MPC Wallet Comparison: Keyless Bitcoin Custody Solutions Ranked

MPC Wallet Providers Compared

Multi-party computation (MPC) wallets split a private key into multiple shares distributed across independent parties. No single party ever holds the complete key. Instead, a threshold number of shares run a cryptographic protocol together to produce a valid digital signature without reconstructing the key. On-chain, the resulting transaction looks identical to a standard single-signature spend.

The following table compares the leading MPC wallet providers across architecture, target audience, and security posture. Each provider is explored in detail below.

Key Shard Architecture

The core design choice for any MPC wallet is the threshold signature scheme: how many total key shares exist, how many are required to sign, and where each share is stored. This determines the security model, recovery options, and failure modes.

2-of-2 Schemes (Zengo, Coinbase)

Zengo and Coinbase both use the Lindell17 two-party ECDSA protocol. Two key shares are generated: one stored on the user's device, one held by the provider. Both shares must participate in signing, but the full private key is never assembled. Lindell17 requires just two rounds of communication and achieves efficiency through homomorphic encryption of one party's share.

The tradeoff: if either party is unavailable, signing is impossible. Both providers address this through dedicated recovery mechanisms (covered below). Zengo has secured over $20 billion in assets for 1.5 million+ users with zero wallet compromises since its 2019 launch.

2-of-3 Schemes (Binance, Copper)

Binance Web3 Wallet generates three key shards: one on the user's device, one held by Binance, and one encrypted with a user-set recovery password and stored in personal cloud storage (iCloud or Google Drive). Any two of the three shards can produce a valid signature. This provides redundancy: losing a single shard does not lock the user out.

Copper uses a similar 2-of-3 model for institutional clients. One shard is held by the client, one by Copper, and one by a nominated third party. One shard can be stored offline in an air-gapped device for cold storage, creating a split custody arrangement.

3-of-3 and Configurable Schemes (Fireblocks, Fordefi)

Fireblocks defaults to 3-of-3 signing using its proprietary MPC-CMP protocol. Three independent endpoints each validate transactions against organizational policy rules before contributing their key share. The protocol runs inside Intel SGX Trusted Execution Environments, adding hardware-level isolation. MPC-CMP reduces signing to a single round (compared to nine rounds in the earlier GG18 protocol), making it roughly 8x faster. Fireblocks has processed over $6 trillion in cumulative digital asset transfers for 1,800+ institutional clients.

Fordefi provides configurable MPC signing with hardware-isolated key management. Acquired by Paxos in November 2025, Fordefi serves nearly 300 institutions with over $3 billion in transaction volume.

Recovery Mechanisms

MPC wallets eliminate seed phrases, but losing access to key shares still requires a recovery path. The quality of that recovery mechanism is critical.

Zengo's recovery is notable: it uses a 3D FaceLock biometric scan combined with an encrypted recovery file in the user's personal cloud and email verification. No seed phrase is ever generated. Binance explicitly warns that forgetting the recovery password while losing device access results in permanent loss: Binance cannot restore access unilaterally.

MPC vs Multisig: Trade-offs

MPC and multisig both distribute signing authority across multiple parties, but they differ fundamentally in where enforcement happens. Understanding these trade-offs is essential when choosing a custody architecture. For a deeper analysis, see our research on Bitcoin MPC vs multisig custody.

The key distinction: multisig quorum requirements are enforced by the blockchain itself, making them publicly verifiable and impossible for the infrastructure provider to circumvent. MPC moves policy enforcement off-chain, which provides flexibility and privacy but requires trusting the MPC provider's infrastructure and audit trails.

For a practical guide to setting up Bitcoin multisig, see our multisig setup comparison tool.

FROST: Threshold Signatures on Bitcoin

FROST (Flexible Round-Optimized Schnorr Threshold signatures) represents a related but distinct approach to multi-party computation. Rather than adapting ECDSA for threshold signing (as GG18, GG20, and Lindell17 do), FROST leverages the linearity of Schnorr signatures to achieve M-of-N threshold signing natively.

