Sanctum CLOUD$0.044-0.8% says every wallet in its app is now a 2-of-3 multisig. The launch thread Sanctum posted on 5 November 2026 describes each wallet as a Squads smart account with three keys, held on the user's phone, in their iCloud or Google Drive, and behind their email. Any two can approve a transaction. Sanctum's pitch: "A lost key no longer locks you out, and a leaked key is no longer enough to drain you."
When Sanctum App 2.0 launched on 1 October, its release notes described Squads multisig protection without spelling out the key arrangement. The 5 November thread supplies it: three keys, two signatures, and each key tied to something the user already has.
How the 2-of-3 multisig wallet works: device, cloud and recovery keys
A multisig is a wallet that needs more than one key to move funds, with a rule such as two of three setting how many must approve. Sanctum's own thread post on the setup lists the three keys behind each wallet:
| Key | Where it lives | What it does, per Sanctum |
|---|---|---|
| Device Key | The user's phone, unlocked with face or fingerprint | Signs every transaction |
| Cloud Key | The user's own iCloud or Google Drive | Signs every transaction |
| Recovery Key (called Sign-in Key on the app page) | The user's email, secured by Turnkey | Replaces a lost Device or Cloud key |
The Sanctum app page fills in how the keys share the work. "Every buy, sell, and send needs a signature from both your phone and your cloud backup," it says, so the phone and cloud keys handle routine signing. The email key, which the launch thread calls the Recovery Key and the app page calls the Sign-in Key, is the fallback: "It lets you replace a key if either your Device or Cloud key is lost." If a phone goes missing, the cloud key and the email key together set up a new device key, and the same works the other way round for a lost cloud backup.
In Sanctum's 14 October explainer, the phone key is "encrypted on your phone and only unlocks with your face or fingerprint," and when the user approves, "two of them sign together. No need for extra devices or passing transactions around."
Why a 2-of-3 multisig protects against lost and stolen keys
The 2-of-3 rule changes the two classic ways people lose crypto. Sanctum puts the problem plainly: most wallets, hot or hardware, rely on a single key, and whoever gets it can take everything. On a single-key wallet, losing the key (a dead phone, a lost seed phrase) means losing the funds, and leaking it (a phishing site, malware) means someone else can empty the wallet. Under a 2-of-3 rule, neither event on its own is fatal. In Sanctum's words from the thread's security post: "With 3 keys in 3 different places, one stolen phone, hacked cloud account or phished email isn't enough on its own."
The trade is that a user now has three accounts to protect instead of one secret, and two of them (Apple or Google, and an email provider) sit with large consumer platforms the user already relies on. An attacker would need to compromise two of the three to move funds.
Multisigs are not new. Sanctum pointed out in October that DAOs, treasuries and funds on Solana have used them for years, mostly on Squads, which Sanctum said secures $15 billion; the Squads documentation puts the figure at "over $10 billion in value." What kept them away from individuals, according to Sanctum, was the work involved: "Setting one up meant managing several keys across several devices and getting each one to sign. A team can handle that, but it's too much for one person on a phone."
Squads smart accounts and Turnkey email keys
Sanctum is best known for its liquid staking infrastructure, and its consumer app is where users hold and earn rewards on SOL. The wallet change rests on two outside providers. Squads supplies the smart account, the on-chain program that enforces the two-signature rule, so no single key can authorise a transfer. Turnkey, a key-management provider, secures the email-based key.
The pairing has been used before. Turnkey's customer story on Squads says it "enabled email-based recovery for Squads consumer wallet app, Fuse." Squads is also bringing the same structure to business accounts: Squads co-founder Stepan Simkin wrote on 4 November that each member of a business account on Squads' Altitude gets "its own 2/3 formally verified squads multisig with email + passkey for authorizing transactions."
For Solana, the change puts a security model used by DAO treasuries into a phone app aimed at ordinary SOL holders, with keys tied to accounts those users already have.
How to upgrade a Sanctum wallet to the multisig
Existing users upgrade inside the app. Sanctum's upgrade instructions say: "Open the app, click the Update App button, and go through the key creation process." The user creates the new keys during that setup. The app is available on iOS, Android and the Solana Seeker dApp Store, per the Sanctum app page.
What to watch next: more keys, tiered approvals and security deep dives
Sanctum said on 14 October that it plans to add "support for more keys and tiered approvals next" and to "publish deep dives on Sanctum's security." Those write-ups are where users can check the details that matter before or after upgrading:
- any network or rent costs for the smart account itself
- audit coverage of Sanctum's own wallet integration
- whether and when wallets that have not upgraded will be required to
- how a smart-account wallet connects to outside Solana apps
- what a user can do if their email account is the key that is compromised
