Multisig vs MPC Wallets: Shared Custody Architectures Compared

Multisig vs MPC Wallets Overview

Multisig and MPC are the two dominant architectures for shared crypto custody. Both eliminate the single-key failure point that makes individual wallets vulnerable, but they do so through fundamentally different mechanisms. Choosing the right approach depends on your chain requirements, transaction volume, operational team, and how much you value on-chain transparency versus off-chain flexibility.

A multisig wallet requires multiple independent private keys to authorize a transaction. Each key is a complete signing key, and the spending policy (for example, 2-of-3) is enforced directly by the blockchain. An MPC wallet splits a single private key into shares distributed across multiple parties. These shares are never assembled: instead, each party uses its share in a multi-party computation protocol to jointly produce a standard single signature, with the actual key never existing in one place.

Security Models

Both architectures protect against the compromise of a single key or device. The difference lies in where the security guarantees are enforced and what an attacker must compromise to steal funds.

In a 2-of-3 multisig, each of the three keys is a fully valid signing key stored on a separate device or by a separate party. An attacker must compromise two of the three independent key holders. The threshold policy is written into the Bitcoin script itself: the blockchain will not accept a transaction with fewer than the required signatures, regardless of any off-chain system failure.

In an MPC wallet, no single share can sign a transaction. Shares are created during a distributed key generation ceremony and must be combined through the MPC protocol to produce a valid signature. The security guarantee comes from the cryptographic protocol, not from on-chain rules. This means the MPC provider's coordination infrastructure becomes part of the trust model: if the signing service is compromised, the policy enforcement layer is compromised with it.

Key distinction: Multisig trust is enforced by the blockchain consensus layer. MPC trust is enforced by the cryptographic protocol and the infrastructure running it.

On-Chain Footprint and Fees

Multisig transactions are larger because they include multiple signatures and a script revealing the spending policy. This directly increases fees, since Bitcoin miners charge per virtual byte (vB).

A standard P2WSH 2-of-3 multisig input weighs roughly 104 vB, compared to about 68 vB for a single-sig P2WPKH input. Legacy P2SH multisig is even more expensive at roughly 296 vB per input. For higher thresholds like 3-of-5, inputs can exceed 170 vB. At a fee rate of 20 sat/vB, a 2-of-3 P2WSH input costs about 2,080 sats versus 1,360 sats for single-sig: roughly 53% more per input.

MPC wallets produce a standard single signature regardless of how many parties participated. The on-chain transaction is identical to a single-key spend, so fees match the minimum for that address type. For high-volume operations processing thousands of transactions per day, this fee difference compounds significantly.

For detailed fee calculations by script type, see the Bitcoin multisig setup comparison.

Chain Support

Multisig is a native feature of Bitcoin's scripting language via OP_CHECKMULTISIG (legacy) and OP_CHECKSIGADD (Tapscript). Ethereum supports multisig through smart contracts like Safe (formerly Gnosis Safe). Other chains have varying levels of native or contract-based multisig support, and each implementation differs in its capabilities and limitations.

MPC wallets operate at the cryptographic layer, below the blockchain. Because the output is a standard ECDSA or EdDSA signature, MPC works on any chain that accepts those signature schemes. This makes MPC the default choice for institutions managing assets across dozens of blockchains from a single platform. Fireblocks and Fordefi both advertise support for 80+ and 90+ chains, respectively.

Key Rotation and Recovery

Key rotation is one of the sharpest operational differences between the two models.

In a multisig wallet, replacing a compromised or lost key means creating a new wallet with an updated set of keys and migrating all funds to the new address. This incurs on-chain transaction fees and requires coordination among all key holders. For a treasury with thousands of UTXOs, this migration can be expensive and time-consuming.

MPC wallets support key rotation through a process called resharing. The shares are regenerated so that old shares become cryptographically invalid, but the underlying public key and wallet address remain unchanged. No on-chain transaction is required. This is particularly valuable for institutions that need to rotate keys on a regular schedule or when personnel changes occur.

