--- title: "A 2-of-3 MuSig2 multisig paying a silent payment address, on mainnet · Bitsaga Insights" description: "Two simulated SeedSigners holding a MuSig2 2-of-3 pay a BIP-352 silent payment address on mainnet. One taproot input, one taproot output, one 64-byte signature. Every screen, every transaction, and how to check it." url: "https://bitsaga.be/insights/musig2-silent-payment" language: "en" --- > Two simulated SeedSigners holding a MuSig2 2-of-3 pay a BIP-352 silent payment address on mainnet. One taproot input, one taproot output, one 64-byte signature. Every screen, every transaction, and how to check it. [Insights](https://bitsaga.be/insights) · Hardware # A 2-of-3 MuSig2 multisig paying a silent payment address, on mainnet By [Rob Segers](https://bitsaga.be/about) · September 4, 2026 ![Two SeedSigner screens: one reviewing a payment to a verified name, the other confirming the multisig signature](https://bitsaga.be/images/insights/musig2-silent-payment.png) Two people hold a 2-of-3 taproot multisig built with MuSig2 (BIP-327, BIP-390). They pay a silent payment address (BIP-352). Nobody holds the private key of the coin they spend, and a silent payment needs exactly that key. This page is the record of it happening on mainnet: every screen the two signers saw, every transaction, and how anyone can check it. World first, as far as we can find A MuSig2 multisig paying a silent payment address on chain The design existed on paper (BIP-352's own footnote, and macgyver13's proposal with a draft Coldcard branch). We found no transaction on any network before this one. If you know of one, tell us and this line changes. Proved · mainnet block 965485 Also first, same transaction Multisig signers verifying a payment name on device The recipient was a BIP-353 name. Both signers validated its DNSSEC proof themselves, from the root trust anchor down, before contributing anything. Proved · same block ## What this means if you hold bitcoin in a multisig - **Your multisig stops being visible.** A classic 2-of-3 tells the whole world it is a 2-of-3, forever, on every coin. This one looks like a single key. Nobody can tell your setup from a phone wallet's. - **You can pay a silent payment address at all.** Silent payments exclude script multisig inputs. A MuSig2 key path is the only multisig that can send to an `sp1…` address. - **The recipient gets a fresh output every time**, from an address they published once. No address reuse on their side, no way to link your payment to their other payments. - **You pay a name, and your signers check it.