Safe Multisig Statistics: 39 Safes Behind DeFi Admin Keys

By the Guardian team Updated November 2026 6 min read

Quick answer. Across 39 Safes holding admin powers at 22 large Ethereum protocols, 4-of-7 is most common. Thresholds run from 1 to 9, signer sets from 2 to 14. Upgrade Safes need a median of 4 signatures, pause Safes 3.

Watch: Safe Multisig Statistics: 39 Safes Behind DeFi Admin Keys 1:42

Video transcript

Wallet counts say how many multisigs exist, not which ones can change a protocol. We read the 39 Safes holding admin powers at 22 Ethereum protocols.

Four of seven is the most common setup, used by seven Safes. Thresholds run from one to nine, signer sets from two to fourteen.

Upgrade Safes need a median of four signatures, pause Safes three. All four one-signature Safes hold pause powers. Stopping is built to be fast.

Six Safes can upgrade with no delay. The seven behind a timelock have the same median threshold. Overall, 42 of 52 power links act at once.

239 distinct signers fill 270 slots. Liquid Collective's two Safes share all seven signers. At mETH, shared signers can pass either Safe. Two addresses sign for both Curve and Convex.

Nine Safes have another Safe as a signer. Aave's Protocol Guardian counts three one-of-three Safes among its seven.

One Safe, at StakeWise, has a module that can execute without owner signatures. One, at Ethena, has a guard. The other 37 rely on signatures alone.

Benchmark your Safes. Below four upgrade signatures, add a timelock. Keep pausers from upgrading or moving funds. Count distinct signers, list every module, and re-read after changes.

Guardian's Managed Security maps every signer behind your admin keys and reviews each multisig transaction before signing. Read the full report, or talk to Guardian.

Wallet counts say how many multisigs exist. They do not say which ones can change a protocol.

This report counts the Safes that can upgrade, pause or reconfigure a large DeFi protocol on Ethereum.

It is the Safe-level companion to our admin key census of 25 top protocols. We took every Safe in that census and read it again at a fresh block.

Protocols are named because everything here is public chain state. Individual signers are not.

How We Counted

Sample. The census's 25 protocols, ranked by Ethereum TVL on DefiLlama, and the admin powers it traced.
Safes. All 38 Safes in its dataset, plus a second Kelp pauser we found by rebuilding the same roles.
Block. We re-ran the census at block 26,346,197 (November 5, 2026, 04:20 UTC).
Reads. Threshold, owners, nonce, version, modules, guard and fallback handler for each Safe.
Signers. Each owner classified as an EOA, a Safe, another contract or an EIP-7702 account.
Checks. All 141 census checks passed again. No Safe changed its threshold, signers, modules or guard since block 26,343,097.
Limits. Ethereum mainnet only. Who holds each key, and how it is stored, is not onchain.

Thresholds and Signer Counts

Twenty-two of the 25 protocols use at least one Safe for an admin power. Sky and Uniswap route theirs through token governance.

Fluid uses token governance, an Avocado multisig and an EOA instead.

Setup	Safes
4-of-7	7
2-of-3	5
3-of-5	5
3-of-6	4
5-of-9	4
6-of-10 and 6-of-14	2 each
Ten other setups, 1-of-2 to 9-of-13	1 each

Median: 3 signatures and 7 signers.
One signature: four Safes. Pausers at EigenLayer (1-of-7) and Kelp (1-of-5), an ether.fi guardian (1-of-6), and EigenLayer's Executor.
The Executor is 1-of-2, but both its signers are contracts: a 10-day timelock and the 9-of-13 Community Multisig.
Under half: seven Safes need fewer than half their signers, including two 6-of-14 Safes at mETH.
Majority: 26 Safes need more than half. Only one needs more than 6 signatures.

Thresholds by Power

One Safe can hold several powers. We sorted the 52 links between a Safe and a power by what the power does.

Power	Safes	Through a timelock	Median threshold
Upgrade code	13	7	4
Repoint or approve code	3	0	4
Pause, freeze or blacklist	21	0	3
Parameters, fees and minters	11	1	4
Mint, burn or move balances	2	1	5 and 6

Every pause Safe acts at once, and all four one-signature Safes sit in this group. Stopping is built to be fast.

Six Safes can upgrade with no delay, at five protocols:

SSV Network, 5-of-9
EigenLayer, 9-of-13, through the 1-of-2 Executor (two Safes)
Falcon Finance, 4-of-6
Pendle, 3-of-5
Liquid Collective, 4-of-7

The other seven upgrade Safes propose into a timelock. Re waits 2 days, mETH and Maple 3, and ether.fi, Kelp and EigenLayer 10.

A timelock did not come with a higher threshold. Both groups have a median of 4 signatures.

Direct or behind a timelock

31 Safes act only directly.
4 act only through a timelock: upgrade Safes at ether.fi (6-of-10), mETH (6-of-14) and Maple (4-of-7), and EigenLayer's 3-of-5 Protocol Council.
4 hold both: at Re (3-of-5), Ethena (5-of-10) and Kelp (6-of-11), and EigenLayer's 3-of-6 Operations Multisig.