Recovery also differs. Multisig recovery involves locating the threshold number of keys: if you have 2-of-3, you need any two of the three keys. Each key can be backed up independently using standard seed phrases. MPC recovery depends on the provider's backup mechanism, which varies: some use encrypted cloud backups, others require hardware-based recovery ceremonies.

Multisig Implementations

The multisig ecosystem on Bitcoin is mature, with both managed services and self-sovereign tools.

Casa

Casa offers a 2-of-3 vault on its Standard plan ($250/year) and a 3-of-5 vault on its Premium plan ($2,100/year). The client holds the majority of keys across separate hardware devices, while Casa holds one recovery key that cannot spend funds unilaterally. Inheritance is built in: a designated recipient can initiate a transfer request that triggers a six-month waiting period, with no death certificate required.

Unchained

Unchained provides 2-of-3 collaborative custody where the client holds two keys and Unchained holds one. Beyond custody, Unchained offers Bitcoin-backed loans, IRA accounts, and trading services. Its Inheritance Boot Camp ($4,000 first year) includes advisory meetings, estate gap analysis, and trust vault setup.

Sparrow Wallet

Sparrow is a free, open-source desktop wallet that supports both single-sig and multisig configurations across legacy, SegWit, and Taproot address types. It works with hardware wallets over USB or in air-gapped mode via PSBTs. Version 2.1.0 (February 2025) added PSBTv2 support per BIP 370. Sparrow provides full control without vendor lock-in but requires more technical knowledge to set up and maintain.

MPC Implementations

MPC wallets are primarily offered by institutional custody providers, though consumer-facing options exist.

Fireblocks

Fireblocks is the largest institutional MPC platform. It distributes key shares across a quorum of at least three endpoints, each of which independently validates transactions against the organization's policy rules before contributing its share. Wallets can be configured as hot (API co-signer), warm (internet-connected mobile device), or cold (air-gapped device with QR-code approvals).

ZenGo

ZenGo targets retail users with a "keyless" wallet that splits the key into two shares: one on the user's device and one on ZenGo's servers. There is no seed phrase. Authentication uses biometric 3FA, and the wallet includes a Web3 firewall (ClearSign) that simulates transactions before signing. ZenGo supports Bitcoin, Ethereum, and Solana, among other assets.

Fordefi

Fordefi is an institutional MPC wallet built for DeFi operations across 90+ blockchains, including Bitcoin, Ethereum, Solana, Sui, and Cosmos. It provides transaction simulation, smart contract insights, and a policy engine for approval rules. Fordefi holds SOC 2 Type 2 certification and undergoes annual cryptographic audits. Paxos acquired Fordefi in late 2025.

For a deeper comparison of MPC providers, see the MPC wallet comparison tool.

Implementation Comparison

FROST: A Middle Ground

FROST (Flexible Round-Optimized Schnorr Threshold signatures) is a threshold signature protocol that combines properties of both multisig and MPC. Like multisig, it distributes trust across multiple independent signers with a t-of-n threshold. Like MPC, it produces a single standard signature that is indistinguishable from a single-key spend on-chain.

FROST was formalized as RFC 9591 in June 2024. Its signing protocol requires only two communication rounds, making it significantly faster than older threshold ECDSA schemes that typically need four to eight rounds. The output is a standard 64-byte BIP-340 Schnorr signature, which means FROST transactions pay the same fees as single-sig Taproot spends and reveal nothing about the number of signers or the threshold to on-chain observers.

Key shares in FROST are generated through a distributed key generation ceremony or via a trusted dealer. Research into Dynamic-FROST (D-FROST) proposes combining FROST with proactive secret sharing to enable key rotation without changing the wallet address, bridging the last major operational gap between FROST and traditional MPC.

Spark uses FROST for its signing protocol, enabling threshold custody for Bitcoin and stablecoins like USDB with single-sig on-chain efficiency. Bitcoin-level standardization is progressing through BIP-445, which was assigned in January 2026.

