MPC Wallet vs Multisig

How to Decide Between a Multisig Wallet and an MPC Wallet

Start With Your Threat Model, Not the Technology

Most teams start this decision backwards. They read a comparison chart, notice that MPC signatures are cheaper and that multisig transactions are transparent, and pick whichever column has more checkmarks. That approach produces a custody policy that looks good in a vendor deck and falls apart the first time someone asks, “what happens if our MPC provider’s cloud region goes down during a $12 million settlement window?”

The better starting point is to write down, in plain language, the three or four ways your funds are actually likely to be stolen or lost. For a corporate treasury moving payroll-adjacent stablecoin balances, the realistic threats are an insider colluding with an external attacker, a phished finance-team laptop, and a cloud key-management outage. For a fund custodying investor assets, add regulatory scrutiny and third-party audit requirements to that list. For a DAO treasury, add “a core contributor loses their hardware wallet in a move” and “a governance vote gets manipulated.” None of those threat models point to the same architecture, and that is the whole reason this decision resists a one-size-fits-all answer.

Four Questions That Determine Your Path

Once the threat model is written down, four practical questions do most of the remaining work:

• How often does the wallet need to sign? A treasury that settles dozens of small vendor payments daily has a very different cost and latency tolerance than a fund that moves money four times a year.
• How many chains and asset types does the policy need to cover? Multisig is chain-specific by design — a Safe on Ethereum does not help you on Solana or Bitcoin. Most production MPC platforms sign across dozens of chains from one key-share set.
• Who needs to independently verify the security model without trusting a vendor’s word for it? On-chain multisig contracts are open-source and auditable by anyone with a block explorer. MPC’s guarantees live partly in proprietary implementation details you often cannot inspect yourself.
• What is the real cost of a signer being unavailable at the wrong moment? Both models can be designed around this, but they fail differently, and the worked example later in this guide shows exactly how.

Evaluation Criteria: What Actually Separates Multisig From MPC in Practice

On-Chain Footprint and Transaction Cost

An on-chain multisig contract, such as a Safe (formerly Gnosis Safe) on Ethereum, requires the smart contract to verify multiple ECDSA signatures against a stored list of owner addresses before it will execute a call. That verification logic costs gas on top of whatever the underlying transfer would have cost anyway. A threshold MPC signature, by contrast, is produced entirely off-chain through a cryptographic protocol run between key-share holders; the chain only ever sees one signature and cannot tell it apart from a wallet controlled by a single private key. That single distinction cascades into almost every other line item in a custody budget.

Key Rotation and Resharing Without a New On-Chain Transaction

When an employee with multisig signing rights leaves the company, the standard remedy is an on-chain transaction that swaps the owner list — visible, auditable, but also a transaction that costs gas, requires a fresh round of the remaining signers’ approval, and briefly changes the wallet’s address-level owner set for anyone watching. Threshold MPC schemes built on proactive secret sharing can reshare the key material among a new set of parties — adding one device, removing another, changing the threshold from 2-of-3 to 3-of-5 — without ever touching the chain or changing the wallet’s public address. The tradeoff is that this resharing step lives entirely inside the vendor’s protocol, so its correctness depends on an implementation you likely cannot verify line by line yourself.

Chain and Asset Coverage

Multisig implementations are tied to whatever scripting or contract logic a given chain supports. Bitcoin has native multisig scripts going back to 2012; Ethereum-family chains rely on smart-contract wallets like Safe; Solana has purpose-built multisig programs like Squads. Adding a new chain typically means deploying and auditing a new contract, or waiting for a vendor to support it. MPC key-share sets are, by design, curve-and-algorithm bound rather than chain bound: the same threshold ECDSA setup that secures an Ethereum key can typically also secure a Bitcoin or BNB Chain key with comparatively little extra engineering, and EdDSA-based threshold schemes extend that reach to Solana and Cosmos-family chains. This is the single biggest reason large custodians and exchanges lean on MPC platforms internally, even when their published documentation for retail users still talks about “multisig-like” protections.

