An MPC wallet is a crypto wallet whose private key is split into shares held on different devices or by different parties, so that a set number of them must work together to sign a transaction and no single share can sign alone. MPC stands for secure multi-party computation, a branch of cryptography that lets several parties compute something together without revealing their private inputs to each other. MPC wallets use it for signing. MPC is also used for a second purpose in crypto, computing on private data, which is how COTI's network uses it.

Current as of October 20, 2026.

The Short Answer

What an MPC wallet is

  • One wallet whose key is split into shares
  • A threshold of shares, such as 2 of 3, signs together
  • No single share can sign by itself

How it differs from multisig

  • Multisig uses several separate keys and a rule on the blockchain
  • An MPC wallet produces one signature that can look like an ordinary single-key wallet's

What to weigh

  • It removes the single point of failure of one key
  • It relies on complex software, and often on a provider that holds a share

What MPC Means

The US National Institute of Standards and Technology (NIST) describes secure multi-party computation as a way to jointly compute a function over inputs held by several parties without each party revealing its input. The idea goes back to Andrew Yao's 1982 paper, Protocols for Secure Computations, and was generalised by Goldreich, Micali and Wigderson in 1987.

Wallets apply that idea to one specific job: producing a signature. NIST's threshold cryptography project says threshold schemes apply the principles of MPC to distribute trust in cryptographic operations such as signing.

How an MPC Wallet Works

The key is split into shares

Instead of one private key in one place, the key is split into shares, for example one on your phone, one on your laptop and one with a backup service.

Shares sign together

When you send a transaction, a threshold of shares runs a signing protocol together. Each share contributes, but the shares themselves aren't revealed to each other. The result is one signature. RFC 9591 (June 2024), the FROST specification published by the Internet Research Task Force's Crypto Forum Research Group, puts it this way: "FROST signatures can be issued after a threshold number of entities cooperate to compute a signature".

How the shares are created matters

The shares can be created in two ways. In a trusted-dealer setup, one party generates the full key and splits it, so the full key exists briefly at setup and the dealer must delete it, according to RFC 9591. In distributed key generation, the parties create their shares together, and dealerless threshold schemes such as the one in Gennaro and Goldfeder's 2018 paper are designed so that no single party ever holds the full key. That protocol, often called GG18, is one of the families later affected by the flaws described below.

Graphic titled Three ways to control a crypto wallet. Single-key wallet: one private key often backed up as a seed phrase, one ordinary signature on-chain, simple but whoever has the key or phrase has the funds. Multisig: several full keys with a set number required to sign, M of N, the rule lives in a script or contract and is checkable once used, transparent and auditable but built differently on each chain. MPC threshold wallet: one key split into shares with a threshold signing together, can look like one ordinary signature from a single key, no single share can sign but you rely on complex software and often on a provider. Banner: MPC also means private computation, where parties compute on secret inputs together, which is how COTI's network uses it with garbled circuits

MPC Wallet vs Multisig

Both remove the single point of failure of one key, but they work at different layers.

Multisig

  • Uses several separate, full keys. A set number of them must sign, often written as M of N.
  • On Bitcoin, BIP-11 (2011) made M-of-N transactions a standard type, with the public keys listed in the script.
  • On Ethereum, smart-contract wallets such as Safe let you define a list of owner accounts and a threshold of owners who must confirm a transaction.
  • The rule is enforced on the blockchain and can be checked by anyone, though on Bitcoin the script is usually revealed only when the coins are spent. Each chain implements it differently.
  • On Bitcoin, Schnorr multisignatures built with MuSig2 blur the line, because several keys produce one signature with no visible rule.

MPC (threshold) wallet

  • Uses one key split into shares, with a threshold signing together off-chain.
  • RFC 9591 says FROST signatures can be verified as if they came from a single signer. Bitcoin's BIP-340 says Schnorr multisignatures look, to a verifier, no different from ordinary signatures, and that Schnorr also supports threshold schemes such as FROST.
  • Because the signing happens off-chain, the same approach can work on chains that don't support multisig natively.

