TL;DR
Verify the receive address on a device that has your multisig registered, get it to the exchange without the clipboard, check it again after pasting, and send a small amount first. Only then move the rest.
Before you start
- Your multisig is built, backed up and tested (step 10)
- The BitBox02 or Ledger has your multisig registered
- You know where the backups will go, and they’re there or on their way
Steps
- In Sparrow, open Receive and show the address on the BitBox02 or Ledger. Compare every character.
- Type it over into the exchange on your computer, or, if you use the exchange’s phone app, scan the QR code Sparrow shows. Never send it by email, chat or synced clipboard.
- After pasting it into the exchange’s withdrawal form, compare it with the device screen again. Clipboard malware strikes between copying and pasting.
- Withdraw a small amount and wait until Sparrow shows it confirmed.
- Withdraw the rest. Large amounts can go in a few parts if that makes you feel better; each part costs a fee.
What exchanges may ask
Many exchanges, especially in the EU, ask you to confirm that a withdrawal address is your own wallet, and some want proof for larger amounts. Common options are a declaration, a small test deposit from that wallet, or signing a message. Signing a message from a multisig isn’t practical, and a test deposit needs coins already in the multisig, so for a first withdrawal the declaration is usually the only option.
Reusing the same address
Saving one verified address at the exchange and reusing it is convenient and avoids a new check each time. The trade-off is privacy: the exchange, and anyone who learns that address, can follow every deposit. A fresh, verified address each time is more private.
After the move
Update your notes and, if the amount changed a lot, your inheritance letter.