When to Choose Each Architecture

The right choice depends on your specific requirements across several dimensions.

• Bitcoin-only custody with maximum transparency: multisig gives you on-chain policy enforcement and no dependence on third-party infrastructure.
• Multi-chain institutional operations: MPC is the practical choice when you need unified key management across 50+ blockchains with consistent policy controls.
• High transaction volume: MPC's single-sig footprint saves meaningful fees at scale compared to legacy multisig.
• Frequent personnel changes: MPC resharing avoids costly fund migrations when team members join or leave.
• Regulatory audit requirements: multisig's on-chain transparency can simplify compliance by providing a verifiable record of every approval.
• Privacy-sensitive operations: MPC and FROST both hide the signing structure from on-chain observers.

For further reading on the cryptographic foundations, see our research on MPC vs multisig custody and FROST threshold signatures.

Frequently Asked Questions

Is MPC more secure than multisig?

Neither is inherently more secure: the security depends on the implementation and threat model. Multisig enforces its spending policy on-chain, so even a compromised coordination layer cannot bypass the threshold requirement. MPC eliminates the single point of failure at the key level, but its policy enforcement relies on the provider's infrastructure. For Bitcoin-only self-custody, multisig has a longer track record. For multi-chain institutional operations, MPC's flexibility can reduce operational risk.

Can you use multisig on Ethereum?

Yes, but Ethereum does not have native multisig at the protocol level the way Bitcoin does. Ethereum multisig is implemented through smart contracts like Safe (formerly Gnosis Safe), which holds over $100 billion in assets across multiple EVM chains. Smart contract multisig adds gas costs for contract interaction on top of the base transaction fee, and the contract itself becomes an additional attack surface that must be audited.

What happens if an MPC provider goes offline?

It depends on the provider's architecture and your backup strategy. If the provider holds one share in a 2-of-3 scheme and goes offline permanently, you need two remaining shares to recover. Most institutional MPC providers offer encrypted backup shares or disaster-recovery key ceremonies. With some consumer wallets like ZenGo, the provider's share is backed up to a decentralized network as a fallback. Always verify the provider's recovery guarantees before committing significant funds.

Are multisig transactions more expensive than MPC?

On Bitcoin, yes. A 2-of-3 P2WSH multisig input is roughly 53% larger than a single-sig P2WPKH input, and fees scale linearly with transaction weight. MPC produces a standard single signature, so transaction costs match single-sig rates. However, Taproot with MuSig2 can close this gap: when all signers cooperate, the aggregated key-path spend is the same size as a single-sig Taproot transaction.

How does FROST compare to traditional MPC wallets?

FROST is a specific threshold signing protocol based on Schnorr signatures, while "MPC wallet" typically refers to a platform using threshold ECDSA or a proprietary protocol. FROST signing requires only two rounds of communication versus four to eight for threshold ECDSA, making it faster. FROST also produces native BIP-340 Schnorr signatures compatible with Bitcoin's Taproot, whereas threshold ECDSA produces standard ECDSA signatures. Both achieve single-sig on-chain efficiency.

Can I convert a multisig wallet to an MPC wallet?

Not directly. Multisig and MPC use fundamentally different key structures. Converting requires creating a new MPC wallet, generating fresh key shares through a DKG ceremony, and migrating funds from the multisig address to the new MPC-controlled address via an on-chain transaction. There is no way to transform existing multisig keys into MPC shares without moving funds.

Which architecture do hardware wallets support?

Most hardware wallets (Coldcard, Trezor, Ledger, Foundation Passport, BitBox) support multisig natively through standard PSBT workflows. Hardware wallet support for MPC is limited because MPC requires interactive communication during signing, which conflicts with the air-gapped security model. Some MPC providers like Fireblocks support hardware-based cold signing with QR codes, but this is a proprietary workflow rather than a standard protocol.

This tool is for informational purposes only and does not constitute financial advice. Data is approximate and based on publicly available information as of late 2026. Always verify current pricing, features, and security models before making custody decisions.