Company bitcoin needs controls people can follow.
DIY multisig asks for in-house Bitcoin operations. Institutional custody can bring contracts, onboarding, cost, and a counterparty. A shared vault gives teams between those options a practical route.
The compromise many teams live with
Your organisation holds bitcoin. It may have come from a treasury decision, revenue, or a founder's early setup. In practice, it often still sits on one person's device, behind one seed phrase.
Everyone can see the compromise. It is quick to start, but awkward to explain to a board or auditor. If that person is on leave, leaves the company, or cannot be reached, the organisation has a governance problem.
The operating need is ordinary: more than one person involved in a spend, roles that match the finance function, a record of who proposed what, who signed, and when, and a setup that survives a departure.
Why the usual options do not always fit
Both alternatives can be right. They just suit different organisations.
The first is do-it-yourself multisignature with desktop coordinator software. It can work well when someone on the team understands the Bitcoin details and can own the process. If not, your organisation becomes the systems integrator. You have to design the key ceremony, write the procedures, train people, test recovery, and support the setup.
The second is a custody platform built for institutions. That may be the right answer for a larger treasury, but it brings onboarding, contracts, cost, and a counterparty relationship.
Many organisations sit between those choices. The options exist; they just do not match their scale, budget, or operating reality. So the bitcoin stays where it started.
How a shared treasury vault helps
A shared vault is a standard bitcoin multisignature address with several keys. You decide how many must sign before bitcoin moves.
For a treasury, common shapes are 2-of-3 or 3-of-5. The keyholders are usually the people who would approve a payment of the same size today: a finance lead, a director, a second director, and, where the quorum allows it, an offline key or a professional adviser.
In a 3-of-5 vault, no single person can move the bitcoin. Two people cannot move it either. If one key is lost or compromised, the remaining keyholders can still meet the quorum and move the bitcoin to a new vault. A departure is handled the same way: the remaining keyholders move the bitcoin to a new vault without the leaver's key.
No one person, and no two, can move it. A departure is one key of five.
Two signatures are not enough. Nothing moves until three keys sign.
Every spend starts as a proposal. Each keyholder sees who proposed it, the destination, the amount, and who has signed so far. Nothing moves until the quorum signs. After broadcast, the bitcoin network gives you a transaction record to reconcile to your internal approvals.
During launch, shared vaults are free to set up. Vaults created during the launch window stay free.
A common treasury setup
For a small treasury, a practical 3-of-5 setup is:
- Finance lead.
- Director.
- Second director.
- Offline backup key.
- Professional adviser or other approved signatory.
Any three can sign. No one person can move the bitcoin. Two people cannot move it either. If one person leaves, the remaining keyholders can move the bitcoin to a new vault with the new roster.
How it works
- Agree the quorum and keyholders as part of your payment authority.
- Create a
3-of-5vault and add the keyholders. - Send each claim link privately to the right person.
Each keyholder accepts, creates or connects their own key, and keeps their own backup. When all keyholders have accepted, each participant checks the final roster, quorum, and address. Once everyone acknowledges the same vault, it becomes active and its address is fixed. Then move the treasury bitcoin into it.
Verify it yourself
In a standard shared vault, Cobault holds no key. Cobault coordinates proposals and signatures. It is not a keyholder, cannot sign, and cannot move your bitcoin. Your organisation holds its keys through the people you choose.
How keys are generatedYour vault is recoverable without Cobault if enough keyholders have their seed phrases and recovery kits. Each keyholder should download their own recovery kit at activation. The kit contains the vault details needed to reconstruct the vault address and signing path, including the quorum, participant roster, network, and derivation information. Keep the guide with your treasury procedures.
The shared-vault recovery guideThe vault is a bitcoin address. An auditor can check its balance and transactions in a block explorer, then reconcile them to your records. The explorer-verification guide should show how to match that address to the vault details and how to read the transaction record.
Explorer-verification guide — publishing soonCobault implements Craton.
Limits to understand
- It does not enforce spending policies. A standard shared vault moves bitcoin when enough keys sign. Period limits and approved destinations are for policy vaults, which are provided for by the standard Cobault implements but are not yet available.
- It does not replace your treasury policy. The quorum enforces who must sign. Your organisation still decides what may be approved and why.
- It does not stop a quorum acting together. In a 3-of-5 vault, any three keyholders can spend without the other two. Choose keyholders as you would choose signatories.
- It does not rotate a key in place. Replacing a keyholder means creating a new vault with the new key set and moving the bitcoin. That is an ordinary on-chain transaction.
- It does not keep the position private. The address, balance, deposits, and spends are visible on the public bitcoin network. Keyholders also see each other's display names, account email addresses, and public keys inside Cobault.
- It is not custody. Cobault is coordination software, not a custodian, bank, or deposit-taker. Bitcoin in a vault is not covered by a government guarantee or compensation scheme. Bluemetal Services Pty Ltd is not licensed as a financial services provider, and nothing here is financial product advice.
Next step
Or read the walkthrough first: a 3-of-5 treasury vault, approvals, and the record. Publishing soon.