FROST was standardized by the IETF as RFC 9591 in June 2024 and assigned BIP-445 (draft) in January 2026. It completes signing in two rounds (one with pre-processing), producing a standard 64-byte Schnorr signature under a 32-byte aggregate public key. On-chain, a FROST spend is indistinguishable from a regular Taproot key-path spend.

Spark uses FROST threshold signatures as part of its Bitcoin Layer 2 architecture. Rather than relying on proprietary MPC-TSS infrastructure, Spark's approach builds on standardized Schnorr-based threshold cryptography compatible with Bitcoin's Taproot upgrade. This provides the privacy and fee benefits of MPC (single-sig appearance on-chain) while building on a protocol with IETF standardization. For more on how FROST works, see our FROST threshold signatures explainer.

Security Track Record

No major MPC wallet provider has suffered a direct cryptographic compromise of its MPC protocol in production. However, implementation-level vulnerabilities have been found and patched through responsible disclosure.

In August 2023, Fireblocks researchers disclosed BitForge: a set of vulnerabilities affecting implementations of the GG-18, GG-20, and Lindell17 protocols. The GG-18/GG-20 flaw involved missing validation of the Paillier encryption modulus, allowing an attacker to extract key shards in 16-bit chunks across 16 signing attempts. The Lindell17 flaw (CVE-2023-33242) allowed full private key extraction after approximately 200 forced abort-and-retry signing attempts. Zengo, Coinbase, and Binance were among those affected and remediated within the 90-day disclosure window.

Separately, the TSSHOCK attacks presented at Black Hat USA 2023 demonstrated that a single malicious party could extract private keys in one to two signing ceremonies across multiple wallet implementations. These findings underscore that MPC-TSS protocols are mathematically sound, but correct implementation is non-trivial.

The July 2024 WazirX hack ($235 million, attributed to the Lazarus Group) is frequently discussed in MPC security contexts because Liminal Custody was the infrastructure provider. However, the attack exploited a discrepancy between transaction data displayed in the signing interface and actual on-chain data, not a cryptographic MPC failure. An independent Grant Thornton audit found no security flaws within Liminal's MPC systems.

Regulatory Treatment of MPC Key Shares

A central regulatory question for MPC wallets is whether holding a single key share constitutes "custody" of customer assets. There is no universal regulatory answer, but the practical position emerging across jurisdictions is straightforward: if an entity holds enough key shares to unilaterally move funds, that entity is a custodian.

In the US, the SEC's Division of Trading and Markets released guidance in May 2025 allowing broker-dealers to custody non-security crypto assets at permissible "control locations" under Exchange Act Rule 15c3-3(c). In September 2025, the Division of Investment Management issued a no-action letter permitting state-chartered trust companies to hold digital assets as a "bank" for custody purposes. The SEC and CFTC issued joint digital-asset guidance in March 2026 further clarifying custody frameworks.

For institutional MPC providers like Fireblocks and Copper, these developments are significant. Copper's US subsidiary registered as a broker-dealer with the SEC and became a FINRA member, establishing qualified custodian status. MPC custody is increasingly accepted because it provides documented key control, audit trails, and segregation of duties that regulators can evaluate.

How to Choose an MPC Wallet

The right MPC wallet depends on your use case, the assets you hold, and your operational requirements.

For individual users seeking a seedless, mobile-first Bitcoin wallet: Zengo offers the most mature consumer MPC experience with proven biometric recovery and a strong security track record.

For institutions requiring configurable policies, compliance documentation, and multi-chain support: Fireblocks is the market leader with SOC 2 Type II certification, 70+ chain support, and $6 trillion+ in cumulative transfers.

For developers building smart wallet infrastructure or wallet-as-a-service products: Coinbase WaaS provides an open-source MPC library (cb-mpc) with sub-200ms signing latency and documented APIs.