** No long address to compare by eye; the device proves the name resolves to the address it is paying. - **No co-signer can misdirect the money.** Every share comes with a proof, and each device refuses to sign if any proof or the output does not check out. - **Cheaper.** One 64-byte signature instead of two signatures plus a script: this spend was 111 vB. What the chain sees one taproot input · one taproot output · one 64-byte signature No multisig is visible. No `sp1…` address ever appears on chain; a silent payment address is never written anywhere but the payer's own wallet. ## The transactions | Network | Spend | Block | Output the recipient found | Size | |---|---|---|---|---| | Mainnet | [e809314c820d10da3b911efc947031f01f9d0b3e19557605733c867b1572d332](https://mempool.space/tx/e809314c820d10da3b911efc947031f01f9d0b3e19557605733c867b1572d332) | 965485 | [`bc1pcnasn84eqqfve8sktfat65nww07z66u5eftzlj0a2dgvxx3klanqlz74k6`](https://mempool.space/address/bc1pcnasn84eqqfve8sktfat65nww07z66u5eftzlj0a2dgvxx3klanqlz74k6) | 111 vB | | Bitsaga Signet | [eba1bb443e66d9560432e5ee8e24aacfa3c74356d763cc9eca7e793fbd0d0126](https://signet.bitsaga.be/api/tx-proof?txid=eba1bb443e66d9560432e5ee8e24aacfa3c74356d763cc9eca7e793fbd0d0126) | 92601 | `tb1pl04f5aqp0fax7jq3sqfyhc5we7s37ngwa8y3786hl8p6r9z3tatq3csga8` | 111 vB | | Regtest | `e8854615af629f19b3ad110f84ec83baaa3f48a5ffb14e61951d4ebba52562e8` | 340 | `bcrt1pggk5lc7grxnkxelsmesj75txphqkjdr76te7uxcgcn8v8zvcre6ssft5d7` | 111 vB | The spending input is the 2-of-3 coin at [`bc1p2ky0fhk8n88swkfxcemjwlyr87funhyfsyh040t3wza0ad402qjq42q0pd`](https://mempool.space/address/bc1p2ky0fhk8n88swkfxcemjwlyr87funhyfsyh040t3wza0ad402qjq42q0pd), funded by [1aa25dced4408f506ad11a8e9c855fd7b29bde07044790192ae8431ae1db8687](https://mempool.space/tx/1aa25dced4408f506ad11a8e9c855fd7b29bde07044790192ae8431ae1db8687). The recipient's silent payment address is `sp1qq053744rl7pn5sx84z5yu7kx03dlxescex28agq7euwanatf45sfzqmhvlcgjfrfmj5mqde4rtnm6ggz6ye8gd2g9ltw8n5k725tg99ptseau3ru`. It does not appear in either transaction; the output above was derived from it and from the input, and the recipient found it by scanning with its scan key, nothing else. ## The screens Two simulated SeedSigners, one seed each, in two separate browsers. The coordinator between them holds no key. Each signer scans the transaction three times. ### The recipient is a name The transaction pays `musig2@silentpayments.net`, a BIP-353 payment name. Its DNS record carries the silent payment address, and the PSBT carries the RFC 9102 DNSSEC proof of that record (2580 bytes). Each device validates the proof itself, from the root trust anchor down, and shows the name as verified only when the