A married couple wants to manage shared blockchain assets—an NFT collection held at a joint address, funds in a DeFi protocol, or tokens representing business equity—without one person handing over their private keys to the other. The address itself can be written down or displayed on both devices. But how does the spouse actually interact with it? A traditional setup where both people know the same recovery phrase creates a single point of failure: if one person’s computer is compromised or one person acts without the other’s knowledge, the shared assets are at risk. A business partner facing similar constraints faces legal and operational problems on top of security ones. How do you enable two people to sign transactions from the same address without either one depending on the other’s recovery phrase or trusting a centralized intermediary?

A multi-signature smart contract can solve part of this problem by requiring both signers to approve a transaction before it executes. But not every address is a multisig, and retrofitting an existing address is costly. An alternative approach uses separate hardware wallets, separate Rabby Wallet installations, and address sharing rather than key sharing. Each person controls their own private credentials, installs their own copy of the wallet, and accesses the shared address through hardware-backed signing or as a “watch-only” address for transaction monitoring. The practical arrangement is neither as simple as handing over a seed phrase nor as technically complex as deploying a contract—it is a middle path that trades convenience for security, and only works if both parties understand exactly what each person can and cannot do.

The fundamental difference between accessing an address and controlling a private key

When a person installs Rabby Wallet, they create or import a recovery phrase that controls one or more private keys. Those keys are stored on their device, protected by encryption and the operating system’s security architecture. Any transaction initiated from a key controlled by that phrase must be signed by that key. By contrast, an address is just a public destination—it can be known, displayed, and used to receive funds by anyone who has written it down or been given it. Two people can both know the same address without either one knowing the other’s private key.

The distinction becomes concrete in practice. Alice generates a hardware wallet on a Ledger device, imports its first address into her Rabby Wallet installation, and writes down the address—say, `0x1234…`. Bob independently generates his own hardware wallet on a different Ledger device, also imports the same address into his Rabby Wallet installation by typing or pasting it, and writes down the same address. Both Alice and Bob can now see the address balance, view its transaction history, and construct transactions intended to move funds from it. But only Alice can sign with her hardware key, and only Bob can sign with his hardware key. Neither one has the other’s recovery phrase. Neither one can take unilateral action from that address unless the contract or protocol itself allows single-signature control—which brings us back to multisig or other access structures.

A self-custodial wallet like Rabby enforces this boundary. It does not hold private keys on its servers; it assumes the user has them. That assumption means the wallet cannot unilaterally move funds, but it also means the user cannot recover a lost key by proving their identity to the wallet provider. For a couple or business partners, this clarity is valuable. It prevents either party from accidentally delegating control to the other. It also prevents either party from claiming they forgot their key and expecting the partner to retrieve the funds. The key is genuinely the key—no exceptions.

Watch-only addresses and transaction monitoring without signing authority

Not every shared address requires both people to sign transactions from it. Sometimes one person initiates moves, and the other person simply monitors the balance and transaction history. A watch-only address in Rabby Wallet lets someone see activity without having the private key. To add one, a user pastes the public address into Rabby under the “Add Address” or “Import Address” section, and the wallet displays its balance and activity across supported EVM networks without prompting for a signing device.

This arrangement is particularly useful for transparency and compliance. A spouse can see that funds are in the address, observe when they move, and verify that no unauthorized transactions have occurred. A business partner can audit the holdings and receive confirmation that assets are where they are supposed to be. Neither action requires the signer to hand over a recovery phrase. The watch-only viewer cannot initiate transactions; they can only observe. This is not a limitation if the arrangement is intentional—if, for example, one partner is primarily responsible for DeFi yields or rebalancing, while the other partner needs regular reassurance that the assets are still there.

Rabby’s transaction simulation and human-readable details become especially valuable in this context. If one partner constructs a transaction that interacts with a lending protocol, a decentralized exchange, or a bridge, the watching partner can review the details before or after signing. Rabby will show the expected input, output, gas cost, and any security warnings related to token approvals or contract risks. A watch-only address cannot stop a transaction, but it can document what happened and raise a question if something looks wrong.

Hardware wallet compatibility as the foundation for secure multi-user access

Hardware wallet compatibility is the practical key to making this work at any scale. A hardware wallet is a device—a Ledger, Trezor, or similar appliance—that stores the private key offline and only signs transactions when the user physically confirms on the device’s screen. When integrated with Rabby Wallet, a hardware wallet means that even if a person’s computer is infected with malware, the actual signing operation happens on a separate, hardened device. Each person can connect their own hardware wallet to their own Rabby installation, and the shared address becomes signable by either person depending on whose hardware is used.

