services where the custodian holds the keys.
  • It establishes sovereign recovery as the central evaluation criterion. A collaborative custody provider that does not commit to (and implement) sovereign recovery is structurally weaker than one that does.
  • It surfaces the inheritance argument that is the synthesis’s strongest case for collaborative custody: inheritance with a partner involved is dramatically simpler than inheriting a DIY multisig.

The defensible position: collaborative 2-of-3 is the right configuration for many Tier 2+ holders, especially those whose inheritance situation is non-trivial. DIY 2-of-3 is the right configuration for holders with the operational discipline to sustain it and the philosophical preference for sovereignty. Either is defensible; neither is universally correct.

What this is

Collaborative custody is a specific business arrangement layered on top of standard 2-of-3 (or 3-of-5) multisig. The architecture:

  • Holder holds Key 1 (typically on a hardware wallet in primary custody — home safe, office, etc.)
  • Holder holds Key 2 (typically on a second hardware wallet in a different location)
  • Partner holds Key 3 (on the partner’s institutional infrastructure — typically itself a multi-key institutional setup)
  • Any two keys can sign

Routine spending: holder signs with Key 1, signals the partner, partner signs with Key 3. The holder has spent without ever touching Key 2.

Recovery scenario A — Holder loses Key 1: holder uses Key 2 + Partner’s Key 3 to sweep funds to a fresh 2-of-3 setup.

Recovery scenario B — Holder loses Partner cooperation (partner bankruptcy, regulatory action, etc.): holder uses Key 1 + Key 2 (sovereign recovery) to sweep funds. This requires that the wallet descriptor and the recovery procedure are documented in a partner-independent way.

Inheritance scenario: Heir contacts the partner (provided in inheritance documentation). Partner validates identity (typically with attorney coordination and a death certificate). Heir accesses one of the holder’s two keys. Partner provides the second signature. Funds move to the heir’s setup.

The partner provides:

  • Key custody for one of the three keys (on enterprise-grade infrastructure)
  • Wallet descriptor backup
  • Technical expertise for setup, recovery, and inheritance
  • Documented procedures the holder and heirs can follow
  • (Some providers) ongoing relationship management, attorney coordination, estate-planning support

The partner does not provide:

  • The ability to spend the holder’s funds — the partner cannot sign unilaterally
  • Custody of the holder’s two keys
  • A recovery service that can act without the holder’s cooperation (legitimate ones)

The 2026 provider landscape

Unchained Capital

Founded 2016 (Austin, Texas). Co-founders Joe Kelly, Dhruv Bansal, Parker Lewis (now departed), Drew Bartholomew.

Positioning: White-glove collaborative custody with substantial inheritance and estate-planning support. Unchained explicitly positions the partner relationship as ongoing and active — they treat the multisig as infrastructure for a broader financial-planning relationship.

Service tiers (as of 2026-05-14):

  • DIY Unchained — free; the holder holds all three keys; Unchained provides the platform and coordinator software but doesn’t hold a key
  • Concierge — the paid collaborative-custody product; Unchained holds one key; service fees scale with holding size
  • Trading services — buy/sell Bitcoin directly into the multisig wallet without exchange intermediation
  • IRA services — Bitcoin IRA with multisig custody
  • Inheritance services — formal inheritance protocols, attorney coordination, trust-vehicle integration

Hardware wallet support: Wide. Coldcard, Trezor, BitBox, Foundation Passport, Blockstream Jade, Ledger all supported.

Sovereign recovery: Strong and explicit. Unchained publishes documentation for sovereign recovery and treats it as a core commitment. Customers can leave Unchained at any time with their two keys and the descriptor.

Distinctive features: The white-glove relationship is the central value proposition. Unchained’s team includes attorneys, estate-planning specialists, and financial advisors who work alongside the technical multisig infrastructure.

Trade-offs: Higher fees than minimal-service alternatives; the partner-relationship intensity is meaningful (the partner knows you well over time); regulated as a US financial-services provider, which has implications for KYC and tax reporting.

Casa

Founded 2018 (Denver, Colorado). Founders include Jameson Lopp (CTO) and Nick Neuman (CEO).

Positioning: Multi-key architecture and tools-first. Casa treats the partner role as lighter than Unchained does — the holder is more in control of their multi-key setup, with Casa providing the platform, tools, and one signing key.

Service tiers (as of 2026-05-14):

  • Basic plan — collaborative 2-of-3 multisig with Casa holding one key
  • Premium plan — 3-of-5 multisig with Casa holding two keys, additional support features
  • Inheritance support — built into the platform

Hardware wallet support: Wide; Coldcard, Trezor, BitBox, Foundation Passport, Ledger.

Sovereign recovery: Strong; Casa publishes the recovery process and the descriptors needed for sovereign operation without Casa.