proof is valid, current, and covers exactly the address the output is derived from. A signer has no clock, so it takes its date from a timecode QR (`oT260904130533`, UTC). The rule is that the date comes from a second screen; in this run the coordinator was that second screen, so the date check proves the mechanism and not independence. ### Step 1 of 3: a share and a proof The output does not exist yet. The device shows who it is paying, and hands back its share of the Diffie-Hellman secret with a BIP-374 proof that the share was made with its own key. ![Signer A: seed loaded](https://bitsaga.be/images/insights/musig2-silent-payment/main-A-seed.png) Signer A: seed loaded ![Signer B: seed loaded](https://bitsaga.be/images/insights/musig2-silent-payment/main-B-seed.png) Signer B: seed loaded ![Signer A: date taken from the timecode QR](https://bitsaga.be/images/insights/musig2-silent-payment/main-A-date.png) Signer A: date taken from the timecode QR ![Signer B: date taken from the timecode QR](https://bitsaga.be/images/insights/musig2-silent-payment/main-B-date.png) Signer B: date taken from the timecode QR ![Signer A reviews: the name, verified, the amount, the address](https://bitsaga.be/images/insights/musig2-silent-payment/main-A-review.png) Signer A reviews: the name, verified, the amount, the address ![Signer B reviews the same](https://bitsaga.be/images/insights/musig2-silent-payment/main-B-review.png) Signer B reviews the same ![Signer A: step 1 of 3, nothing signed](https://bitsaga.be/images/insights/musig2-silent-payment/main-A-step1.png) Signer A: step 1 of 3, nothing signed ![Signer B: step 1 of 3, nothing signed](https://bitsaga.be/images/insights/musig2-silent-payment/main-B-step1.png) Signer B: step 1 of 3, nothing signed ### Step 2 of 3: nonces The coordinator has combined the two shares into the output script. Each device verifies the other signer's proof and recomputes the script before it publishes a nonce. The review now shows the derived taproot address. ![Signer A reviews the derived output](https://bitsaga.be/images/insights/musig2-silent-payment/main-A-review2.png) Signer A reviews the derived output ![Signer B reviews the derived output](https://bitsaga.be/images/insights/musig2-silent-payment/main-B-review2.png) Signer B reviews the derived output ![Signer A: step 2 of 3, still nothing signed](https://bitsaga.be/images/insights/musig2-silent-payment/main-A-step2.png) Signer A: step 2 of 3, still nothing signed ![Signer B: step 2 of 3](https://bitsaga.be/images/insights/musig2-silent-payment/main-B-step2.png) Signer B: step 2 of 3 ### Step 3 of 3: partial signatures With both