MPC vs MultiSig: an honest comparison

Ask ten security engineers to settle the MPC vs multisig question and you will hear a familiar split: custody-technology vendors favor MPC, Bitcoin veterans favor multisig, and both camps talk past each other. The comparison deserves better, because the two approaches solve the same problem — no single person, device, or server should be able to move funds alone — in fundamentally different places. MPC (multi-party computation) splits the key itself, using off-chain cryptography. Multisig splits the authority, using rules the blockchain itself enforces.

That one design choice drives nearly every practical difference: what you pay in fees, what outsiders can verify, what happens when a vendor disappears, and who can be held accountable after a bad signature. Neither approach is a strict upgrade over the other. As of this writing in April 2024, both secure tens of billions of dollars, and both have produced expensive failures. Here is the honest version of the comparison.

Two ways to split the power to spend

An MPC wallet is usually built on a threshold signature scheme (TSS). It splits one private key into mathematical shares held by different parties or devices; to sign, the shareholders run an interactive protocol and jointly compute a single, ordinary signature. The full private key never exists in any one place at any moment — not even when the wallet is created. The blockchain sees a normal address and a normal signature, and has no idea a quorum was involved.

Multisig takes the opposite route. Each participant holds a complete, independent key, and the spending rule — say, 2-of-3 — is encoded where the network can see and enforce it: in Bitcoin script, which has supported multisig natively since 2012, or in a smart contract on chains like Ethereum. A 2-of-3 multisig will not release funds unless two of the three registered keys each produce their own valid signature. The quorum is not a promise made by software you run; it is a rule the chain's consensus enforces.

Both models are sold under the same word — "wallet" — which hides how different the trust assumptions are. In one, the guarantee comes from an implementation of advanced cryptography that outsiders cannot inspect; in the other, from consensus rules that everyone can.

MPC moves the quorum into cryptography and asks you to trust an implementation. Multisig writes the quorum into the chain and lets anyone verify it.

The case for MPC

MPC's advantages are real, and they explain why much of institutional custody runs on it.

• Chain coverage comes almost free. One threshold-ECDSA implementation covers, in principle, every chain that accepts ECDSA signatures. There is no per-chain contract to write, audit, and deploy — a real cost for multisig products, which must reimplement their model on every network they support.
• The address looks normal. An MPC wallet pays single-signature fees and reveals nothing about its policy on-chain. Before taproot activated in 2021, Bitcoin multisig spends were visibly larger and more expensive than single-signature spends; MPC never had that problem.
• Shares can be rotated. Proactive refresh lets holders re-randomize their shares without moving funds or changing the deposit address, so an attacker must compromise a quorum of shares within one rotation window rather than over years.
• No smart-contract risk. Nothing is deployed on-chain, so there is no contract code to exploit. The 2017 Parity incident — a bug in a shared multisig library that froze hundreds of millions of dollars of ETH — is the cautionary tale every MPC vendor cites, and it is a fair one.

Where MPC breaks

The weaknesses are just as structural, and they are less advertised.

The cryptography is genuinely hard. Threshold ECDSA is an interactive, multi-round protocol with sharp edges, and mistakes have reached production. In 2023, security researchers disclosed practical key-extraction attacks against several widely deployed threshold-signing implementations — flaws in the code, not the underlying math, but users of the affected wallets were exposed all the same. A multisig user's core assumption is "the chain verifies signatures correctly." An MPC user's core assumption is "my vendor implemented a subtle cryptographic protocol correctly." Those are not the same size of assumption.

Nobody outside can verify the quorum. An MPC address looks like any other address, which means the threshold in the marketing material cannot be checked on-chain. The Multichain incident of July 2023 made this concrete: roughly $125 million moved out of the project's addresses, and subsequent statements from the team indicated that the servers holding its key material had been under the effective control of a single person all along. Whatever the architecture diagram promised, the operational reality was one point of failure — and no outsider could have detected that from the chain.

Recovery usually runs through the vendor. Most production MPC systems are vendor-specific: shares live in proprietary formats, signing needs the vendor's coordination service, and recovery depends on the vendor's tooling continuing to exist. Some providers offer offline export; many do not. If vendor-free recovery matters to you, ask for a demonstration before funding the wallet, not after.

Accountability is thinner. The output of an MPC signing ceremony is one aggregate signature. The chain cannot show which participants approved a transaction; whatever attribution exists lives in the vendor's logs, which the vendor controls.

The case for multisig — and its honest costs

In the MPC vs multisig comparison, on-chain multisig inverts nearly all of these properties. The policy is public and enforced by consensus, so an auditor, a co-founder, or a court can confirm the quorum without trusting anyone's dashboard. Every approval is a distinct signature from a distinct key, so after an incident you know exactly which keys signed. And because the keys are ordinary keys — in Ownbit's MultiSig, every participant is a standard BIP39 seed phrase — recovery does not depend on any company's continued existence. Bitcoin multisig has secured funds this way for over a decade.

The costs are equally concrete. More signatures mean bigger transactions and higher fees, although taproot has narrowed that gap on Bitcoin. The policy that auditors love is also visible to adversaries: a 2-of-3 wallet advertises what it is. Multisig must be implemented per chain — Bitcoin script, EVM contracts, TRON's native scheme, Solana programs — and quality varies across implementations. And on smart-contract chains the contract itself is attack surface, which is why multisig contract code should be open source and independently auditable; Ownbit publishes its multisig contracts for exactly that reason.

MPC vs multisig: how to choose

Choose MPC when the workflow is the product: a trading desk pushing hundreds of automated signings a day across dozens of chains, with an operations team, a vendor contract, and an SLA. In that setting, chain-agnostic signing and share rotation genuinely earn their complexity, and the vendor dependence is a negotiated business relationship rather than an accident. The same logic covers exchanges and payment processors, where signing volume makes per-transaction human review impractical in any model.

Choose multisig when the policy has to be verifiable by people who do not fully trust each other — co-founders, business partners, family members — or has to outlive every company involved. If two partners want proof, not assurance, that neither can move treasury funds alone, an on-chain 2-of-3 provides it — and either of them can confirm the arrangement with a block explorer, years later, without asking anyone's permission. For organizations that need structure on top of the quorum, Enterprise MultiSig adds owner and signer roles, signer weights, spending limits, and address whitelists.

Two more points keep the choice honest. First, the approaches compose: one signer inside an on-chain multisig can itself be an MPC setup, and some teams run exactly that hybrid. Second, both approaches cure the same underlying disease — a single seed phrase as a single point of failure — but they replace it with different things: multisig with several standard seed phrases you can back up however you like, MPC with vendor-formatted shares you back up on the vendor's terms.

The honest summary of MPC vs multisig, then: MPC buys operational flexibility and privacy and pays in verifiability and vendor dependence; multisig buys verifiability and independence and pays in fees, privacy, and per-chain engineering. Decide which currency you would rather pay in — funds are only truly yours if the failure modes are ones you understand.

Frequently asked questions