MPC vs multisig: differences, risks and a hybrid setup

MPC splits one private key into shares that sign together offchain, while a multisig is a smart contract that checks several independent signatures onchain, and institutional vaults tend to use both, with the multisig holding ownership and MPC running day-to-day operations.

The difference between MPC and multisig is where the approval rule lives. An MPC (multi-party computation) wallet splits a single private key into shares held by separate parties, who run a threshold signature protocol to produce one ordinary signature, so the blockchain sees a normal single-key transaction. A multisig, such as a Safe on Ethereum, is a smart contract holding a list of independent owner keys and a threshold, and it executes a transaction only after the contract has verified enough of their signatures onchain. MPC keeps the quorum private and works on almost any chain; multisig makes the quorum public and auditable.

Both remove the risk of one stolen key draining a wallet, and they fail in different ways. Production systems often combine them: the multisig governs what can change, and MPC keys carry out routine work inside those rules.

How does an MPC wallet work?

An MPC wallet generates its key in pieces. During distributed key generation, each party creates a share, and the full private key is never assembled on any single device. To sign, a threshold of share holders, say two of three, run a cryptographic protocol that combines their contributions into one valid ECDSA or EdDSA signature. The best-known protocols are GG18 and GG20, and Fireblocks' MPC-CMP, which it open-sourced after introducing it in 2020 and which signs in a single round against nine for GG18.

Because the output is a normal signature, MPC works on chains that have no smart contract support and costs the same gas as a single-key transfer. Shares can be refreshed and signers swapped offchain without moving funds or changing the address. Policy (who may approve what, and up to which amount) sits in the provider's software beside the signing process, outside the blockchain.

How does a multisig wallet work?

A multisig is an account whose rules are code. On Ethereum and other EVM chains the standard is Safe, a smart contract with a set of owner addresses and a threshold between one and the number of owners, per Safe's documentation. Each owner signs with its own complete key, and the contract refuses to execute until the threshold is met. Safe says it secures over $60 billion across 25+ networks.

Owners and the threshold can be changed without moving to a new address. Safe exposes changeThreshold and owner add, remove and swap functions, though each change has to pass as a Safe transaction approved by the current quorum. Bitcoin has its own native multisig in script, which does require a new address when the signer set changes.

MPC vs multisig side by side

What are the risks of multisig wallets?

Two of the largest multisig losses on record came from signers approving a transaction that wasn't what their screen showed, with the contract itself working as designed. On 21 February 2025 about $1.5 billion was taken from a Bybit cold wallet held in a Safe, which the FBI attributed to North Korean hackers. Forensic work found that a compromised Safe{Wallet} developer machine let attackers inject code into the web interface Bybit's signers used, and the disguised transaction handed control of the wallet to the attacker. External reviewers found no vulnerability in the Safe contracts.

WazirX lost more than $230 million on 18 July 2024 in a similar way. Its multisig needed three of five exchange signers plus one from a third-party custody provider, and its preliminary report describes a mismatch between what the signing interface displayed and what was actually signed. In both cases the quorum was satisfied by real signers, which is why transaction simulation, independent verification of calldata and hardware-wallet confirmation matter as much as the threshold. The other recurring risks are lost keys with no recovery path, and signers who aren't independent, such as three keys held by one team on similar laptops.

What are the risks of MPC wallets?

MPC concentrates risk in the cryptographic implementation and in the provider running it. In August 2023 Fireblocks researchers disclosed BitForge, a set of flaws in common implementations of GG18, GG20 and Lindell17 that could let an attacker extract a full private key; vendors including Coinbase WaaS and Zengo patched them under a 90-day disclosure process. These bugs are hard for a client to detect, because the protocol runs inside the vendor's software.

MPC is also opaque from the outside. An auditor looking at the chain sees one address and one signature, with no way to confirm how many parties approved or whether the policy was followed. That evidence has to come from the provider's logs and attestations. An outage or compromise at the provider can pause signing too, which is why institutions keep a recovery process for the key shares.

