Guides / Glossary / Single-signature wallet
Glossary

Single-signature wallet: why we do not recommend it for companies

A wallet controlled by one private key. Whoever has that key, or its recovery phrase, can move everything.

Education only

Definition. A wallet with one private key. We do not recommend it for a company treasury, because one device or person becomes a single point of failure.

How it works

A single-signature wallet has one private key, usually generated from one recovery phrase. Any payment needs one signature from that key. It is the default in most consumer wallet apps and on many hardware devices, and it is simple to set up and use.

Why we do not recommend it for a company

A company is not one person. Its money should not depend on one device, one memory or one sheet of paper. With a single key, every risk is concentrated in the same place: if the device and phrase are lost, the bitcoin is gone; if the phrase is copied, anyone holding the copy can take everything without a second check; if the keyholder leaves on bad terms, becomes ill or dies, the company may be unable to act or to prove it still has control.

A single key also cannot enforce the controls a board would normally expect for payments, such as two approvers. A policy can say two people must agree, but the network will accept one signature. Multisig makes the rule technical rather than a matter of trust.

Firmware and supply chain problems show the same point. The 2026 COLDCARD advisory described a firmware bug that weakened seed generation in affected versions. With a single key from an affected device, the whole treasury would be exposed. In a 2 of 3 wallet using devices from different makers, one weak key does not, on its own, release the funds.

Companies that do not want to manage keys at all can look at a regulated custodian or, for price exposure only, an exchange traded product. Those are different risks, compared on the custody guide.

Example only, fictional. A founder bought bitcoin for the company on a phone wallet. When they left, the remaining directors could not show the auditor who controlled the coins. The company had to negotiate with its former director to move the funds to a new 2 of 3 wallet.

Common mistakes

Sources

Primary sources only. Each link was checked on 9 November 2026. Rules change, so confirm the current version with your adviser.

  1. Bitcoin BIPsBIP 39: Mnemonic code for generating deterministic keys
  2. CoinkiteCOLDCARD security advisory: weakened seed generation in affected firmware (July 2026)
  3. Bitcoin BIPsBIP 11: M of N standard transactions (multisig)
  4. NISTSP 800-57 Part 1 Rev. 5: Recommendation for key management
Education, not advice.

This is general information and education only. It is not financial, investment, tax, accounting, legal or regulatory advice, and it is not a recommendation to buy, sell or hold bitcoin or any other asset. It does not take account of your circumstances or those of your company. You must obtain your own official professional advice to confirm this information is correct before acting on it.

Rules change. This information is correct to our understanding at the last-reviewed date, but it may be incomplete or out of date, and official sources take precedence. Bitcoin is volatile. A company that buys it could lose some or all of the money it puts in.

Using this site does not create an adviser or client relationship. IoT Financial is not authorised or regulated by the Financial Conduct Authority (FCA) and is not registered with the US Securities and Exchange Commission (SEC) as an investment adviser. Read the full disclaimer.