MPC vs multisig: differences, risks and a hybrid setup

MPC splits one private key into shares that sign together offchain, while a multisig is a smart contract that checks several independent signatures onchain. Institutional vaults tend to use both, with the multisig holding ownership and MPC running day-to-day operations.

The difference between MPC and multisig is where the approval rule lives. An MPC (multi-party computation) wallet splits a single private key into shares held by separate parties. Those parties run a threshold signature protocol to produce one ordinary signature, and the blockchain sees a normal single-key transaction. A multisig, such as a Safe on Ethereum, is a smart contract holding a list of independent owner keys and a threshold, and it executes a transaction only after the contract itself has verified enough of those owners' signatures onchain. MPC keeps the quorum private and works on almost any chain. Multisig makes the quorum public and auditable.

Both remove the risk of one stolen key draining a wallet, and they fail in different ways. Production systems often combine them: the multisig governs what can change, and MPC keys carry out routine work inside those rules.

How does an MPC wallet work?

An MPC wallet generates its key in pieces. During distributed key generation each party creates a share, and the full private key is never assembled on any single device. Embedded wallet providers use MPC or secure enclaves, and wallet as a service providers compared shows which model each one uses. To sign, a threshold of share holders (say two of three) run a cryptographic protocol. It combines their contributions into one valid ECDSA or EdDSA signature. The best-known protocols are GG18, GG20 and Fireblocks' MPC-CMP. Fireblocks introduced MPC-CMP in 2020 and later open-sourced it, and it signs in a single round against nine for GG18.

Because the output is a normal signature, MPC works on chains with no smart contract support. It also costs the same gas as a single-key transfer. Shares can be refreshed and signers swapped offchain without moving funds or changing the address, while policy (who may approve what, and up to which amount) sits in the provider's software beside the signing process, outside the blockchain.

How does a multisig wallet work?

A multisig is an account whose rules are code. On Ethereum and other EVM chains the standard is Safe. Per Safe's documentation, it's a smart contract with a set of owner addresses and a threshold between one and the number of owners. Each owner signs with its own complete key, and the contract refuses to execute until the threshold is met. Safe says it secures over $60 billion across 25+ networks.

Owners and the threshold can change without moving to a new address. Safe exposes changeThreshold plus functions to add, remove and swap owners. Each change still has to pass as a Safe transaction approved by the current quorum. Bitcoin has its own native multisig in script, and that one does need a new address when the signer set changes.

MPC vs multisig side by side

What are the risks of multisig wallets?

Two of the largest multisig losses on record came from signers approving a transaction that wasn't what their screen showed. In both, the contract itself worked as designed. On 21 February 2025 about $1.5 billion was taken from a Bybit cold wallet held in a Safe, which the FBI attributed to North Korean hackers. Forensic work traced it to a compromised Safe{Wallet} developer machine. Attackers used it to inject code into the web interface Bybit's signers used, and the disguised transaction handed control of the wallet to the attacker. External reviewers found no vulnerability in the Safe contracts.

WazirX lost more than $230 million on 18 July 2024 in a similar way. Its multisig needed three of five exchange signers plus one from a third-party custody provider. Its preliminary report describes a mismatch between what the signing interface displayed and what was actually signed. In both cases real signers satisfied the quorum. Transaction simulation, independent checks of calldata and hardware-wallet confirmation carry as much weight as the threshold. The other recurring risks are lost keys with no recovery path, and signers who aren't independent (three keys held by one team on similar laptops, say).

What are the risks of MPC wallets?

MPC concentrates risk in the cryptographic implementation and in the provider running it. In August 2023 Fireblocks researchers disclosed BitForge, a set of flaws in common implementations of GG18, GG20 and Lindell17. The flaws could let an attacker extract a full private key. Vendors including Coinbase WaaS and Zengo patched them under a 90-day disclosure process, though bugs like these are hard for a client to spot in the first place, because the protocol runs inside the vendor's software where the client can't inspect it.