Each sends some changes through a timelock but acts at once on others: Re's on a minter and a pause, Ethena's on a blacklist, Kelp's on its contract registry, EigenLayer's on pauses.

Of the 52 links, 42 need no delay.

Shared and Nested Signers

The 39 Safes have 270 signer slots and 239 distinct signers. Twenty-six signers sit on two or more Safes, and five sit on three.

Most overlap stays inside one protocol:

Liquid Collective: the 4-of-7 Safe that upgrades River and the 4-of-7 governor Safe that adds operators have the same seven signers.
mETH: its two 6-of-14 Safes share six signers, enough to pass either. One proposes upgrades; the other can force-mint and force-burn.
ether.fi: four signers of the 1-of-6 guardian Safe also sit on the 4-of-7 operating Safe.
Kelp: all five signers of the 1-of-5 pauser also sit on a 3-of-6 pauser.

One overlap crosses protocols. Two addresses sign for both Curve's 5-of-9 Emergency DAO and Convex's 3-of-5 multisig.

Shared signers are common. They do mean two Safes can be less independent than the count suggests.

Signers that are not plain keys

Of the 270 slots, 256 are EOAs. Eleven are other Safes, one is a timelock and two are EIP-7702 accounts.

Nested Safes: nine Safes have a Safe as a signer. Aave's 4-of-7 Protocol Guardian counts three 1-of-3 Safes among its seven.
EIP-7702 lets an EOA point its code at a delegate contract.
Two signers use it, one on Curve's Emergency DAO and one on Re's admin Safe. Both point to a contract Sourcify names EIP7702StatelessDeleGator.

Modules, Guards and Versions

A module can make a Safe execute transactions with no owner signatures. Safe's own code says it runs them "without further confirmations."

A guard does the reverse: it checks every signed transaction and can block it. One of the 39 Safes has a module, and one has a guard.

StakeWise's 4-of-7 DAO Safe runs a Reality module, originally built to execute Snapshot proposals. A passed proposal can run one day after its Reality.eth answer is final.
The Safe owns that module and can mark a proposal invalid before it runs.
Ethena's 5-of-10 dev Safe has a guard. Only whitelisted executors can submit, and module or fallback handler changes are blocked.
The guard also limits delegatecalls to an approved MultiSend. Changing or removing it waits 48 hours.

27 Safes run version 1.3.0, 11 run 1.4.1, and Compound's 5-of-9 pause guardian runs 1.1.1. Guards arrived in version 1.3.0.

Activity varies widely. Nonces, which count the signed transactions a Safe has executed, run from 4 to 2,324. Eleven Safes had executed fewer than 20.

Benchmarks for Your Setup

Compare your own admin Safes with this sample:

Upgrades: the median here is 4 signatures. With fewer, put a timelock in front.
Pausers: a low threshold is normal. Make sure that Safe cannot also unpause, upgrade or move funds.
Independence: count distinct signers, not Safes. Check whether shared signers can pass both.
Nested signers: read every signer Safe's own threshold. A 1-of-3 signer lowers the real bar.
Modules: list each one and what it can call. It acts without signatures.
Guards: know the recovery path before you need it. A broken guard can block every transaction.
Re-read after changes: one transaction can change a threshold, owners, modules or guard.

For upgrade process, see our guide to smart contract upgrade change management.

How Guardian Helps

Guardian's Managed Security maps every path to a protocol's funds: the contracts, the roles that can move them, and the keys, signers and multisigs behind each one.

Its security operations team reviews every multisig transaction before it is signed, and every deployment and configuration change as it lands.

Risk Monitoring tracks who holds owner, pauser, upgrader and parameter rights, and which of them are EOAs rather than multisigs.

Frequently Asked Questions

What is the most common multisig threshold for DeFi admin Safes?

In this sample, 4-of-7: seven of 39 Safes use it. 2-of-3 and 3-of-5 follow with five each. The median Safe needs 3 signatures and has 7 signers.

Do DeFi admin Safes use modules or guards?

Rarely. Of 39 Safes, one has a module (StakeWise's Reality module, originally built for Snapshot proposals) and one has a guard (Ethena's executor whitelist). The other 37 rely on signatures alone.

Is a 1-of-N Safe a security risk?

It depends on what it controls. All four 1-of-N Safes here hold pause powers. The one that can also upgrade, EigenLayer's Executor, has two contract signers: a 10-day timelock and a 9-of-13 Safe.

How did you find which Safes hold admin powers?

We started from our census of 25 protocols, which traced each upgrade, pause and parameter power to its final holder. We re-read every Safe it named, plus one found by rebuilding the same roles, at block 26,346,197.

Sources

Know every signer behind your admin keys

Guardian maps the keys, signers and multisigs behind your protocol's powers and reviews every multisig transaction before it is signed.

Talk to Guardian Explore Managed Security