Distinctive features: The Jameson Lopp involvement gives Casa technical credibility; the seedless-security model (where the holder’s keys are tied to the hardware wallet’s secure element rather than a written seed) is a Casa-specific feature; the security-key product (a hardware wallet purchased from Casa that ties to their service) is another.

Trade-offs: The partner relationship is less hand-holding than Unchained; some holders prefer this, others find it less supportive; pricing has evolved over time.

Nunchuk

Founded 2020 (Vietnam-based, with US operations). Founder Hugo Nguyen.

Positioning: Sovereignty-first; “we can’t help you even if we wanted to.” Nunchuk’s design philosophy is that the holder should never need to rely on Nunchuk for custody — even for the partner-key scenarios where Nunchuk does hold a key.

Service tiers (as of 2026-05-14):

  • Free app — fully-featured multisig coordinator for free; no Nunchuk-held keys; holder holds all keys
  • Assisted Wallet — paid collaborative service where Nunchuk holds one key in 2-of-3, with explicit sovereignty-first design

Hardware wallet support: Wide; treats hardware wallets as holder-choice components.

Sovereign recovery: The defining commitment. Nunchuk publishes open-source recovery tools; the wallet works without Nunchuk’s cooperation; Nunchuk’s role is minimal by design.

Distinctive features: The political-philosophical stance is the brand. Nunchuk’s 2021 response to a Canadian injunction (the “Convoy” case, where Canadian authorities ordered Nunchuk to freeze customer funds; Nunchuk responded that they technically could not) made the sovereignty position concrete. Nunchuk does not have KYC beyond email, does not know customer balances, and does not provide concierge services.

Trade-offs: Less hand-holding than Unchained or Casa; the holder must engage with the technical layer more; appropriate for sovereignty-aligned holders, less appropriate for non-technical first-time users.

The Bitcoin Adviser

Smaller specialty provider focused specifically on the estate-planning end. The Bitcoin Adviser positions the multisig configuration as infrastructure for a broader inheritance plan — closer to working with a wealth manager who happens to specialize in Bitcoin.

Positioning: Estate-planning-first collaborative custody. The multisig setup serves the inheritance goal; the inheritance plan is the central product.

Service tiers: Custom; consultative engagement; pricing reflects the white-glove inheritance-planning service.

Hardware wallet support: Wide; integrates with the holder’s existing setup or recommends devices.

Sovereign recovery: Implemented per standard multisig principles; the focus is the inheritance side.

Distinctive features: Attorney coordination, trust-vehicle integration, regular inheritance rehearsals with heirs.

Trade-offs: Smaller and less standardized than Unchained or Casa; the consultative engagement is appropriate for substantial holdings with complex estate situations; overkill for simpler scenarios.

Bitkey (Block, Inc.)

See Bitkey for the full treatment.

Positioning: Consumer-facing collaborative custody packaged as a hardware wallet. The holder buys a Bitkey device; the architecture is 2-of-3 with Block holding one key. The product is aimed at non-technical mobile-first users who would not adopt traditional collaborative custody.

Service tiers: Single product at $150; no subscription fee.

Hardware wallet support: N/A — Bitkey is itself the hardware. The phone is the second key; Block holds the third.

Sovereign recovery: Implemented but the architectural opinions are stronger than other providers. Holders cannot easily reconfigure Bitkey to a different multisig structure.

Distinctive features: Non-technical UX; the phone-app interface; no trusted display on the device itself.

Trade-offs: Block as a counterparty with substantial regulatory exposure; the closed default configuration; the phone-as-central-interface architecture.

When to use this

Collaborative 2-of-3 is appropriate when:

  • Holdings are Tier 2 or higher ($50K+; threshold varies with threat model)
  • The holder recognizes that they themselves are likely their largest threat (yourself category from Threat modeling for self-custody)
  • Inheritance is a non-trivial concern — substantial estate, multiple heirs, or complex family dynamics
  • The holder would rather outsource complexity than build DIY-multisig operational discipline
  • The privacy cost of disclosing Bitcoin ownership to the partner is acceptable
  • The holder has identified a reputable partner with strong sovereign-recovery commitments

Collaborative 2-of-3 is less appropriate for:

  • Sovereignty-first holders who object to any partner involvement on principled grounds
  • Highly privacy-conscious holders for whom the partner-knows-you-hold-Bitcoin disclosure is unacceptable
  • Holders with very large stacks that the partner’s institutional infrastructure may not accommodate
  • Holders in jurisdictions where the partner cannot legally operate (regulatory considerations)
  • The truly DIY-capable holder who has the operational discipline for sovereign 2-of-3 and prefers it philosophically

How to evaluate a collaborative custody provider

The synthesis’s three evaluation criteria:

1. Verify the partner’s open-source sovereign-recovery story

The single most important criterion. A reputable partner publishes open-source tools and documentation that let the holder spend from the 2-of-3 setup using only their two keys and the descriptor — without the partner’s cooperation.

