MPC vs. multisig: which custody technology is more secure?

Multi-signature (multisig) wallets require several independent keys to authorize a transaction. Multi-party computation (MPC) splits one key into shares that never combine, so the parties still produce a single signature together. Both remove the risk of a single lost or stolen key. Neither removes the risk of a compromised signing ceremony, and neither is more secure than the other in the abstract.

Multisig enforces its quorum on-chain, in a script or contract that anyone can inspect. MPC enforces its quorum inside a cryptographic protocol, off-chain, producing a signature indistinguishable from an ordinary one. The difference between the two is not a ranking, but a difference in where trust is placed and how it is verified.

Multisig and MPC both remove the risk of a single point of failure in key management, but they enforce that protection in different places. Multisig requires a defined number of separate keys to sign a transaction, written into a script or contract that the network checks. MPC splits one private key into shares that never combine, and a threshold of those shares must cooperate to produce one ordinary-looking signature.

The distinction matters because it changes what a defender needs to verify. An auditor examining a multisig wallet can read the quorum requirement directly from the chain. An auditor examining an MPC wallet has to trust the correctness of the software implementing the threshold protocol, since the split key and the cooperation between shares happen off-chain and leave no separate on-chain trace.

Multisig originated as a feature of the Bitcoin protocol itself. Bitcoin Improvement Proposal 11 introduced m-of-n multi-signature transactions in 2012, initially limited to three keys. Bitcoin Improvement Proposal 16 added pay-to-script-hash addresses that made multisig practical to use at scale.

A 2020 academic analysis of Bitcoin's on-chain scripting limits sets the resulting bound at 15 public keys under that standard, later extended to 20 under the segregated witness upgrade. Under this design, a wallet is spendable only when a threshold number of signatures, drawn from a larger set of authorized keys, appears together in the unlocking script.

Ethereum has no equivalent opcode. According to Ethereum account abstraction documentation, a multisig wallet on Ethereum is a smart contract that enforces the same m-of-n logic in code the network executes. Multisig is not one technology with a single specification. It is a pattern implemented separately on each network, bounded by whatever limits that network places on script size and complexity.

MPC applied to signing distributes a single private key into cryptographic shares among several parties, none of whom ever holds the complete key, before, during, or after a transaction is signed.

A 2016 paper by cryptographers Rosario Gennaro, Steven Goldfeder, and Arvind Narayanan introduced the first practical threshold ECDSA scheme built specifically to secure Bitcoin wallets because ECDSA, the signature algorithm Bitcoin and most other chains rely on, is markedly harder to compute in a distributed way than algorithms such as RSA or Schnorr signatures.

Later protocols, including the FROST threshold protocol described in a 2024 Internet Research Task Force document for Schnorr-based signatures, reduced the communication required between signing parties, making threshold signing fast enough for institutional transaction volumes.

The output of an MPC signing session is a single, standard signature. It looks identical to a signature produced by one key holder acting alone, because from the network's perspective, that is exactly what happened. The distributed computation that produced it never touches the chain.

Multisig places its trust in the blockchain itself. The rule that a transaction needs a threshold number of signatures is enforced by every node that validates the chain, and it is visible to anyone who inspects the address or contract. MPC places its trust in the cryptographic protocol and its implementation instead. The threshold rule is enforced before a transaction ever reaches the chain, and no external validator confirms it.

This is the real axis of comparison, and it is not the same axis as which one is harder to break. A flaw in a multisig contract is discoverable by anyone who can read the code that governs it, which is why audited multisig contracts accumulate a public track record over time. A flaw in an MPC implementation is discoverable only by someone with access to the source code and the expertise to analyze a cryptographic protocol.

Multisig is auditable in a direct sense. The quorum requirement sits in the address or contract itself, and anyone with a block explorer can confirm it before sending funds. That transparency comes at the cost of portability, since a multisig wallet works differently on every network: Bitcoin enforces m-of-n logic through a native script, while Ethereum requires a deployed smart contract funded with its own resources and audited on its own terms.

MPC produces a signature that is chain-agnostic by construction. Because it is indistinguishable from a signature generated by a single key, it works with any chain that already verifies ECDSA or Schnorr signatures, without requiring a special script or contract. What MPC gives up is that same on-chain transparency: a threshold quorum enforced inside a protocol cannot be confirmed simply by reading the address.

Recovery differs in a similar way. Losing a key share in a well-designed MPC setup does not require moving funds to a new address, because research on proactive secret sharing, dating to the mid-1990s, established that key shares can be refreshed among the remaining parties while the underlying key, and the public address tied to it, stay the same. Recovering from a lost key in a multisig wallet typically means constructing a new script or contract with a new set of keys and moving the funds into it, an operation that is itself a visible, on-chain event.

No single answer holds across every deployment. Both technologies remove the risk that one compromised key drains a wallet, and both have been broken in the field, not through a flaw in the underlying mathematics, but through a compromise of the layer around it: a phishing attack, a poisoned software update, or a manipulated transaction display that fooled a legitimate signer.

In 2025, the largest single exchange breach on record drained more than $1.4 billion from a cold wallet secured by multisig. Public post-incident analysis found that the multisig threshold itself functioned exactly as designed, since the required number of independent signers approved the transaction. The compromise sat in what those signers were shown before they signed: a manipulated transaction display that made a malicious transfer look like a routine one.

Cryptography was not the failure point. The interface between the signers and what they were actually authorizing was. Neither multisig nor MPC would have prevented that failure on its own, because the vulnerability lived in the layer where a human confirms what a machine is about to do, a layer that sits outside both cryptographic schemes.

Multisig suits situations where transparency and governance matter as much as the transaction itself: treasuries with multiple stakeholders, decentralized organizations, and any setup where an outside party needs to verify the signing rule without taking an operator's word for it. MPC suits situations where speed, multi-chain reach, and operational scale matter most: exchanges and custodians executing high transaction volumes across many networks through a single, chain-agnostic signing process.

Institutional custody providers increasingly run both, using multisig where an auditable, on-chain rule is itself part of the control, such as board-level or treasury-level approval, and MPC for the high-frequency signing that supports trading, staking, or settlement across dozens of networks. It is a choice between two places to put a verification burden: on-chain, where anyone can check it, or inside a protocol, where fewer people can, and each burden fits a different job.