TL;DR
For a 2-of-3 you need three hardware wallets from three different makers, and at least one, better two, that knows your multisig and checks addresses against it. My pick is the trio I use: Trezor Safe 5, BitBox02 and Ledger Nano S Plus, all with Sparrow. At the makers’ own prices on October 10, 2026 that’s $198 plus €149.
The Blockstream Jade and Keystone 3 Pro are good swaps if you want QR codes instead of USB. I haven’t used the Jade, Keystone, Coldcard or SeedSigner in this setup myself; what I say about them comes from the makers’ own documentation and shops, checked October 2026.
What matters in a multisig
A hardware wallet that’s great on its own isn’t automatically a good multisig key. These are the things I look at, roughly in order of importance.
- A different maker from the other two. That’s the whole point of the setup: one bug or one bad batch hits one key, not two. See why three brands.
- It knows your multisig. A device that knows your setup can check a receive address against your real wallet, not just against what the computer tells it. The BitBox02, Jade, Keystone and Coldcard store it; the Ledger checks against a registration you approved, with the proof kept in Sparrow’s wallet file (wallet registration explained). The Trezor doesn’t: Sparrow sends the setup each time, so it only shows what Sparrow sends. You want at least one device that does, ideally two (step 8).
- It works with Sparrow, the coordinator the setup guide uses. Everything in the table below does.
- A standard 24-word BIP39 backup. Every brand can restore that. Watch the defaults: the Trezor Safe 5 offers a 20-word backup that your other devices can’t restore, and the Keystone offers Shamir backups. See BIP39 vs SLIP39.
- A screen you can read a full address on. You’ll compare addresses character by character. Bigger is easier, not safer.
- Published code. Open firmware lets others check what the device does. In a 2-of-3 one closed design is fine, as long as the other two aren’t the same design (open vs closed source).
- Optional: an air-gap. QR codes or a memory card instead of a cable. Nice, but one air-gapped device doesn’t change much in a 2-of-3 (why).
Side by side
Prices are from each maker’s own shop on October 10, 2026. They change often, and some shops show euros depending on where you are.
| Device | Checks addresses against your setup | Code | Talks to Sparrow by | Price at the maker |
|---|---|---|---|---|
| Trezor Safe 5 | No, Sparrow sends it each time | Open source | USB | $129 |
| BitBox02 Bitcoin-only | Yes | Open source, reproducible builds | USB | €149 |
| BitBox02 Nova | Yes | Open source, reproducible builds | USB | €175 |
| Ledger Nano S Plus | Yes, after you approve it once (Bitcoin app 2.1 or later; Sparrow keeps the proof) | Bitcoin app open, operating system closed | USB | $69 |
| Blockstream Jade / Jade Plus | Yes, up to eight setups | Open source, no secure element | USB or QR | $67 / $149 ($169 metal) |
| Keystone 3 Pro | Yes, after you import it | Open source (Bitcoin-only firmware) | QR only | $149 |
| Coldcard Mk5 / Q | Yes, after you import it | Published, under MIT plus Commons Clause | microSD (Q also QR), or USB | $219 / $319, marked down |
| SeedSigner | No, it stores nothing; you scan the descriptor each session | Open source (MIT) | QR only | DIY parts; the project says under $50 |
All of them can make a standard 24-word BIP39 seed. On the Trezor and the Keystone you have to choose it during setup.
Coldcard: read the July 2026 alert first
On July 30, 2026, attackers started sweeping funds from Coldcards whose seeds were made with too little randomness. According to Coinkite’s advisory, seeds created on Mk2 and Mk3 firmware 4.0.1 to 4.1.9, Mk4 and Mk5 before 5.6.0, and the Q before 1.5.0Q are affected. A firmware update doesn’t fix an existing seed. New units ship with corrected firmware, according to Coinkite’s shop. Details in security alerts and Coldcard multisig with Sparrow.
My pick
The three I use: a Trezor Safe 5, a BitBox02 and a Ledger Nano S Plus. Why this trio:
- Three makers, three separate firmwares, and two different approaches to the secure chip. Trezor and BitBox keep the bitcoin code open; Ledger runs it inside a closed secure element. A flaw in one approach gets an attacker one key.
- Two of them know the multisig. The BitBox02 and the Ledger check receive addresses against your real wallet. The Trezor’s big touchscreen is the easiest place to read a full address, as an extra check.
- All three plug into Sparrow by USB, so setup and signing work the same way on each. No QR scanning, no memory cards.
- It’s not expensive. The Ledger is the cheapest key on the list and does its job fine as one of three.
Head-to-head comparisons: Trezor Safe 5 vs BitBox02, Trezor Safe 5 vs Ledger Nano S Plus and BitBox02 vs Ledger Nano S Plus.
Good alternative combinations
Always three makers. Beyond that, a few combinations make sense:
- Budget: Ledger Nano S Plus, Blockstream Jade and Trezor Safe 5, about $265. Two of the three check addresses against your setup. More in what a multisig costs.
- iPhone at hand: swap the BitBox02 for the BitBox02 Nova. It works the same in Sparrow; the Bluetooth only matters if you use your phone.
- One key without a cable: replace the Trezor with a Jade Plus or a Keystone 3 Pro. Then all three devices check addresses against your setup. See Jade multisig and Keystone multisig.
- Two keys without a cable: a Jade Plus and a Keystone 3 Pro, plus a BitBox02 or Ledger. That’s what it takes to really keep USB out of signing, because any two keys can spend.
- Coldcard: fine as one key, on fixed firmware and with a seed created after the update. It moves files on a microSD card.
- SeedSigner: for people who like to build. It remembers nothing, so you load the seed from a QR code every time. See SeedSigner multisig with Sparrow.
Where to buy
Buy only from the maker’s own shop or from Amazon.com itself (“Ships from and sold by Amazon.com”), never from a reseller, not even an official one: here’s why. Whichever you pick, do the tamper check when it arrives.
- Trezor Safe 5: Buy from Trezor · Buy on Amazon
- BitBox02: Buy from BitBox · Buy on Amazon
- BitBox02 Nova: Buy from BitBox · Buy on Amazon
- Ledger Nano S Plus: Buy from Ledger · Buy on Amazon
- Blockstream Jade / Jade Plus: Buy from Blockstream (code Y9CHA5) · Buy on Amazon
- Keystone 3 Pro: Buy from Keystone · Buy on Amazon
- Coldcard: Coinkite shop (no affiliate link)
Common mistakes
- Buying three devices of one brand, or two of one brand, to keep things simple.
- Keeping the Trezor’s 20-word default or the Keystone’s Shamir option. Choose 24 words.
- Relying on the Trezor alone to check addresses. It shows what Sparrow sends it.
- Setting up a Keystone multisig on its multi-coin firmware. Install the Bitcoin-only firmware first.
- Keeping a Coldcard seed that was created on affected firmware.
- Saving a few dollars with a reseller or a third-party seller on a marketplace.