What is the advantage of MPC?

MPC's advantages are operational. One signing setup covers dozens of chains, including ones without smart contracts, transactions cost the same as a normal transfer, and signers can be rotated without an onchain change. Those properties suit automated, high-frequency work such as rebalancing, fee collection and settlement, where a human multisig quorum on every transaction would be slow and expensive.

What is the difference between MPC and HSM?

A hardware security module (HSM) is a tamper-resistant device that stores a whole private key and signs inside the hardware, so the key never leaves it. MPC removes the whole key instead, splitting it across parties so no device holds it. The two can work together: some providers keep each MPC share inside a secure enclave or HSM, so every share gets hardware protection and the key is still never complete.

MPC, multisig or smart wallets?

A smart wallet (smart account) is any wallet whose rules are set by a contract, and a multisig is one rule a smart account can enforce. The layers combine: an MPC key can be one of the owners on a Safe, and a Safe can add modules such as spending limits or time delays. The practical choice is which layer holds which power.

How can a multisig quorum be audited onchain?

A Safe's configuration is public state. Anyone can call getOwners and getThreshold on the contract, or read them on a block explorer, and every executed transaction leaves an event and the signatures that approved it. For a vault owned by a Safe, the check runs in two steps: read the vault's owner address (on a proxy contract, the explorer's "Read as Proxy" tab), then read that Safe's owners and threshold. This check can't be run against an MPC key, whose approval rules live with the provider.

How Upshift combines multisig and MPC in one vault

Upshift vaults split authority between the two models by function. The vault owner is a Gnosis Safe multisig, which Upshift's documentation describes as shared between Upshift, the curator and the partner, and operator keys run in MPC for routine operations. For any vault, the owner address and that Safe's threshold can be read onchain.

The operator's limits come from the contract and the policy engine, which restricts activity by chain, protocol, token and function, and Upshift's admin portal simulates each transaction before a second person approves it (maker-checker). Changes to parameters such as the management fee can sit behind a timelock whose length is set per vault, and pausing is an owner function. Upshift's contracts have been through 10 smart contract audits by 6 independent firms.

The split plays to each model's strength: parameters that change a depositor's economics need a visible, multi-party quorum, while fee accrual and NAV updates run many times across 30+ chains and suit MPC. Always make sure to do your own research and be aware of the above and any other risks before depositing.

Frequently asked questions

Is MPC safer than multisig?

Neither is safer in every case. MPC removes the full key and works across chains, while multisig enforces the rule onchain where anyone can verify it. The largest recent losses on both came from deceived signers and implementation flaws, so the surrounding controls decide most outcomes.

Is a Gnosis Safe an MPC wallet?

No. Safe (formerly Gnosis Safe) is a smart contract multisig: each owner signs with its own key and the contract checks the threshold onchain. An MPC wallet can be one of its owners.

Can a multisig threshold be changed?

On Safe, yes. The owners can change the threshold or add, remove and swap owners through a Safe transaction approved by the current quorum, and the wallet address stays the same.

Which is cheaper, MPC or multisig?

MPC is cheaper onchain, because it submits one ordinary signature. A multisig pays extra gas for the contract to verify several signatures, a cost that adds up for frequent automated transactions.

What is a threshold signature scheme?

A protocol that lets a set number of key-share holders, such as two of three, jointly produce one valid signature without reconstructing the private key. It is the cryptography behind MPC wallets.

Can MPC and multisig be used together?

Yes, and institutional set-ups often do. Upshift vaults use a Safe multisig as owner and Fireblocks or Fordefi MPC keys for operator roles.

Keep reading

• How onchain yield vaults are secured. The five security layers and the threats each covers.
• Who does what in an onchain vault. The owner, operator and curator roles end to end.
• How to launch a vault. Who holds which keys, timelines and costs.