Specific questions to ask:

  • Where is the sovereign recovery documentation published?
  • Has the recovery procedure been independently verified?
  • What open-source tools support the recovery?
  • What are the holder’s specific instructions if the partner disappears tomorrow?

Unchained and Casa both publish strong sovereign-recovery documentation. Nunchuk’s entire architecture is sovereignty-recovery-first. Less established providers should be evaluated against this criterion specifically.

2. Confirm multi-vendor hardware support

A partner that requires the holder to use specific hardware wallets is structurally weaker than a partner that supports the standard multi-vendor diversity. The holder should not be locked to one device manufacturer because of the partner’s choice.

The major providers all support multiple vendors. Avoid partners who lock to a specific device.

3. Understand what happens if the partner disappears tomorrow

Test this concretely. Read the partner’s documentation. Identify the specific tools and procedures the holder would use. Verify that the wallet descriptor is in the holder’s possession (not just the partner’s). Consider performing an actual sovereign-recovery rehearsal — sweep funds from the collaborative multisig to a fresh 2-of-3 setup using only the holder’s two keys, without partner cooperation, to confirm the procedure works.

Tradeoffs and considerations

The partner knows you hold Bitcoin

This is the principal privacy cost. The partner has KYC-level information about the holder and an approximate sense of the holdings. For most holders, this disclosure is acceptable (the partner is a regulated business with strong privacy practices). For holders with specific privacy threat models, the disclosure is meaningful.

Mitigations:

  • Nunchuk’s minimum-disclosure model (no KYC beyond email; no balance knowledge)
  • Using the partner for a portion of the stack rather than all of it (collaborative custody for the “operational” stack; sovereign multisig for the deep-cold savings)
  • Geographic separation (collaborative custody with a partner in a jurisdiction the holder does not reside in, where regulatory disclosure is structurally limited)

Counterparty longevity risk

The partner can fail. Mitigations:

  • Sovereign recovery (the holder can leave at any time)
  • Partner diversification (using two different collaborative-custody partners for different portions of the holding)
  • Partner monitoring (the holder should track the partner’s business health and migrate if signs of distress appear)

The 2022 Voyager and Celsius collapses (centralized lenders, not collaborative-custody providers, but instructive) showed that businesses in the Bitcoin space can fail. Collaborative custody’s structural advantage is that the holder is not exposed to partner failure in the catastrophic sense — the funds are still in the holder’s control via the two holder-held keys.

The ongoing cost

Collaborative custody is a business; it is priced accordingly. Free tiers exist (Nunchuk’s basic app; Unchained’s DIY); paid services scale with holding size. For Tier 2 holders, the annual cost is typically a few hundred to a few thousand dollars; for Tier 3, more.

The cost is justified by:

  • Complexity reduction (the partner manages the technical layer)
  • Inheritance support (the partner has a documented process)
  • Recovery support (the partner helps if a holder key is lost)
  • The ongoing relationship value (for providers like Unchained that explicitly invest in the holder-partner relationship)

For holders who can sustain DIY 2-of-3 operational discipline and don’t value the inheritance support specifically, the cost may not be justified.

The “real self-custody” debate

A persistent debate in the Bitcoin community: is collaborative custody “real” self-custody? The arguments:

The pro position: The holder holds two of three keys. The partner cannot move funds. The holder has unilateral spending authority (with the partner’s cooperation, which the partner is contractually obligated to provide). This is fundamentally different from custodial services.

The skeptical position: The partner is in the loop. The holder has disclosed to the partner. The partner can refuse to cooperate (in theory) or be compelled by regulatory action. The structural property of “no third party can affect my funds” is not preserved.

The synthesis’s read: Collaborative custody is meaningfully different from custodial services. The partner cannot move funds unilaterally; the holder retains spending authority. But it is not pure sovereignty — the partner is in the loop and the holder has disclosed. The right framing: collaborative custody is a legitimate position on the sovereignty spectrum, not the maximum-sovereignty endpoint.

For holders for whom maximum sovereignty is the goal, DIY 2-of-3 is the appropriate configuration. For holders who value the complexity-reduction and inheritance-support benefits, collaborative 2-of-3 is appropriate. Both are defensible; neither is the “real” answer.

Tiered application

Tier 0–1: Collaborative custody is generally overkill. Single-sig with strong discipline covers the realistic threat surface.

Tier 2 (1M+): Collaborative 2-of-3 is the appropriate default for many holders, especially those with non-trivial inheritance concerns. Provider choice depends on the holder’s preferences — Unchained for white-glove, Casa for tools-first, Nunchuk for sovereignty-aligned.