Auditability, Insurance, and Regulatory Recognition

On-chain multisig has a decade-plus track record, open-source reference implementations, and a security model regulators and auditors already know how to reason about: count the signers, check the threshold, verify the contract hasn’t been silently upgraded. MPC’s cryptography is well-studied in academic literature, but production implementations are proprietary, harder for an outside auditor to fully verify, and newer as deployed systems — threshold ECDSA signing only became commercially practical and widely deployed in the last several years. Some qualified custodians and insurers still price MPC-secured assets differently than multisig- or cold-storage-secured assets, purely because the underwriting history is thinner.

Cryptographic Maturity and Vendor Lock-In

Multisig’s security rests on the blockchain’s own consensus and signature-verification rules, which are public, standardized, and shared across every wallet that uses them. MPC’s security rests on the specific threshold-signature protocol a vendor chose to implement — commonly a variant of GG18, GG20, CMP, or newer lattice- and FROST-based constructions — and on how carefully that vendor implemented it. In 2023, independent researchers disclosed a class of vulnerabilities in several production threshold-ECDSA implementations that allowed a malicious co-signer, under specific conditions, to extract enough information to reconstruct a full private key across several key-generation and refresh sessions. Multiple vendors patched their libraries after responsible disclosure. The episode is a useful reminder that MPC security is only as good as a specific vendor’s cryptographic engineering, not a property of the general technique.

Recovery Paths When a Device or Employee Disappears

Multisig recovery is procedural: if you lose one signer out of a 3-of-5 setup, the remaining four can still transact and can vote to rotate in a replacement. Losing more than (M minus threshold) signers, however, permanently locks the wallet, because the underlying math offers no backdoor. MPC recovery usually depends on the vendor’s backup-share architecture — some platforms let you recover from a threshold of your own shares without vendor involvement, others require the vendor’s cooperation, and a small number have failed customers precisely because the vendor itself became unreachable, went through an acquisition, or shut down. Ask any MPC vendor, in writing, exactly what happens to your key shares if their company disappears tomorrow — the answer belongs in your written custody policy, not in a sales call.

Multisig vs Threshold MPC vs Aggregated Signatures: The Full Comparison

A third option belongs in this comparison too: aggregated signature schemes such as MuSig2 (Bitcoin, via Taproot Schnorr signatures) and FROST. These let multiple independent keyholders jointly produce one Schnorr signature that looks, on-chain, exactly like a single signer — combining multisig’s “each party keeps their own independent key” simplicity with MPC’s “one clean on-chain signature” efficiency. They are newer in production and currently limited mostly to Schnorr-supporting chains, but they are worth tracking for any Bitcoin-heavy treasury policy.

Worked Example: Structuring Custody for a $40 Million Treasury Desk

Consider a mid-sized crypto-native company holding $40 million across BTC, ETH, and a stablecoin operating balance, and consider how a tiered policy actually plays out in numbers rather than abstractions.

The finance team splits the treasury into three tiers. Tier one is the operating tier: roughly $1.5 million in stablecoins, moved out in amounts under $50,000 several times a day to cover vendor payments, contractor payroll, and exchange rebalancing. Tier two is the working reserve: about $8.5 million, moved in transfers between $50,000 and $2 million perhaps twice a week. Tier three is the deep reserve: the remaining $30 million, moved only a handful of times a year, usually to rebalance into a new custodian or fund a large strategic purchase.

For tier one, a 2-of-3 threshold MPC setup through an institutional custody platform makes sense: two of three designated finance staff must approve via mobile app, transfers under the $50,000 policy limit clear in minutes, and the wallet address stays constant even as the company rotates approvers during hiring changes. The gas overhead is negligible because MPC signatures don’t add on-chain verification cost.