The setup is straightforward. Alice plugs her Ledger into her computer, opens Rabby, and selects “Add Hardware Wallet.” She confirms the pairing on the Ledger’s screen, selects the account she wants to use, and Rabby displays that address. She then shares the address with Bob. Bob plugs his own Ledger into his own computer, opens his own Rabby installation, manually adds the shared address as a watch-only import, and also notes Bob’s own hardware wallet address separately if he plans to sign. When a transaction needs to be signed from the shared address, Bob needs to use Alice’s Ledger (with Alice’s permission and physical proximity), or Alice needs to sign it. The arrangement forces explicit, synchronous coordination—which is often exactly what couples and business partners need.

This approach eliminates the recovery-phrase problem entirely. Neither Alice nor Bob ever has the other’s seed phrase. Neither one can use the other’s hardware device without being physically present and knowing the device PIN. If Alice’s computer is stolen, Bob’s assets and signing authority remain inaccessible to the thief. Conversely, if Alice and Bob have a falling-out, neither one can unilaterally move the funds—they would need to engage a legal process or agree on a transaction, depending on whether the address is jointly controlled or whether one person’s key is actually required for the protocol in use.

Separating operational control from asset ownership in DeFi and NFT contexts

A shared address can hold NFTs in a collection, tokens in a lending protocol, or positions in a decentralized exchange. When one partner initiates a transaction—listing an NFT for sale, withdrawing yield from a protocol, or executing a token swap—the other partner may want to review it before it executes, or they may want to archive a record of what happened. Rabby’s transaction simulation shows the expected outcome before signing, and the transaction history shows the actual outcome afterward. For couples managing joint assets or business partners stewarding treasury funds, this creates an audit trail.

However, “review” and “approval” are different operations. If only one person can sign, then review by the other person is advisory rather than binding. If the protocol or contract requires both signatures, then review becomes enforcement. The shared address itself does not determine which model applies—the contract’s access control does. A standard Ethereum address controlled by a single private key can only be signed by the holder of that key. A multisig contract can require two or three signatures before a transaction executes. Rabby Wallet supports both, but the difference is built into the contract, not the wallet.

For a DeFi yield farm or NFT marketplace interaction, this means understanding the actual control structure before depositing funds. If both partners want veto power, a multisig contract is necessary. If one partner is trusted to execute moves and the other partner only monitors, watch-only access to the address is sufficient. If both partners need signing capability but cannot be present simultaneously, separate hardware wallets connected to the same address creates a structure where either person can sign, but neither person can unilaterally lock the other out.

Recovery phrases and inheritance: What happens when one person dies or disappears

The arrangement described so far assumes both partners remain active and accessible. But what if one person dies, becomes incapacitated, or is simply unreachable for months? If assets are in an address that requires that person’s hardware wallet to sign, the other person is stuck. This is a real consideration for couples managing joint funds, and it requires planning that goes beyond wallet setup.

One option is to create a recovery phrase from the hardware wallet and store it in an offline, secure location that both people can access in case of emergency. This reintroduces the shared-secret problem: whoever has access to the stored phrase can move the funds unilaterally. A safer variant is to split the phrase using Shamir’s Secret Sharing, where the original phrase is divided into multiple shares such that any N shares (of M total) can reconstruct the key, but fewer than N shares are useless. One partner could hold 2-of-3 shares, the other partner holds 1 share, and a third copy is held in a safe deposit box or by a trusted lawyer. If one partner dies, the other can reconstruct the key with their share plus the third-party share.

However, this approach is not built into Rabby Wallet itself. It requires external tools and careful custody. A simpler, less cryptographically elegant option is for both partners to write down and separately memorize a shared recovery phrase, then store written copies in two different secure locations (neither accessible to the other person). If one person dies, the surviving partner can retrieve the phrase and restore the wallet. This trades some security (both people know the phrase) for simplicity and resiliency. The right choice depends on the value at stake, the trustworthiness of both parties, and whether legal arrangements (like a will or trust document) can address the succession question independently.

Network bridges and cross-chain considerations for shared addresses

If a couple or business partners hold assets across multiple EVM networks—Arbitrum for yield farming, Polygon for low-cost transactions, Ethereum for liquidity or NFTs, Optimism for future upside—a single Rabby installation can display all of them and interact with bridges to move funds between chains. A watch-only address can show balances on all supported networks simultaneously. A hardware wallet can sign transactions on any network that the device supports, as long as the address exists there.

