Best Multisig Wallets for Ethereum in 2026
Quick answer. Safe is the default, used by 22 of 25 large Ethereum protocols we checked. Pick the interface by how it verifies: Safe{Wallet}'s built-in checks, Ledger Enterprise Multisig's clear signing, Eternal Safe's no-backend design, or Den's onchain policies.
Video transcript
Bybit lost over 1.5 billion dollars from a Safe multisig in February 2025. The contracts did what they were told.
Safe's foundation traced it to a compromised Safe Wallet developer machine. The real choice is the interface, and how signers check what they sign.
Safe remains the default. In our statistics, 22 of 25 large Ethereum protocols use a Safe for at least one admin power.
We compared five options without ranking them. Each removes a different risk, so pick by how it verifies: Safe Wallet's built-in checks, Ledger's clear signing, Eternal Safe's no-backend design, or Den's onchain policies.
Many checks only warn. Safe says a flagged Safenet transaction can still execute. Two setups block instead: Safe Shield with a Hypernative guard, and Den, whose contracts revert failing checks.
Any interface can be compromised, so verify elsewhere. Recompute the hashes, match them on the signing device, simulate and read the trace, and stop on any operation of one.
Safe's docs warn that a malicious module can take over a Safe, and a broken guard can freeze one. Audit any you add, and alert on changes.
With Managed Security, Guardian reviews every multisig transaction before it is signed. We also monitor your contracts on every block, and an OpSec audit tests what signers see.
Read the full comparison for every feature and caveat, or talk to Guardian at guardian.security.
On February 21, 2025, Bybit lost over $1.5 billion from a Safe multisig. The contracts did what they were told.
Safe's foundation traced the attack to a compromised Safe{Wallet} developer machine. Investigators found malicious JavaScript in the interface, aimed at Bybit.
So the real choice is the interface, and how it lets signers check what they sign. Vendor claims here come from each project's docs, read in November 2026.
Multisig Wallets Compared
In our Safe multisig statistics, 22 of 25 large Ethereum protocols use a Safe for at least one admin power. Fluid uses an Avocado multisig.
| Wallet | Contracts | Verification | Worth knowing |
|---|---|---|---|
| Safe{Wallet} | Safe | Safe Shield checks; Tenderly simulation | Hosted by Safe; optional blocking guard |
| Ledger Enterprise Multisig | Safe | Clear signing on Ledger Stax and Flex | Fees on Ethereum; five networks |
| Eternal Safe | Safe | Your own RPC, no backend | Runs locally or on IPFS |
| Den | Den's own, open source | Policy checked by app, server and contracts | Audited by yAudit and Certora in 2026 |
| Avocado | Avocado's own | Configurable n-of-m signers | Audited by PeckShield and Statemind |
We do not rank them. Each removes a different risk, so the right one depends on which risk you carry.
Signing and Verification Features
Safe{Wallet}
Safe Shield runs as you prepare a transaction. It flags threats reported by Blockaid, Tenderly and Hypernative.
It also flags changes to owners, modules or thresholds, unverified contracts, and a missing guard. It simulates the outcome before execution "when available".
Safenet adds independent checkers that flag six patterns, including unexpected delegatecalls, signer changes and unlimited approvals.
"For now, a Safenet result is a warning," Safe says: you can still execute a flagged transaction.
Ledger Enterprise Multisig
Launched on October 23, 2025, it is built on Safe and syncs with existing Safe accounts. Ledger says the device shows the full recipient, amount and token.
It also describes signer and threshold changes on the device. Only Ledger Stax and Flex can sign.
It runs on Ethereum, Base, Optimism, Arbitrum and Polygon. On Ethereum, Ledger charges $10 per governance operation and 0.05% of transfers, capped at $5,000 per transaction.
Eternal Safe
Eternal Safe is a fork of Safe{Wallet} v1.26.2, funded by the Safe Grants Program. It needs "only an RPC URL" and runs on IPFS or locally.
Signatures pass between signers as Smart Links. Its README warns they are "encoded, not encrypted."
Den
Den's Multi-Layer Security Wallet uses its own open-source contracts on Ethereum, Arbitrum, Base, Optimism and Ronin.
The signing app or SDK, an offchain service Den calls the Guardian (no relation to us) and the contracts each run its policy engine. A failing check reverts onchain.