For tier two, the team steps up to 3-of-5 MPC with a mandatory 15-minute delay and an automatic policy-engine rule that anything over $2 million routes to tier three approval instead, regardless of who tries to sign it. This tier still benefits from MPC’s low fees, but the higher threshold and built-in delay buy time to catch a compromised laptop or a social-engineering attempt before funds actually move.

For tier three, the team deliberately moves away from MPC and into an on-chain 4-of-7 multisig, with signers split across three physical locations and a mandatory 48-hour on-chain timelock module before any transaction can execute, even after collecting four valid signatures. The higher gas cost is irrelevant at this transfer size, and the benefit — an owner list and threshold that anyone, including an outside auditor or insurer, can verify directly on a block explorer without trusting any vendor’s internal claims — is worth far more than the fee savings MPC would offer. The 48-hour delay also gives the team a real window to notice and cancel a transaction if four signers somehow get tricked into approving something that shouldn’t clear, which is exactly the failure mode the next section covers in detail.

Common Mistakes Teams Make When Choosing a Wallet Architecture

Treating “Blind Signing” as Someone Else’s Problem

In February 2025, attackers linked to North Korea’s Lazarus Group executed the largest crypto theft on record, draining roughly $1.5 billion in ether from a Safe multisig cold wallet used by a major exchange. The attackers did not break the multisig math at all. They compromised a developer’s machine connected to the Safe front-end infrastructure and altered what the transaction actually did while displaying something innocuous to the signers, who approved it on their hardware wallets without independently verifying the raw transaction data. Every one of the required signatures was legitimately produced by an authorized signer — the multisig threshold worked exactly as designed. The lesson generalizes to MPC as well: a threshold scheme, aggregated signature, or multisig contract only protects you from what happens after signers see accurate information. If your approval process lets people sign whatever a web interface shows them without decoding the actual call data, the number of required signers is decorative.

Picking MPC for Chain Coverage It Doesn’t Actually Have

Vendors market broad chain support, but “supported” can mean anything from “production-grade signing with dedicated infrastructure” to “technically possible if you file a support ticket.” Teams sometimes commit to an MPC provider assuming day-one coverage for a newer chain their roadmap depends on, only to discover that coverage arrives months later, or requires a separate contract addendum and additional integration work.

Underestimating the Operational Cost of Multisig Key Rotation

A 4-of-7 multisig sounds resilient until you calculate how often, realistically, someone on a seven-person signer list changes roles, loses a device, or leaves the company. Each rotation is an on-chain transaction requiring the outgoing signer’s cooperation (or a workaround if they’re unavailable), gas costs, and a fresh coordination effort among the remaining signers. Teams that pick a large signer count for optics end up quietly avoiding rotations they should be doing, which is its own security problem.

Assuming MPC Removes the Need for Geographic Key Distribution

Because MPC key shares never combine, some teams assume location no longer matters and let all shares sit on infrastructure inside a single cloud region, sometimes even a single vendor’s data center. If that vendor has an outage, gets served with a legal order, or suffers a breach that affects all shares simultaneously, the “shares never combine” property offers little practical protection. Geographic and provider diversity matters for MPC key shares for exactly the same operational-resilience reasons it matters for multisig hardware devices.

Practical Checklist Before You Commit

• Write down your actual threat model in plain language before comparing any vendor’s marketing page.
• Map your expected transfer frequency and typical dollar size against a tiered policy rather than one flat threshold.
• Confirm, in writing, exactly what happens to MPC key shares if the vendor is acquired, sanctioned, or shut down.
• Require every signer to decode and verify raw transaction data — not just a UI summary — before approving anything above your operating tier.
• Test your recovery process at least once a year, including a scenario where one signer or key-share holder is genuinely unreachable.
• Diversify multisig hardware and MPC key-share infrastructure across separate locations, devices, and where possible, separate cloud providers.
• Ask any qualified custodian or insurer how they price MPC-secured assets differently from multisig-secured assets before assuming coverage is equivalent.
• Revisit chain-coverage claims from MPC vendors against their actual production SLAs, not their roadmap slide.

