Security alert · Oct 9, 2026: Ledger devices bought from a reseller in Southeast Asia were drained. Buy hardware wallets only from the maker. What to do →

Multisig Setup

Checklist

BitBox02 multisig with Sparrow: step by step

Last reviewed: October 2026

TL;DR

Set the BitBox02 up in the BitBoxApp first: skip the microSD backup, write down the 24 words and update the firmware. Then close the BitBoxApp and use it in Sparrow. The first time you show an address, the BitBox02 registers your multisig under the wallet’s name and remembers it for good. From then on its address check is one you can trust.

What the BitBox02 does in this setup

In my 2-of-3 the BitBox02 is the key whose firmware anyone can check, thanks to reproducible builds. It’s also my main address check: once registered, it stores a fingerprint of your three keys and calculates addresses from them itself, so a tampered computer can’t make it confirm an address that isn’t yours. The BitBox02 review has my view of the device.

Buy the Bitcoin-only edition. It leaves out other coins, so there’s less code on the device (Bitcoin-only firmware).

What you need

  • A BitBox02 Bitcoin-only, bought from the maker or Amazon.com itself
  • The BitBoxApp on your signing computer, for the first setup and firmware updates
  • Sparrow installed and verified (step 3). Sparrow 2.5.4 and newer needs BitBox02 firmware 9.4.0 or later; the current firmware is 9.27.1 (August 31, 2026)

Steps

1. Set up in the BitBoxApp

  1. Connect the BitBox02, open the BitBoxApp and let it check that the device is genuine.
  2. On the Setup your wallet screen, click Advanced options below Create wallet and enable Skip microSD card backup and write down recovery words instead. Leave the word count at 24.
  3. Create the wallet, set a device password and write down the 24 words by hand. The device asks you to confirm them. Rules for the words are in step 4.
  4. Install any firmware update the BitBoxApp offers.
  5. Close the BitBoxApp. Older versions (4.47.0 and lower) take exclusive hold of the device, so unplug and reconnect if Sparrow can’t see it.

Why skip the microSD card: the backup on it isn’t protected by a password. Anyone who finds the card can restore your wallet. Since Sparrow 2.1.0 you also don’t need to pair the device with the BitBoxApp before using it in Sparrow.

2. Import the keystore in Sparrow

  1. In the new multisig wallet (step 6), open a keystore tab and click Connected Hardware Wallet.
  2. Unlock the BitBox02 with its password, on the device. The first time it meets Sparrow, both may show a pairing code: check they match and confirm on the device.
  3. Click Import Keystore. Check that the derivation path reads m/48’/0’/0’/2′ and that the master fingerprint matches your notes.

3. Register the multisig

  1. Finish the wallet, back up the descriptor (step 7), then open the Receive tab and click Display Address.
  2. The BitBox02 shows a Register screen with the wallet name. Sparrow sends your Sparrow wallet name, cut to 30 characters. Only if no name is sent does the device ask you to type one (“Please name this account”). Older guides show that prompt; with a current Sparrow you’ll usually just confirm the name.
  3. Check the details and the keys against your notes, then confirm. The device shows “Multisig account registered” and keeps it, also after unplugging.
  4. It now shows the address. Compare every character with Sparrow; it scrolls, so go through it piece by piece.

4. Sign

Click Sign in Sparrow with the BitBox02 connected and unlocked (step 9). The BitBox02 shows the registered wallet name with the transaction. Check the address and amount, then confirm. If a wallet isn’t registered yet, Sparrow registers it at this point too.

Passphrase (optional)

If you use a passphrase, switch it on in the BitBoxApp: Settings → Manage device → Expert settings → Passphrase → Enable optional passphrase, and confirm on the device. Reconnect it. From then on it asks for the passphrase on the device after the password, never on the computer. Confirming an empty entry opens the plain wallet.

Two things to watch. A typo opens a different, empty wallet, so check the fingerprint in Sparrow. And the registration belongs to the wallet you unlocked: register while the passphrase wallet is open, because that’s the one you use.

Quirks

  • Names must be unique. Running a second vault on the same devices? Give it a different name in Sparrow, or the BitBox02 refuses: “A multisig account configuration with this name already exists.”
  • Long names get cut. Over 30 characters, Sparrow trims the name, so keep it short.
  • Authenticity check in Sparrow. Since 2.5.4 Sparrow also shows a dialog if the BitBox02’s attestation check fails. Stop and contact BitBox through their website if you see it.
  • No iPhone. The original BitBox02 works with computers and Android only. In this setup that doesn’t matter.

Common mistakes

  • Keeping the microSD card “as an extra backup”.
  • Leaving the BitBoxApp open, so Sparrow can’t reach the device.
  • Registering on the plain wallet when you use a passphrase.
  • Checking only the start and end of the address because it scrolls.

Buying

Buy from BitBox’s own shop or from Amazon.com itself (“Ships from and sold by Amazon.com”), never from a reseller (why). Do the tamper check when it arrives.

Buy from BitBox · Buy on Amazon

Related