MPC is also opaque from the outside. An auditor looking at the chain sees one address and one signature. There's no way to confirm from the chain how many parties approved or whether the policy was followed, and that evidence has to come from the provider's logs and attestations. An outage or compromise at the provider can pause signing too. Institutions keep a recovery process for the key shares for that reason.

What is the advantage of MPC?

MPC's advantages are operational. One signing setup covers dozens of chains, including ones without smart contracts. Transactions cost the same as a normal transfer, and signers can be rotated without an onchain change. That suits automated, high-frequency work such as rebalancing, fee collection and settlement, where a human multisig quorum on every transaction would be slow and expensive.

What is the difference between MPC and HSM?

A hardware security module (HSM) is a tamper-resistant device that stores a whole private key and signs inside the hardware. MPC goes the other way and never forms the whole key, splitting it across parties instead. The two can work together. Some providers keep each MPC share inside a secure enclave or HSM. Every share gets hardware protection and the key is still never complete.

MPC, multisig or smart wallets?

A smart wallet (smart account) is any wallet whose rules are set by a contract, and a multisig is one rule a smart account can enforce. The layers combine. An MPC key can be one of the owners on a Safe, and a Safe can add modules such as spending limits or time delays. The practical choice is which layer holds which power.

How can a multisig quorum be audited onchain?

A Safe's configuration is public state. Anyone can call getOwners and getThreshold on the contract, or read them on a block explorer. Every executed transaction leaves an event and the signatures that approved it. For a vault owned by a Safe, the check takes two steps. First read the vault's owner address (on a proxy contract, the explorer's "Read as Proxy" tab), then read that Safe's owners and threshold. There's no equivalent check for an MPC key, whose approval rules live with the provider.

How Upshift combines multisig and MPC in one vault

Upshift vaults split authority between the two models by function. The vault owner is a Gnosis Safe multisig, which Upshift's documentation describes as shared between Upshift, the curator and the partner. Operator keys run in MPC for routine operations. For any vault, the owner address and that Safe's threshold can be read onchain.

The operator's limits come from the contract and the policy engine, which restricts activity by chain, protocol, token and function. Upshift's admin portal also simulates each transaction before a second person approves it (maker-checker). Changes to parameters such as the management fee can sit behind a timelock whose length is set per vault, and pausing is an owner function. Upshift's contracts have been through 11 smart contract audits by 6 independent firms.

Parameters that change a depositor's economics get a visible, multi-party quorum. Fee accrual and NAV updates run many times across 30+ chains, and MPC handles those. Always make sure to do your own research and be aware of the above and any other risks before depositing.

Frequently asked questions

Is MPC safer than multisig?

Neither is safer in every case. MPC removes the full key and works across chains, while multisig enforces the rule onchain where anyone can verify it. The largest recent losses on both came from deceived signers and implementation flaws, which is why simulation, calldata checks and key recovery carry so much weight.

Is a Gnosis Safe an MPC wallet?

No. Safe (formerly Gnosis Safe) is a smart contract multisig: each owner signs with its own key and the contract checks the threshold onchain. An MPC wallet can be one of its owners.

Can a multisig threshold be changed?

On Safe, yes. The owners can change the threshold or add, remove and swap owners through a Safe transaction approved by the current quorum, and the wallet address stays the same.

Which is cheaper, MPC or multisig?

MPC is cheaper onchain, because it submits one ordinary signature. A multisig pays extra gas for the contract to verify several signatures. That cost adds up for frequent automated transactions.

What is a threshold signature scheme?

A protocol that lets a set number of key-share holders, such as two of three, jointly produce one valid signature without reconstructing the private key. It is the cryptography behind MPC wallets.

Can MPC and multisig be used together?

Yes, and institutional set-ups often do. Upshift vaults use a Safe multisig as owner and Fireblocks or Fordefi MPC keys for operator roles.

Keep reading

• How onchain yield vaults are secured. The five security layers and the threats each covers.
• Who does what in an onchain vault. The owner, operator and curator roles end to end.
• How to launch a vault. Who holds which keys, timelines and costs.