Key Takeaways

• Multisig splits signing authority across independent keys and enforces the threshold on-chain, which makes it transparent and auditable but chain-specific and comparatively costly to rotate.
• Threshold MPC splits the key material itself and produces one clean off-chain signature, which is cheaper, faster, and portable across many chains, but rests on a vendor’s proprietary cryptographic implementation.
• Aggregated signature schemes like MuSig2 and FROST blend properties of both and deserve a place on the roadmap for Bitcoin-heavy treasuries, even though production use is still early.
• A tiered policy — MPC for operational transfers, multisig for deep reserves — consistently outperforms a single-architecture decision for treasuries above roughly $500,000.
• The most damaging real-world failures, including the 2025 Safe wallet incident, have exploited what signers were shown, not the underlying signature math — verification discipline matters as much as the architecture you choose.

Frequently Asked Questions

Is MPC more secure than multisig?

Neither is universally more secure; they distribute risk differently. Multisig’s security is enforced by public, auditable blockchain rules, while MPC’s security depends on a specific vendor’s proprietary implementation of a threshold-signature protocol. MPC tends to offer better operational resilience and lower cost, while multisig tends to offer better independent verifiability. The 2023 disclosure of vulnerabilities in several production threshold-ECDSA libraries showed that MPC’s youth as a deployed technology carries its own risk profile, separate from the underlying cryptography being unsound.

Can you convert an existing multisig wallet to MPC without moving funds?

Not directly. A multisig wallet’s funds live at a smart-contract or script address controlled by that contract’s owner list, while an MPC wallet’s funds live at an address derived from a jointly generated key. Switching architectures means generating a new address under the new model and moving funds on-chain to it, which is itself a transaction that should go through your existing approval process.

Does MPC work with Bitcoin the same way it works with Ethereum?

The underlying threshold-ECDSA math works for Bitcoin’s ECDSA-based addresses, and threshold Schnorr schemes work with Bitcoin’s Taproot addresses, but Bitcoin’s simpler scripting model means native multisig and, increasingly, MuSig2 aggregated signatures are more commonly used there than commercial MPC platforms, which see heavier adoption on Ethereum and other smart-contract chains.

How many signers should a corporate treasury require for large transfers?

There is no universal number, but a common institutional pattern for deep reserves is a threshold requiring a clear majority of a seven- or nine-person signer group, spread across at least three physical locations, with no single location holding enough signers to reach the threshold alone. Smaller operational tiers typically use lower thresholds, such as 2-of-3 or 3-of-5, in exchange for faster clearing.

What happens if an MPC vendor goes out of business?

It depends entirely on how that specific vendor architected key-share backup and export. Reputable providers let clients hold or independently back up enough shares to reconstruct signing authority without the vendor’s ongoing cooperation. Weaker implementations require the vendor’s active participation to sign or recover, which becomes a serious problem if the vendor is unreachable. This should be confirmed in writing before onboarding, not assumed.

Is Safe (formerly Gnosis Safe) multisig or MPC?

Safe is an on-chain multisig smart-contract wallet, not MPC. It stores a public list of owner addresses and a signature threshold directly in a deployed contract on Ethereum and other EVM-compatible chains, and every required signature is submitted and verified on-chain.

References

• Chainalysis and multiple industry incident trackers, reporting on the February 2025 Bybit-linked Safe wallet exploit and its attribution to Lazarus Group.
• Verichains research disclosure on threshold-ECDSA implementation vulnerabilities affecting multiple production MPC libraries, 2023.
• Public documentation for Safe (Gnosis Safe) smart-contract wallet architecture and owner/threshold model.
• Academic literature on threshold ECDSA protocols (GG18, GG20, CMP) and on Schnorr-based aggregated signature schemes (MuSig2, FROST).
• For a broader look at how institutions structure digital-asset holdings at the balance-sheet level, see Finance Fundamentals’ guide to Bitcoin in the corporate treasury.