Which is better? Neither in every case. Multisig puts the rules on-chain where anyone can check them. MPC can keep the account looking like a normal single-key wallet and changes who holds what off-chain.

What to Watch Out For

  • Implementation flaws. Threshold signing protocols are complex. On August 9, 2023, researchers at Fireblocks, a digital asset custody company that runs its own MPC platform, disclosed vulnerabilities in some widely used implementations of the GG18, GG20 and Lindell17 protocols. For GG18 and GG20, Fireblocks says the flaw sat in the protocol description itself, where a missing zero-knowledge proof could let an attacker extract the full private key. Fireblocks says it notified affected providers under a responsible disclosure process and that multiple providers fixed their implementations.
  • Who holds the shares. Some MPC wallets keep one share with the provider. That can make recovery easier, but it also means you depend on that provider's security and availability. Check whether you can sign or recover without it.
  • Recovery. With no single seed phrase, recovery depends on how the wallet backs up and refreshes shares. Read the provider's documentation before you rely on it.
  • Chain and asset support. Not every scheme supports every signature type. FROST produces Schnorr signatures, which Bitcoin verifies since its Taproot upgrade, while Ethereum accounts use ECDSA, so MPC wallets there rely on threshold ECDSA protocols such as the GG18, GG20 and Lindell17 families. Check that the wallet supports the chains you use.
  • Questions to ask: can you sign without the provider's share, was key generation dealerless, has the signing code been audited or patched since 2023, and can you recover if the provider shuts down?

The Other MPC: Computing on Private Data

MPC isn't only about keys. The same branch of cryptography lets several parties compute a result from private inputs, with each learning only the result. That's how COTI's network uses it.

COTI's documentation describes a garbling protocol, a form of MPC, that lets two or more parties jointly compute a function while keeping their inputs and intermediate values private. COTI's network uses garbled circuits to run smart contracts on encrypted values, and COTI says it has been in production on its mainnet since March 2025. It has its own trust assumption, in the docs' words: "COTI V2 is predicated on the fact that a threshold of the network nodes operate faithfully." Our guide to garbled circuits explains how it works, and our guide to zero-knowledge proofs covers a related tool.

So an MPC wallet protects a key, while MPC computation protects data. Both depend on a threshold. An MPC wallet stays safe as long as fewer shares than the threshold are compromised, and COTI's documentation says its network relies on a threshold of nodes operating faithfully.

Frequently Asked Questions

Is an MPC wallet custodial?

It depends on who holds the shares. If you hold enough shares to sign on your own, it's closer to self-custody. If the provider holds a share you can't sign without, you depend on the provider. Check the wallet's terms and recovery options. This is a practical description, not a legal classification.

Is an MPC wallet safer than a multisig?

Not automatically. Both remove the risk of one stolen key. Multisig keeps its rules visible on-chain, while MPC depends on the correctness of complex signing software, which has had disclosed flaws. The right choice depends on your setup and who you trust.

Does an MPC wallet have a seed phrase?

Usually not in the traditional sense, because there's no single key to back up. Instead, each share is backed up or refreshed according to the wallet's design, so recovery works differently from a seed-phrase wallet.

Where to Go From Here

MPC wallets split control of one key, and MPC computation lets parties compute a shared result without seeing each other's inputs. If you build on COTI, whose network uses MPC through garbled circuits (in production on COTI mainnet since March 2025, COTI said on September 1, 2026), start with the Build on COTI documentation.

Details checked October 20, 2026. Standards and products change. Nothing here is financial or legal advice. Naming a wallet, provider or protocol here isn't a recommendation. COTI will never ask for your seed phrase or private key, and only COTI's official channels (coti.io, docs.coti.io, COTI's Medium blog and its official X and Telegram) carry announcements.

Sources