nonces in, each device verifies everything again and signs. Stock Bitcoin Core v31.1.0 aggregates the two partial signatures into the one Schnorr signature on chain, and relays it. ![Signer A: signed](https://bitsaga.be/images/insights/musig2-silent-payment/main-A-step3.png) Signer A: signed ![Signer B: signed](https://bitsaga.be/images/insights/musig2-silent-payment/main-B-step3.png) Signer B: signed ![Signer A hands the transaction back](https://bitsaga.be/images/insights/musig2-silent-payment/main-A-qr3.png) Signer A hands the transaction back ![Signer B hands the transaction back](https://bitsaga.be/images/insights/musig2-silent-payment/main-B-qr3.png) Signer B hands the transaction back ## Found by someone else's code The sender's own arithmetic finding its own output proves little. So the receive side was checked with software that knows nothing about MuSig2, PSBTs or shares: setavenger's [blindbit-cli](https://github.com/setavenger/blindbit-rs) (Rust), pointed at our [BlindBit Oracle](https://silentpayments.net/lookout) and given only the recipient's scan key and spend public key, scanning block 965485. ``` 2026-09-04T14:19:42.958942Z INFO connecting to oracle service oracle_url=http://127.0.0.1:8011 2026-09-04T14:19:42.958986Z INFO no existing state file, creating new scanner 2026-09-04T14:19:42.964059Z INFO scanning blocks start=965485 end=965485 2026-09-04T14:19:42.970556Z INFO probable match found txid=e809314c820d10da3b911efc947031f01f9d0b3e19557605733c867b1572d332 2026-09-04T14:19:43.003978Z INFO received block from peer peer=127.0.0.1:8333 block_hash=00000000000000000000559c736df96712d1869641436c16874a4ab350ec4b46 tx_count=3268 elapsed_ms=13 2026-09-04T14:19:43.008680Z INFO balance total=0.00049550 BTC confirmed=0.00049550 BTC trusted_pending=0 BTC untrusted_pending=0 BTC 2026-09-04T14:19:43.013950Z INFO balance after scan total=0.00049550 BTC confirmed=0.00049550 BTC trusted_pending=0 BTC untrusted_pending=0 BTC 2026-09-04T14:19:43.014209Z INFO saving scanner state path=/home/rob/.cache/tmp/musig-blindbit-state.json 2026-09-04T14:19:43.014826Z INFO state saved 2026-09-04T14:19:43.014834Z INFO scan completed successfully exit 0 ``` ## Why this needed new work BIP-352 derives the recipient's output from the sum of the input private keys. For a taproot input that is the key behind the output key. In a MuSig2 key path no one has it; each signer has a share. Diffie-Hellman is linear, so the shares can be combined: each signer contributes `d_i · B_scan`, and the public KeyAgg coefficients, parity and tweaks turn the pieces into exactly what a single holder would have computed. BIP-352 itself sketches