Splitting a seed vs multisig: Shamir, SLIP-39 and SSKR compared

"You need several pieces to move the money" describes two very different setups. One is a split seed: a single secret cut into shares, using Shamir's Secret Sharing or a standard built on it such as SLIP-39 or SSKR. The other is multisig: several independent keys, with the blockchain itself refusing to move funds unless enough of them sign.

Both spread risk, but they protect against different things, and confusing them leads to setups weaker than they look.

How Shamir's Secret Sharing works

Shamir's Secret Sharing, published by Adi Shamir in 1979, splits one secret into n shares so that any t of them can rebuild it, while fewer than t reveal nothing at all. In a 2-of-3 split, any two shares recover the secret, and a single share tells an attacker literally nothing about it.

Two common wallet standards build on it:

• SLIP-39, from SatoshiLabs, encodes each share as a 20- or 33-word phrase and supports groups (for example, "two of my three shares, or one from my family and one from my lawyer"). It is used by Trezor's Shamir backup.
• SSKR (Sharded Secret Key Reconstruction), from Blockchain Commons, does the same job with its own encoding, used by some airgapped signers.

SLIP-39 shares are not interchangeable with an ordinary BIP-39 phrase. Wallets that support SLIP-39 generally can't convert an existing 24-word phrase into shares; the backup has to be created that way from the start.

The catch: the key meets again to sign

Shamir is a backup technique. The shares protect the secret while it sits in storage. But a share can't sign anything. To spend, the shares are combined and the full key is rebuilt — on one device, in one piece.

That means at the moment of signing, a Shamir-backed wallet is a single-key wallet. If that device is compromised, or the person rebuilding the key is coerced, the split doesn't help. Often the key is rebuilt once and then lives on a single hardware wallet.

Multisig works the other way round. Each signer has its own key, generated separately, and the keys never meet. Each one signs on its own device, and the blockchain checks that enough valid signatures are present. There is no moment when one device holds everything. MPC wallets vs multisig covers a third approach, where keys are split by cryptography rather than enforced by the chain.

Don't just cut your 24 words into thirds

A tempting do-it-yourself version is to write the first eight words on one card, the next eight on another and the last eight on a third. This is not Shamir, and it has two problems.

First, it isn't a threshold scheme. You need all three pieces, so losing any one card loses the wallet.

Second, each piece leaks part of the secret. Every BIP-39 word carries 11 bits; a 24-word phrase holds 256 bits of randomness plus an 8-bit checksum. One card of eight words reveals 88 of those 256 bits. Someone holding one card has 168 bits left to guess, which is still out of reach — but someone holding two cards has just 80 bits left, far below the margin the phrase was designed for. On a 12-word phrase (128 bits), two of three pieces of four words leave only 40 bits, which can be brute-forced with ordinary hardware.

With real Shamir, a share below the threshold leaks nothing. With a cut-up phrase, every piece makes the attacker's job easier. If you want to split a seed, use a proper standard; seed phrase best practices covers the more usual options of metal backups and separate locations.

Trade-offs: visibility and chains

Each approach has real advantages:

• On-chain footprint. Shamir is invisible on-chain: the wallet looks and behaves like any single-key wallet, on every chain. Multisig is visible — a Bitcoin multisig spend reveals its script, and on account-based chains the vault is a smart contract or program anyone can inspect.
• Chain support. Shamir works with any chain your wallet supports, because it only touches the backup. Multisig is chain-specific: Bitcoin uses scripts, EVM chains use smart contract accounts, Solana uses a program, and each has its own fees and limits.
• What it protects. Shamir protects the backup against loss and theft. Multisig protects every single transaction, because no one device can sign alone.

The two aren't mutually exclusive; what matters is knowing which risk each one addresses.

Where SSP fits

SSP is 2-of-2 multisig. SSP Wallet, the browser extension, and SSP Key, the phone app, each generate their own 24-word recovery phrase. On UTXO chains such as Bitcoin, the vault address is built from a 2-of-2 multisig script containing one public key from each, and every transaction needs both signatures. The two keys are never combined on one device.

SSP does not implement Shamir, SLIP-39 or SSKR. You back up two ordinary 24-word phrases, and restoring the vault from scratch needs both, so both backups matter equally. 2-of-2 vs 2-of-3 vs M-of-N explains that trade-off, and inheritance and emergency access covers how to make sure someone else can recover the funds if they ever need to.

The honest summary

Splitting a seed and using multisig both need several pieces, but for different moments. Shamir-based standards like SLIP-39 and SSKR protect a backup: shares below the threshold leak nothing, and the wallet stays invisible and chain-agnostic. But the full key is rebuilt to sign, so signing still has one point of failure. Multisig keeps separate keys that never meet and makes the chain enforce the rule, at the cost of being visible and chain-specific.

Avoid cutting a phrase into pieces by hand: it needs every piece and leaks secret bits with each one. SSP uses 2-of-2 multisig with two separate 24-word phrases, and doesn't offer seed splitting — so keep both backups safe.