Money that belongs to a group
needs more than one key.
A treasury wallet is one no single person can empty. Orbit is a signer and approval surface for Safe multisig vaults on 4 EVM chains — self-custody, standard contracts, no custodian holding your policy.
A treasury is defined by what one person cannot do.
Personal wallets and treasury wallets look identical on a block explorer. The difference is entirely in who is able to sign.
A personal wallet has one key and one holder, and that is the correct design — you are the only person who should be able to spend your own money. A treasury holds money that belongs to a company, a project or a group, and the same design becomes a liability the moment it is applied: one person's laptop, one person's phishing email, or one person's departure is the whole balance.
Multisig replaces the single key with a contract. The funds sit at an address governed by that contract, the contract holds a list of owner addresses and a number, and it refuses to move anything until that many owners have signed the same transaction. Nobody is trusted with the treasury. The threshold is.
Pick a threshold you can survive.
The threshold is not a security dial where higher is better. It is a trade between being robbed and being locked out, and the second one is far more common.
- 2-of-3 — one signer can vanish and the treasury still moves
- 3-of-5 — the same tolerance with more people involved
- 2-of-2 — feels safe, is brittle: either loss freezes it forever
The test to apply: remove any one owner and check you can still reach the number. If you cannot, you have built a treasury that a single lost phone can end.
What this actually does.
Orbit's multisig surface works with Safe vaults — the standard multi-signature contracts — on Ethereum, Base, Arbitrum and Polygon. That is fewer networks than the rest of the wallet covers, because Safe is EVM-only.
- Connect a wallet you already control as an owner
- Track a Safe by address and read its live state — owners, threshold as "N of M", nonce and contract version
- See the pending queue and how many confirmations each item has collected
- Propose a transaction for the other owners to approve
- Co-sign a proposal somebody else raised
The vaults are standard contracts, not an Orbit format, so the same treasury opens in any Safe-compatible tool. That is deliberate: a treasury you can only administer through one vendor's app has swapped one single point of failure for another.
What it does not do.
Three things, and it is better to know them now than after you have moved money.
- It does not create the vault. The setup flow helps you decide the owners and the threshold, then asks for the address of a Safe you have already deployed elsewhere. What it shows you is a plan, not a deployment.
- It does not execute. Orbit takes a proposal as far as collecting signatures; broadcasting the final transaction happens in a Safe-compatible tool.
- Signing is desktop-only. Proposing and confirming both refuse on the web app, the same authority boundary that governs sending everywhere else in the wallet.
Tracked vaults are also stored per-device in local storage. That is a shortcut list, not an account — the treasury lives on-chain and is unaffected by which device you added it on.
Straight answers.
What is a crypto treasury wallet?
A treasury wallet is a wallet that holds money belonging to a group rather than a person — a company, a project, a DAO, a partnership — and which therefore cannot be allowed to depend on any one individual. The defining feature is not the balance, it is that no single person can move the funds alone.
In practice that means a multi-signature ("multisig") setup: the funds live at an address controlled by a smart contract, the contract knows a list of owner addresses, and it will only execute a transaction once a set number of those owners have signed it. Two of three, three of five, whatever you configure.
How is that different from just sharing a recovery phrase?
Sharing a phrase is the opposite of a treasury. Every person who has seen it holds complete unilateral control forever, and you cannot take it back — you can only move the money to a new wallet and hope nobody drained it first. There is also no record of who did what, because every signature comes from the same key.
A multisig gives you the two things a shared phrase cannot: a threshold, so one compromised person is not enough, and an owner list you can change. Remove a departing signer and their key stops working, without moving a single coin.
What threshold should a treasury use?
The threshold is the entire design and it is a trade between two failure modes. Set it too low and you have not really removed the single point of failure. Set it too high and you cannot move funds when someone is on holiday, loses a phone, or leaves.
The rule that matters: you must be able to lose one signer and still reach the threshold. 2-of-3 survives one loss. 2-of-2 does not — it looks safer than 1-of-1 and is in fact more fragile, because either key going missing freezes the treasury permanently. Count the failure you are most likely to actually have, which is a lost key, not a thief.
What does Orbit's multisig actually do?
It is a signer-and-approval surface for Safe vaults — the standard multisig contracts — on Ethereum, Base, Arbitrum, Polygon. You connect a wallet you already control as an owner, point Orbit at a Safe address, and it reads the vault's live state: the owner list, the threshold as "N of M", the current nonce and the contract version.
From there you can propose a transaction and co-sign one somebody else proposed, and see the pending queue with how many confirmations each item has collected. Because the vaults are standard Safe contracts rather than an Orbit-specific format, the same treasury is readable by any other Safe-compatible tool — Orbit is a client, not a lock-in.
Can Orbit create the vault for me?
No, and this is the honest limit worth knowing before you start. Orbit does not deploy the Safe contract. Its setup flow helps you decide the shape — who the owners are and what the threshold should be — and then asks you to paste the address of a Safe you have already deployed elsewhere. The summary it shows you is a plan, not a deployment.
Orbit also does not execute the final transaction. It gets a proposal to the point where the threshold is met; broadcasting the executed transaction happens in a Safe-compatible tool. If you need creation and execution in one place today, Orbit is not that yet.
Where are my tracked vaults stored, and can I sign from my phone?
Tracked Safes are stored on the device you added them on, in local storage — they are a convenience list, not an account. Nothing about your treasury is held on an Orbit server, and the vault itself lives on-chain regardless, so a lost device costs you the shortcut, not the funds. Add the same Safe address on another device and it is there again.
Signing is restricted to the desktop build. The same authority rule that governs sending in the rest of the wallet applies here: proposing and confirming both refuse on the web app and hand you off to desktop. See the security model for why that boundary exists, and downloads for the builds.
Before you set one up.
A treasury sits on top of the same key model as everything else here. What self-custody actually means covers how Orbit holds keys and what recovery does and does not exist; the security model covers the desktop-signing boundary that governs multisig approvals; and how to use Orbit is the plain walkthrough if this is your first wallet here. The networks the wallet itself covers — which is a longer list than Safe supports — are on the multichain wallet page.
Protect the funds
that belong to everyone.
Standard Safe vaults, approved from a wallet you hold yourself.