Verify outside the interface
Any interface can be compromised, so check each transaction somewhere else too:
- Recompute the hashes with OpenZeppelin Safe Utils or safe-tx-hashes-util, as Safe's help center suggests.
- Match them, and the decoded fields, on the signing device.
- Simulate, and read the trace, not just the summary.
- Stop on any operation of 1: a delegatecall needs technical review.
Which device shows what is covered in the best hardware wallets for multisig signers.
Modules and Guards
A module can execute arbitrary transactions from a Safe. Safe's docs warn: "A malicious module can take over a Safe."
A guard checks every transaction before and after it runs, from Safe 1.3.0 on. Safe adds that "a broken Guard can cause a denial of service for a Safe."
Few large protocols use either. In our statistics, one of 39 admin Safes had a module, and one had a guard.
Two products use guards and policies to block transactions, not just warn:
- Safe Shield with Hypernative: installs a guard that blocks high-risk transactions. You request it from Safe's team; removal needs a 24-hour timelock.
- Den: enforces its policies in its own contracts, so a failing check reverts onchain.
Before you add either kind of control:
- Get the module or guard code audited, and pin the exact version.
- Write down how you recover if the guard blocks everything.
- Alert on every module, guard or owner change.
- Review what each module can execute, and who controls it.
How to Choose
- Built-in checks on Safe's own interface: Safe{Wallet}.
- Decoded transactions on a hardware screen: Ledger Enterprise Multisig.
- No dependence on a hosted backend: Eternal Safe, with an RPC you trust.
- Spending rules enforced onchain: Den, or a reviewed Safe guard.
- All of them: independent hash checks, simulation and a dedicated signing device.
The wallet is half the setup. Thresholds, timelocks and split roles are in our multisig best practices.
How Guardian Helps
With Managed Security, Guardian's security operations team reviews every multisig transaction before it is signed, and every configuration change as it lands.
Guardian also monitors your contracts on every block, including multisig transactions, role changes and upgrades. An OpSec audit tests what your signers see before they approve.
Frequently Asked Questions
What is the best multisig wallet on Ethereum?
Safe's contracts are the default: 22 of 25 large Ethereum protocols in our census use a Safe. Choose the interface by how it verifies: Safe{Wallet} for built-in checks, Ledger Enterprise Multisig for clear signing, or Den for onchain policies.
Is Safe still safe to use after the Bybit hack?
Bybit's Safe contracts worked as written. The attack came through a compromised Safe{Wallet} developer machine and malicious JavaScript in the interface. The lesson is to verify every transaction outside the interface, on a second tool and on the signing device.
What are Safe modules and guards?
A module can execute arbitrary transactions from a Safe. A guard checks every transaction and can block it. Safe warns that a malicious module can take over a Safe, and a broken guard can freeze one.
Can I use a Safe without the Safe{Wallet} interface?
Yes. Ledger Enterprise Multisig works with existing Safe accounts, and Eternal Safe is a fork of Safe{Wallet} that runs locally or on IPFS with only an RPC. The contracts and signatures are the same.
Sources
- BleepingComputer: Lazarus hacked Bybit via breached Safe{Wallet} developer machine (February 26, 2025)
- Safe Help Center: Understanding Safe Shield (read November 2026)
- Safe Help Center: Understanding Safe Shield, Guardian by Hypernative (read November 2026)
- Safe Help Center: What Safenet checks and what the results mean (read November 2026)
- Safe Help Center: Safe Wallet security with Tenderly and Blockaid (read November 2026)
- Safe Help Center: How to perform basic transaction checks on Safe{Wallet} (read November 2026)
- Safe Docs: Safe Modules (read November 2026)
- Safe Docs: Safe Guards (read November 2026)
- Ledger: Ledger Enterprise Multisig (read November 2026)
- Ledger: Ledger Enterprise Multisig announcement (October 23, 2025)
- Eternal Safe on GitHub: README (read November 2026)
- Den: Security Layers (read November 2026)
- Den: Security Audits (read November 2026)
- Den: Deployments (read November 2026)
- Avocado Docs: Multisig (read November 2026)
- Avocado Docs: Audits and Security (read November 2026)
- Guardian: Safe Multisig Statistics, 39 Safes Behind DeFi Admin Keys (November 2026)
- Guardian: Multisig Best Practices, The Institutional Signer Policy (November 2026)
Get a second pair of eyes on every signature
Guardian reviews every multisig transaction before it is signed, whichever wallet your team uses.