Tier 3 (>$1M): Collaborative custody often plays a role but may not be the sole configuration. Common patterns: collaborative 2-of-3 for a portion of the holding; DIY 2-of-3 for another portion; possibly 3-of-5 for the deepest cold storage. Multiple providers may be appropriate for diversification.

For all tiers using collaborative custody: the holder should still hold meaningful operational responsibility (two of three keys; the descriptor; periodic verification). Treating the partner as fully managing the setup is a misunderstanding of the architecture.

Common pitfalls

Treating the partner as a custodian. The partner is not a custodian — they hold one of three keys and cannot move funds. Treating them as a custodian (e.g., expecting them to manage all aspects of the setup, or treating them as the load-bearing custody party) misses the structural arrangement.

Skipping the sovereign-recovery verification. A collaborative custody setup where the holder has never confirmed that sovereign recovery works is structurally fragile. Test it once.

Lock-in to a specific provider’s tooling. If the provider’s wallet works only with their app and cannot be ported to alternative coordinators, the holder is partially locked-in regardless of the sovereign-recovery promise. Verify portability.

Not engaging the inheritance documentation. Collaborative custody’s strongest case is inheritance support. A holder who has the collaborative setup but has not engaged the partner’s inheritance procedures, or has not documented the partner’s existence and contact information for heirs, has not realized the principal benefit.

Treating “collaborative custody” as a singular category. Unchained, Casa, Nunchuk, The Bitcoin Adviser, and Bitkey occupy meaningfully different positions on the partner-involvement spectrum. The holder should choose the provider whose stance matches their preferences, not adopt collaborative custody generically.

Privacy underweight. The partner-knows-you-hold-Bitcoin disclosure is a real cost. For privacy-conscious holders, this should be weighted alongside the convenience benefits.

The partner-as-only-defence-against-yourself fallacy. The partner helps with complexity and inheritance but does not magically defend against operator error in routine operations. The holder must still maintain operational discipline for their two keys.

Mid-tier engagement. A holder who signs up for collaborative custody but doesn’t fully use the partner’s services (doesn’t engage inheritance planning, doesn’t use recovery support, doesn’t take advantage of the technical expertise) is paying for benefits they’re not receiving. Either engage the service or move to DIY.

Tooling and resources

The major providers (as of 2026-05-14):

  • Unchained — unchained.com; the white-glove provider
  • Casa — keys.casa; the tools-first provider
  • Nunchuk — nunchuk.io; the sovereignty-first provider
  • The Bitcoin Adviser — thebitcoinadviser.com; the estate-planning-focused provider
  • Bitkey — bitkey.world; the consumer-facing variant; see Bitkey

Comparison and decision resources:

  • Each provider publishes detailed comparison material against their competitors
  • Lopp’s writing (he is Casa’s CTO; the writing acknowledges that conflict-of-interest)
  • Independent reviews on Bitcoin podcasts and the broader Bitcoin media

Primary practitioner sources:

  • Unchained — Why 2-of-3 is the right multisig setup; DIY multisig vs. collaborative custody multisig
  • Casa — published case studies; the seedless-security model documentation
  • Nunchuk — Bitcoin Self-Custody: A Path Forward; the design-philosophy posts
  • The Bitcoin Adviser — estate-planning-focused content
  • Lopp — broader self-custody writing. See Jameson Lopp.

The synthesis document: Bitcoin Self-Custody & Security (LegacyCipher, April 2026) — collaborative custody as Configuration 5 of the ladder; the provider divergences as the central note.

As of 2026-05-14: the collaborative-custody landscape is mature. Unchained and Casa are the largest providers in the US; Nunchuk has a substantial international user base; The Bitcoin Adviser serves a smaller niche. Pricing and feature sets evolve; verify current details before committing.

Open questions for further development

  • The “real self-custody” debate is ongoing and unlikely to settle. Is there a more useful framing than the binary that surfaces the structural differences without partisan loading?
  • The regulatory environment for collaborative custody providers is evolving. How might MiCA (EU), evolving US regulation, or international AML frameworks affect the providers? Some are more exposed than others.
  • The Bitkey product is structurally collaborative custody packaged differently. Does the framework benefit from treating it alongside Unchained/Casa/Nunchuk rather than as a hardware wallet?
  • Provider diversification (using two collaborative-custody providers for different portions of holdings) is theoretically attractive but adds substantial operational complexity. Is this worth the diversification benefit?
  • The inheritance argument is the synthesis’s strongest case for collaborative custody. As inheritance tooling improves at the DIY level (better documentation templates, inheritance-aware coordinators), does the collaborative-custody advantage narrow?

The framing context:

The adjacent configuration:

Hardware wallets:

Storage and key concepts:

Operational practice:

Inheritance (where collaborative custody’s strongest case lives):

The principal practitioners:

  • Jameson Lopp — Casa CTO; the inside view on collaborative custody

The sub-MOC home:

Graph View

Backlinks