For exchange users wanting integrated self-custody: Binance Web3 Wallet's 2-of-3 scheme provides redundancy within the Binance app, though it is not available to US users.

For Bitcoin-native custody with threshold signing: evaluate FROST-based approaches, which build on Schnorr signature linearity and IETF standardization rather than adapted ECDSA protocols. Spark's implementation of FROST provides threshold security within Bitcoin's Taproot framework.

Frequently Asked Questions

What is an MPC wallet?

An MPC wallet uses multi-party computation to split a private key into multiple shares held by different parties. To sign a transaction, a threshold number of shares participate in a cryptographic protocol that produces a valid signature without ever reconstructing the full key. The result is a standard on-chain signature indistinguishable from a single-signer transaction.

Is an MPC wallet safer than a multisig wallet?

Neither is categorically safer. MPC provides privacy (signing structure hidden on-chain), lower fees, and chain-agnostic support. Multisig provides on-chain enforcement that is publicly verifiable and does not depend on a vendor's infrastructure. The 2023 BitForge disclosures showed that MPC implementations can contain subtle bugs, while multisig relies on battle-tested Bitcoin Script opcodes. Many institutions use both: MPC for operational wallets and multisig for cold storage.

Can I recover an MPC wallet without a seed phrase?

Yes. MPC wallets eliminate seed phrases by design. Recovery depends on the provider: Zengo uses a combination of email, cloud-stored encrypted backup, and 3D biometric verification. Binance requires the recovery password and cloud backup shard. Fireblocks uses configurable disaster recovery policies. The important caveat is that losing access to all recovery factors simultaneously (for example, forgetting a recovery password and losing device access with Binance) can result in permanent loss.

What is the difference between MPC and FROST?

Traditional MPC wallet protocols (GG18, GG20, Lindell17) adapt ECDSA for threshold signing, which requires complex techniques like Paillier encryption and zero-knowledge range proofs. FROST uses Schnorr signature linearity to achieve threshold signing more simply: polynomial interpolation and addition replace heavy cryptographic machinery. FROST is standardized (IETF RFC 9591), completes signing in fewer rounds, and produces signatures native to Bitcoin's Taproot. Both achieve the same goal of M-of-N signing without revealing the full key.

Do MPC wallets support Bitcoin?

All major MPC wallet providers support Bitcoin. Zengo, Fireblocks, Coinbase WaaS, Binance Web3 Wallet, and Copper all provide Bitcoin custody through their MPC infrastructure. The on-chain transaction produced by MPC signing is a standard ECDSA signature compatible with all Bitcoin address types. For Bitcoin-native threshold signing built on Schnorr and Taproot, FROST-based implementations like those used in Spark provide an alternative to ECDSA-based MPC.

Are MPC key shares considered custody by regulators?

There is no universal regulatory definition. The emerging practical standard is that an entity holding enough key shares to unilaterally sign transactions is considered a custodian. Holding a single share in a 2-of-3 scheme (where you cannot move funds alone) is generally not treated as custody. Copper has established qualified custodian status in the US through FINRA registration, and the SEC's 2025-2026 guidance has clarified permissible custody arrangements for digital assets.

Have MPC wallets ever been hacked?

No major MPC wallet provider has suffered a direct cryptographic compromise of its MPC protocol in production. The BitForge vulnerabilities disclosed in August 2023 were implementation flaws (not protocol breaks) found through responsible disclosure and patched by affected providers including Zengo, Coinbase, and Binance. The WazirX hack in July 2024 exploited a signing interface discrepancy, not an MPC cryptographic failure. The underlying threshold signature mathematics remain unbroken.

This tool is for informational purposes only and does not constitute financial advice. Data is approximate and based on publicly available information as of mid-2026. Provider features, security certifications, and regulatory statuses change frequently. Always verify current information directly with providers before making custody decisions.