Home › Learn › MPC vs Multisig

MPC vs Multisig: what actually differs

The short answer, up front

Multisig puts several complete keys on-chain and the blockchain enforces the quorum; MPC splits one key into shares that jointly compute a single signature off-chain. Multisig is transparent but chain-specific and reveals your policy on-chain. MPC produces a standard signature on any chain and keeps the quorum private.

How each works

Multisig

A smart contract or script address requires M of N complete private keys to sign. Every signer holds a whole key; the chain validates the quorum and everyone can see it.

MPC (threshold signatures)

One key exists only as distributed shares. Parties run a cryptographic protocol to produce one ordinary signature — no share ever becomes a key, nothing special appears on-chain.

The practical difference

Multisig support varies per chain (native on Bitcoin, contract-based on Ethereum, absent elsewhere); MPC works identically on every chain because the output is a normal signature.

MPC vs multisig, point by point

	Multisig	MPC
Where the quorum lives	On-chain — visible to everyone	Off-chain — private
Chain coverage	Per-chain implementations, uneven	Any chain; the signature is standard
Key material	N complete keys exist	No complete key ever exists
Fees	Higher on contract chains (multisig contract calls)	Normal single-signature fees
Policy changes	On-chain transaction (visible, costs gas)	Off-chain reshare — addresses unchanged

Why institutions moved to MPC

Three reasons dominate: uniform coverage across chains that have no native multisig; privacy of the signing policy; and operational flexibility — thresholds change by ceremony, not by migrating funds to a new address. The trade-off is trust in the MPC implementation itself, which is why protocol choice (e.g. DKLS23, FROST) and an auditable recovery path matter when evaluating vendors.

Comparison

MPC and multisig, side by side

The differences that actually change an operating model.

Where the quorum livesMultisig publishes the rule on-chain; MPC keeps it off-chain and produces one ordinary signature.

Key materialMultisig means N complete keys exist. In MPC no complete key ever exists, at any point, on any machine.

Chain coverageMultisig needs a per-chain implementation. An MPC signature is standard, so coverage is a question of address formats, not contracts.

FeesContract-based multisig costs more per transaction on account chains; an MPC transfer pays ordinary single-signature fees.

Changing the ruleMultisig changes are on-chain transactions — visible and paid for. An MPC reshare is off-chain and leaves every address unchanged.

PrivacyA multisig arrangement is public by construction; an MPC quorum is not visible on-chain.

Failure modeMultisig is transparent but rigid; MPC is flexible but places weight on the protocol implementation and the recovery path.

Protocol generationAsk which threshold-ECDSA protocol a vendor runs and what a protocol upgrade costs the customer. Ours migrates a vault in place — the public key, every derived address and the existing backup all survive.

What to verifyFor any MPC vendor: how many parties they hold, whether yours is mandatory, and whether recovery works without them.