this in a footnote and says a proof may be needed. The proof is the part that matters. A share nobody can check lets one co-signer send the money to an output the recipient will never find. That is a loss of funds, not a privacy leak. Each share here travels with a BIP-374 proof against the signer's own participant key, and every device verifies every other proof, and the output script built from them, before it lets a nonce or a signature out. A tampered share, a borrowed proof and a wrong script are each covered by a test that expects a refusal. The PSBT fields are the ones macgyver13 proposed for exactly this case in [Silent Payments from a MuSig2 Treasury](https://gist.github.com/macgyver13/0f0281add9a27013c7ee519cad8084c6) (July 2026), with a draft Coldcard implementation: `0x21` for the partial share and `0x22` for its proof, keyed by scan key and participant key. Using the same fields means a Coldcard on that branch and this device could sit in the same 2-of-3. We found no earlier on-chain transaction of this kind on any network; if you know one, tell us and this page will say so. ## What is not claimed - The signers are the SeedSigner firmware running in a browser, not hardware. Same code, different box. - BIP-352 says collaborative silent payments have no formal security proof. This does not change that. - The standard BIP-375 per-input share and proof fields are not filled, because their proof needs the input's private key and nobody has it. Run over this PSBT, the BIP-375 reference validator passes the structure and input eligibility checks and fails ECDH coverage with *Silent payment output present but no ECDH share for scan key*. The per-signer proofs are the substitute, and a validator that reads them is a few lines. - The coordinator fills the MuSig2 fields with a watch-only Bitcoin Core wallet, aggregates the shares itself, and hands the finished PSBT to Core to finalise. Core has no silent payment code and did not need any. ## Check it yourself Signers: fingerprints A `51b2ac0e`, B `ae2e215d`, C `05c4677a` (C never signed). Recipient R `91c1bf2e`. Descriptor of the coin: ``` tr(musig([51b2ac0e/86h/0h/0h]xpub6BxBRQe31Zh57HuUBtqcJwnnZyKc4ucFTkWHRNZNhBC4rgMC3DhCJ5Kv5hoaBbkQ28KpGBQvL7XBnR8SSTimbwPX2pFpjKTFibNrVbcnzuE,[ae2e215d/86h/0h/0h]xpub6BiRes3J9ir1VWEsaRj3E8zsUpcbV4AA1ySfWWYpYWQVLVMwKHLAwNCoC7q2RDVH7mVfeNq8UgsoHgsxV5pkemSJr914BDwujN32GyqjvtF)/0/*,{pk(musig([51b2ac0e/86h/0h/0h]xpub6BxBRQe31Zh57HuUBtqcJwnnZyKc4ucFTkWHRNZNhBC4rgMC3DhCJ5Kv5hoaBbkQ28KpGBQvL7XBnR8SSTimbwPX2pFpjKTFibNrVbcnzuE,[05c4677a/86h/0h/0h]xpub6CLo3LtaYZhFJt4mUTGYgFGaFJ5NyXPk82boafvMTjbN84oXaT2FEyCnHG1mVSJ6RT3JyjeovW4qw6mR7TMdVfwVWAGS8vQY39AtqSnoa6v)/0/*),pk(musig([ae2e215d/86h/0h/0h]xpub6BiRes3J9ir1VWEsaRj3E8zsUpcbV4AA1ySfWWYpYWQVLVMwKHLAwNCoC7q2RDVH7mVfeNq8UgsoHgsxV5pkemSJr914BDwujN32GyqjvtF,[05c4677a/86h/0h/0h]xpub6CLo3LtaYZhFJt4mUTGYgFGaFJ5NyXPk82boafvMTjbN84oXaT2FEyCnHG1mVSJ6RT3JyjeovW4qw6mR7TMdVfwVWAGS8vQY39AtqSnoa6v)/0/*)})#ad0j2vv3 ``` The final PSBTv2, with both shares, both proofs, both nonces and both partial signatures: ``` cHNidP8BAgQCAAAAAQMEAAAAAAEEAQEBBQEBAQYBAAH7BAIAAAAAAQErUMMAAAAAAAAiUSBViPTex5nPB1kmxncnfIM/k8nciYEu+r1xcLr+tq9QJAEOIIeG2+EaQ+gqGZBHBAfem7LXX4WcjhrRalCPQNTOXaIaAQ8EAQAAAAEQBP3///9CFcALpXUNm1lq7JOKhbHz8j1VoeGD+4uD+mRpMjhAWY0vfYso6wKPb42ExHulb2pyppiCiFwr4uzaJBCoAd8BI0sHIyAJJvzNv8gsoyZklHQzC70jBuZQisf4tqjselTa3S4QfqzAQhXAC6V1DZtZauyTioWx8/I9VaHhg/uLg/pkaTI4QFmNL32r67sIYAgHBD5ZRVyjN7H9JDr63incNwre6UU070PULiMgbBUlfSworxJkWbT/omy4VVCqUdiCctJBYPmVhwG03ImswCEWCSb8zb/ILKMmZJR0Mwu9IwbmUIrH+Lao7HpU2t0uEH4tAavruwhgCAcEPllFXKM3sf0kOvreKdw3Ct7pRTTvQ9QuDcm/GgAAAAAAAAAAIRYLpXUNm1lq7JOKhbHz8j1VoeGD+4uD+mRpMjhAWY0vfQ0AWEM4yQAAAAAAAAAAIRYiTdR7h/sKxvpckGpgB/gPNLzZjdpFgovwGPsAAOE/EFECiyjrAo9vjYTEe6VvanKmmIKIXCvi7NokEKgB3wEjSwer67sIYAgHBD5ZRVyjN7H9JDr63incNwre6UU070PULlGyrA5WAACAAAAAgAAAAIAhFmwVJX0sKK8SZFm0/6JsuFVQqlHYgnLSQWD5lYcBtNyJLQGLKOsCj2+NhMR7pW9qcqaYgohcK+Ls2iQQqAHfASNLB6eZRKEAAAAAAAAAACEWhpfHxqsKLv88PBOmdXLHS6GGwjjvtM49RkOioqoKvAZRAoso6wKPb42ExHulb2pyppiCiFwr4uzaJBCoAd8BI0sHq+u7CGAIBwQ+WUVcozex/SQ6+t4p3DcK3ulFNO9D1C4FxGd6VgAAgAAAAIAAAACAIRaZTX0F79vthbdFXLR6G5DRjWOPNS77aVOW+n0sZt2EfVECiyjrAo9vjYTEe6VvanKmmIKIXCvi7NokEKgB3wEjSwer67sIYAgHBD5ZRVyjN7H9JDr63incNwre6UU070PULq4uIV1WAACAAAAAgAAAAIABFyALpXUNm1lq7JOKhbHz8j1VoeGD+4uD+mRpMjhAWY0vfQEYIBX07wYPxZWeaz9EWPqc/WGR1bUhl0kjz922L8riBO7UIhoCbSk77poyTs0ogGPPKpTiKneoEs7vDV9SSc5NEJA6XUdCAoaXx8arCi7/PDwTpnVyx0uhhsI477TOPUZDoqKqCrwGAplNfQXv2+2Ft0VctHobkNGNY481LvtpU5b6fSxm3YR9IhoDAKjVre2TJywF58Ex8VSSXvK5JU4PZjbgwYqc7sbvintCAoaXx8arCi7/PDwTpnVyx0uhhsI477TOPUZDoqKqCrwGAyJN1HuH+wrG+lyQamAH+A80vNmN2kWCi/AY+wAA4T8QIhoDZSNrpv1dMA8KmZhYy6QB8jzOPGbVBVrBwVogSVoQ1SNCAplNfQXv2+2Ft0VctHobkNGNY481LvtpU5b6fSxm3YR9AyJN1HuH+wrG+lyQamAH+A80vNmN2kWCi/AY+wAA4T8QQyED6R9Wo/+DOkDHqKhOesZ8W/NmGMmUfqAezx3Z9WmtIJEDIk3Ue4f7Csb6XJBqYAf4DzS82Y3aRYKL8Bj7AADhPxAhAicgfYIv/DTLOiBrLHW+9vMpcNnfg9R/JLJ5n+vqjDZbQyID6R9Wo/+DOkDHqKhOesZ8W/NmGMmUfqAezx3Z9WmtIJEDIk3Ue4f7Csb6XJBqYAf4DzS82Y3aRYKL8Bj7AADhPxBA1fMGTHwYqWQM9fpL+fgYYBtNWYttI2cDEX4AWrJYniv71/vez86Vygpgb9tMVSE37isUFf3GvPoilQwxLkUeHkMhA+kfVqP/gzpAx6ioTnrGfFvzZhjJlH6gHs8d2fVprSCRAplNfQXv2+2Ft0VctHobkNGNY481LvtpU5b6fSxm3YR9IQKsls4uR/TuwFWRcsM12NYDUCmlcAVij4i8YV8TpRnWTUMiA+kfVqP/gzpAx6ioTnrGfFvzZhjJlH6gHs8d2fVprSCRAplNfQXv2+2Ft0VctHobkNGNY481LvtpU5b6fSxm3YR9QD/ozYCn5gkF6gzvmPbLcdDVsCh7e2MXW12LATATXjx5ZIHCnp3QAkJlbiEkd2bT2E2RY955UyUQ+pJi8nIzR31DGwMiTdR7h/sKxvpckGpgB/gPNLzZjdpFgovwGPsAAOE/EAJViPTex5nPB1kmxncnfIM/k8nciYEu+r1xcLr+tq9QJEICMwTjyV90VXiuulCPrgP3ty9RzWzMWvIWlOYI+EVRDTUDOEbzBkikPypvIJxIrdHGaQ2KmHJbYQgm+gqSu66bPXpDGwKZTX0F79vthbdFXLR6G5DRjWOPNS77aVOW+n0sZt2EfQJViPTex5nPB1kmxncnfIM/k8nciYEu+r1xcLr+tq9QJEICJRmmfijDLdZWSPtxIpZJTnv1rPqDmKKaBTJMFR2rYrICf9DHLzLf/hjbqd1RnJ2qpjHwxLdDPAJWOyWoc8BdEvhDHAMiTdR7h/sKxvpckGpgB/gPNLzZjdpFgovwGPsAAOE/EAJViPTex5nPB1kmxncnfIM/k8nciYEu+r1xcLr+tq9QJCAod/jw7YFEqQUD+rBm90ewJht1mi5em/NNpmfCxBl070McAplNfQXv2+2Ft0VctHobkNGNY481LvtpU5b6fSxm3YR9AlWI9N7Hmc8HWSbGdyd8gz+TydyJgS76vXFwuv62r1AkIJQqgMgZmA6wyYAbYh6xnfEJsmFwCjcKZQq/PzUe41jwAAEDCI7BAAAAAAAAAQQiUSDE+wmeuQASzJ4WWnq9Um5z/C1rlMpWL8n9U1DDGjb/ZgE1/S4KGW11c2lnMkBzaWxlbnRwYXltZW50cy5uZXQGbXVzaWcyBHVzZXIQX2JpdGNvaW4tcGF5bWVudA5zaWxlbnRwYXltZW50cwNuZXQAABAAAQAAASwAgYBiaXRjb2luOj9zcD1zcDFxcTA1Mzc0NHJsN3BuNXN4ODR6NXl1N2t4MDNkbHhlc2NleDI4YWdxN2V1d2FuYXRmNDVzZnpxbWh2bGNnamZyZm1qNW1xZGU0cnRubTZnZ3o2eWU4Z2QyZzlsdHc4bjVrNzI1dGc5OXB0c2VhdTNydQZtdXNpZzIEdXNlchBfYml0Y29pbi1wYXltZW50DnNpbGVudHBheW1lbnRzA25ldAAALgABAAABLABmABANBQAAASxqnCGtaplijYbJDnNpbGVudHBheW1lbnRzA25ldAAw+ZXudHh8zVnmWIv/98xINR7s7NYl9NsnzWhqmRJaMugHKLtKc8Ozdkzvitrfjz6Y35aktgN0X3BSIAjsUIofDnNpbGVudHBheW1lbnRzA25ldAAAKwABAAFRgAAkCUMNArie4JSpCeeAF4jUB568f2yhZJTWLUo4u/dP/6Zk9t3WDnNpbGVudHBheW1lbnRzA25ldAAALgABAAFRgABXACsNAgABUYBqn4TOapY55hxoA25ldADogJ1aUoBcUEfZSuJo59Li5ZoTymUeWnJSf2u7WoCyFPFX3XDvjpsXSX3Y0FbESOyU10fbA7iJddNjdR67a4SvDnNpbGVudHBheW1lbnRzA25ldAAAMAABAAACqQBEAQADDaCTEREs+ROIGM0v6ulw671NajD2CIwlsyWjmrvFzRGXqgmCg+Wq9CEXfCql1xSZKplX0bzBj5jNcfHxgGtl4UgOc2lsZW50cGF5bWVudHMDbmV0AAAwAAEAAAKpAEQBAQMNmdsswUyr3DPW132mOi8V9xESWE8jTo0dxCjjnopKl+GqJxpVXckHAeF+KkxLbxILfDLUT0rAK9iUzy1L53eKGQ5zaWxlbnRwYXltZW50cwNuZXQAAC4AAQAAAqkAZgAwDQIAAA4QatvOU2qLYtMJQw5zaWxlbnRwYXltZW50cwNuZXQAmo++rHnoOA6FZCN7trrw7+F/ue2/Mx0a0JTUV4rSXkDUOm6PsxDNIJUiczDUy7AHTvj10aFOR5W5Q4qJ+AFWiQNuZXQAADAAAQAAEoEARAEAAw2XuuCNH860DRjQM91BYAi7tUIxtOaLN81AZPgkJTgkrLWGHuq8sdZkciJyzQEqcDeZLuJvwR2m0ODq1aRdy/fvA25ldAAAMAABAAASgQBEAQEDDR4gaBqcw0QIKw5lF100p5e4wl+h8eW85FNo0sTG1SNNckvtdxMjoIZwonQV1NGx9oItsPRoWBmnKVOgq7cKBTYDbmV0AAAuAAEAABKBAFcAMA0BAAFRgGqhaNtqjaEvkdMDbmV0AJdj8bfAReahHHTh94wSl9WF5K8m3CF96PKvYKqD+IATIK1Vwnqh6ufhRFCISF9eH5DGqIywrbNWEorsFhMaSAkDbmV0AAArAAEAARhhACSR0w0CLwvsLW95370dCP0ho6+S0OOaS57x4/QRH/8oJJDaRTsDbmV0AAAuAAEAARhhARMAKwgBAAFRgGqrc9BqmkJA4bQAvJsTOiH7+a71CYMTP8XcahJgp4n2eu4OY+DmvHcOLGKSWIUyo4k1nPo7mKPTYgLbBqjHBSikGsMLM9TYAgeNsnAXU1r+fTHhNiMmyQlmJG5tP9iMORfCKqqj36B4MbMw4Ul70FrpPz5Az+zkXtxiRXwKz9xye/rpmObS1X+3rvkh0HenV0FshlZ2sxRXc8+2lWOUrNG2QmPH17nG2RgxR4CBPy0DMg7Wxqy4UdIzXSDqLTBiabVRhlV1xkmHjX8+cWWBL5Csa5GJktL7f06BSuVyR4BRlgCPqTTsARZA6C6Ircwl+Zc+s5vWhLeikhVK8yA7sJ03ezcWbFCo05cxOwAAMAABAAALLAEIAQADCAMBAAHgmA+me1lilS3rloKMCj/t4PhrNXJyyqu2twmkMUKb/G37hVSNFpxt96mkh/zMPSAYIn63c3+F2Pw0C58gSfTH2jsgFrhGhJmCfhkD4sFVX7LRsEgNTHHxSVLbU4Kth7ru+CgEYbQPMD6Pzd13MmELTYc/qgjOTQW93nMf52sOrGGm/S8Uun9nFNKtN/vgT+SrNFHn/FiQmv9YswmBPrzJMKJbVfrRDWt4aV4me45Xv8XYGmaz4uWRpsi1SN+INV1WKzZbAgk5jbxUCH81uUkxUBbEKYs3M8hZ/a9y80scTwjcHZQhvOGxEdAZncKmxek2p7/hcTDmr62oZI+MCMuZAAAwAAEAAAssAQgBAQMIAwEAAaz/tAm8yTn4Mfeh5eyI96WSVexTBAvkMgJzkKTOiW1vkIbzxeF3+/4RgWOq7HrxRixHlFlExOLAJr5emLvN7SWXgnLh4+B5xQlNVz8Og8kvArMtNROxVQuCaSnIDdD5LKyWbRd2n9WGe2R8PzgCmr3EgVLrjyBxWezF0jLHwVN8efS3rCj/EWgvIWgb9tarpVUDK/b58Da+sqqls3eNbuv7pr+eoZG+SrDK6nWeL3c6H5Apxz7LjVc1uTIdsIXxuOLYA4/ilBmSVIzuDWfdRUfhHdY6+cn8HFRm+2hM8AnXGXws9555KrUB5qihylGa8subX2Nn6UwNR1AkUTV74bUAADAAAQAACywBCAEBAwgDAQABr3qN66SdmVp5Ku/IAmPpke/byGE4qTHessZdVoLqtdOwNzjj39yJ2W2mTIbAIk2c4CUU0oXaMGixkFTl54eylpBY6Y4SVmyMgIxAwLdp4dsaJKG9mzHjAxhKMfx7tWuFu7qKvALNUECkRKNtR2lZaYSeFq2Fa7WOj6yIVSJEADGb2rIk2D/A5mqrMv90v+rw+RxFTmhQoSlSB7vUzd6Pb/sI+ql1XC4yhO+gH5k5Phh4bLEy8eZuvGUXMY4c6KO3M367VNA1q1fZcG7Nk1DUr6zYJeQ8hmjuzomBnK9oF69i3E+9gvDjP2ZHsra9oXXxRgf1n0Y1RR5rJ98oLvc9hwAALgABAAALLAETADAIAAACowBqryIAapNygE9mAD73wmLCyL6sBOdg99hcfsy+N55vKIz/1tzG7G1LuCLAansIxUbwL9NDKdnoV9iMo0VFdn4bRzxcy9xtDyvRrnEb+wG/e0WrmjolSZwKqlIxC0EeB3nUjVZ6a4xfFFJkYlzzk1wA/1hFiwJPTDjnMBfsSngeH/LKXCzCFQwPa99mnwqbtpYbP968Aw+vOxgs9hzecuPxMOVovGUg90zLW2kqBjm+92ac8NF6gZPT6gVRGT3Edm2ZID0UGUWM/D8IGuufCdYYcOqp93qHH+FpbgJXSRndsGL1y1K8HWREp2GnNGqvDmNrd2djGKF9SZy0LbSLccpbVUCL/AKEJ1DHrf8BCUID6R9Wo/+DOkDHqKhOesZ8W/NmGMmUfqAezx3Z9WmtIJEDd2fwiSRp3KmwNzUa570hAtEydDVIL9bjzpbyqLQUoVwA ``` The transaction as broadcast: ``` 020000000001018786dbe11a43e82a1990470407de9bb2d75f859c8e1ad16a508f40d4ce5da21a0100000000fdffffff018ec1000000000000225120c4fb099eb90012cc9e165a7abd526e73fc2d6b94ca562fc9fd5350c31a36ff66014002c8d41657f94da833f972bb522c373c83e8fcf05a9af56b5c53634bfe5ac143a5b57b593d34386f74fa5aab74f153217e9fe036439c5a02417ec0225ee8923f00000000 ``` Code: firmware branch `musig2` on [bitsagarob/seedsigner](https://github.com/bitsagarob/seedsigner) (helpers `musig2.py`, `musig2_psbt.py`, `musig2_session.py`, `musig2_sp.py` and their tests), simulator build served unlisted beside the [SeedSigner simulator](https://bitsaga.be/seedsigner-simulator/) at `/seedsigner-simulator/musig/wallet.html?firmware=doomsigner-musig`. Mainnet spend confirmed 4 September 2026, block 965485. Regtest and Bitsaga Signet runs the same day. Every screen, transaction and proof on this page is reproducible from the repository.