The complication arises when the address was generated from a private key on one network and needs to be used on another. Ethereum addresses derived from a recovery phrase are typically network-agnostic—the same address can be used on Ethereum mainnet, Arbitrum, Polygon, and other EVM chains. The private key controlling the address is the same across all chains. So Alice’s hardware wallet, which signs transactions on Ethereum, can also sign transactions on Arbitrum or Base. But the recovery phrase itself was generated on a specific derivation path, and hardware wallets sometimes have network-specific configurations. Both partners need to ensure their hardware wallets are configured to the same derivation path (usually the Ethereum standard), or they will derive different addresses from the same seed phrase.

For a shared address on multiple chains, this matters immensely. If Alice generates an address on Ethereum using her Ledger and shares it with Bob, Bob must configure his Ledger to the same derivation path to ensure they can both sign the same address on the same network. If Bob uses a different derivation path by accident, his Ledger will derive a different address, and neither partner can sign the other’s address. Rabby Wallet will accept either address as a watch-only import and display both, but they control different funds. This is a setup error, not a wallet bug, but it is easy to make and hard to debug without understanding the underlying derivation structure.

A practical multi-user workflow for couples or business partners

Here is a concrete sequence that avoids the common pitfalls. First, both people set up their own Rabby Wallet installations independently. This can be done by downloading Rabby from this page and creating a new wallet with a secure recovery phrase stored offline. Each person should have their own installation on their own device, with their own operating system and their own backup. This is not inconvenient; it is essential.

Second, each person obtains a hardware wallet—ideally the same model (both Ledgers or both Trezors) to avoid firmware or derivation differences. They generate recovery phrases on the hardware devices and store them securely. They do not share recovery phrases with each other. They connect the hardware wallets to their Rabby installations and note the addresses that appear.

Third, one person (say, Alice) decides on a specific address on a specific network where shared assets will be held. This could be her primary address from her hardware wallet, or it could be a separate address derived from a different account number on her Ledger. She shares this address—just the address itself, not the private key—with Bob. Bob imports this address into his Rabby installation as a watch-only account. He can see balances and history but cannot sign transactions.

Fourth, funds are moved into the shared address. If they come from an exchange or another wallet, the person initiating the move sends them to the address. If they come from one of the partners’ personal addresses, Alice can sign the transaction from her hardware wallet and move them to the shared address in a single step.

Fifth, when a transaction needs to be executed from the shared address, Alice uses her hardware wallet to sign. Bob receives a summary (the human-readable transaction details that Rabby provides), reviews it, and approves in the sense that he confirms it aligns with the agreement or plan. But the actual signature comes from Alice’s hardware device, not Bob’s. If the arrangement requires Bob’s signature as well, then a multisig contract is necessary, and this single-hardware-wallet approach does not work.

If either partner wants unilateral signing power, they can add their own hardware wallet to the same address through multisig deployment or by using a contract that splits signing authority. But at that point, the address is no longer simply a shared Ethereum address—it is a smart contract with its own rules, and Rabby will interact with it accordingly. The level of organizational complexity should match the level of operational control desired.

Security implications and the risk of misuse or misconfiguration

This setup eliminates some risks and creates others. The biggest risk of misconfiguration is someone believing they have signing authority when they do not. If Bob has only a watch-only address and assumes he can sign, frustration and miscommunication will result. Clear documentation and a test transaction before moving significant value prevent this. A test transaction—moving a small amount out of the shared address and back in—confirms that the intended signer can actually sign and that the address is what both people think it is.

Another risk is device loss. If Alice loses her hardware wallet and does not have a recovery phrase stored securely, the shared address is locked forever (unless Bob has a copy of the recovery phrase, which reintroduces the shared-secret problem). If Bob’s computer is compromised, an attacker can watch all the watch-only transactions, though they cannot sign them. If Alice’s computer is compromised, an attacker can construct transactions and try to trick Alice into signing them on her hardware device. A hardware wallet’s screen provides a final check—Alice should always verify that the displayed recipient address and amount match what she intended—but it requires diligence.

A less obvious risk is that the address becomes a point of coordination friction. If one person wants to move funds and the other person is unavailable, nothing happens until they reconnect. This is acceptable for a savings account or treasury fund. It is not acceptable for an active trading or rebalancing workflow. For high-frequency operations, a multisig with automatic execution rules, or a delegated signing authority, may be more practical despite the added complexity.

Finally, consider jurisdiction and regulatory exposure. If the shared address holds assets that might be considered a joint account under local law, and both parties have unequal signing authority, one party might have a legal claim against the other for misuse of shared assets. The wallet enforces the technical constraints, but it does not enforce the legal agreement. A written partnership agreement, business structure, or trust document should accompany any technical setup involving shared cryptocurrency assets. Rabby Wallet is a tool for executing transactions; it is not a substitute for legal and financial planning.