Sanctum adds 2-of-3 multisig security to every app wallet

Sanctum has rolled out a 2-of-3 multisig setup for every wallet inside its consumer mobile app. Transactions now need sign-off from any two of three separate keys before they go through.

For a protocol best known for liquid staking and yield on Solana, it is a notable change of emphasis. The pitch is no longer only about growing your assets. It is also about making sure they are still there tomorrow.

How the three keys work

Sanctum’s version splits control across three locations. The first is a device key, stored on the user’s phone and gated by biometrics.

The second is a cloud key, kept in either iCloud or Google Drive. The third is a recovery key linked to the user’s email and secured through Turnkey.

Any two of those three can approve a transaction. So a user who drops their phone in a lake can still reach their funds using the cloud and recovery keys together.

The multisig itself runs on Squads infrastructure. Squads currently protects over $15 billion across Solana applications, much of it held by DAOs and teams.

Sanctum is effectively taking a security model built for organizations and shrinking it down to fit one person’s pocket.

From App 2.0 to full rollout

Sanctum App 2.0, which launched on October 1, 2026, carried the first references to the multisig protection.

The full public rollout was announced on November 5, 2026. That puts roughly five weeks between the first mention and the switch flipping for every wallet in the app.

It is worth separating this from Sanctum’s existing governance setup. The protocol already uses a 6-of-11 multisig to manage protocol upgrades.

That structure covers changes to Sanctum itself, not individual user wallets. The new 2-of-3 system is a different layer aimed squarely at retail users holding their own assets.

Market reaction has been muted, with no significant price fluctuations following the update.

Why single-key wallets are the weak spot

Most self-custody wallets have historically relied on a single private key or seed phrase. If it is stolen, the funds can be drained. If it is lost, the funds are often gone forever.

Sanctum’s move is a direct response to those two failure modes: theft and key loss. Distributing control across three keys means neither problem, on its own, ends in disaster.

Sanctum’s approach embeds smart-account technology directly into the wallet. Users get multisig protection without having to manually set up and coordinate a multisig themselves.

What this means for users and the Solana ecosystem

For everyday users, the biggest change is recoverability. A broken or stolen phone no longer has to mean a lost wallet, since two remaining keys can still authorize access.

The tradeoff is that security now leans partly on outside services. The cloud key depends on Apple or Google account security, and the recovery key depends on the user’s email plus Turnkey.

An attacker would generally need to compromise two of those three places at once, which is a meaningfully higher bar than stealing a single seed phrase.

Still, users should treat their email and cloud accounts with the same seriousness as the wallet itself. Strong passwords and two-factor authentication on those accounts now directly protect crypto holdings.

For Sanctum, the strategic angle is trust. The rollout is expected to bolster user confidence and could potentially attract new users looking for safer staking options.

Because Squads infrastructure already secures large institutional balances on Solana, its adaptation for individuals may serve as a template for other protocols considering similar wallet designs.