# MPC vs Multisig

The short answer, up front: multisig puts several complete keys on-chain and the blockchain enforces the quorum; MPC splits one key into shares that jointly compute a single signature off-chain. Multisig is transparent but chain-specific and reveals your policy on-chain. MPC produces a standard signature on any chain and keeps the quorum private.

## How each works

- **Multisig** — a smart contract or script address requires M of N complete private keys to sign. Every signer holds a whole key; the chain validates the quorum and everyone can see it.
- **MPC (threshold signatures)** — one key exists only as distributed shares. Parties run a cryptographic protocol to produce one ordinary signature; no share ever becomes a key, nothing special appears on-chain.
- **The practical difference** — multisig support varies per chain (native on Bitcoin, contract-based on Ethereum, absent elsewhere); MPC works identically on every chain because the output is a normal signature.

## MPC vs multisig, point by point

| | Multisig | MPC |
| --- | --- | --- |
| Where the quorum lives | On-chain — visible to everyone | Off-chain — private |
| Chain coverage | Per-chain implementations, uneven | Any chain; the signature is standard |
| Key material | N complete keys exist | No complete key ever exists |
| Fees | Higher on contract chains (multisig contract calls) | Normal single-signature fees |
| Policy changes | On-chain transaction (visible, costs gas) | Off-chain reshare — addresses unchanged |

## Why institutions moved to MPC

Three reasons dominate: uniform coverage across chains that have no native multisig; privacy of the signing policy; and operational flexibility — thresholds change by ceremony, not by migrating funds to a new address. The trade-off is trust in the MPC implementation itself, which is why protocol choice (e.g. DKLS23, FROST) and an auditable recovery path matter when evaluating vendors.

## MPC and multisig, side by side

The differences that actually change an operating model.

- **Where the quorum lives** — multisig publishes the rule on-chain; MPC keeps it off-chain and produces one ordinary signature.
- **Key material** — multisig means N complete keys exist. In MPC no complete key ever exists, at any point, on any machine.
- **Chain coverage** — multisig needs a per-chain implementation. An MPC signature is standard, so coverage is a question of address formats, not contracts.
- **Fees** — contract-based multisig costs more per transaction on account chains; an MPC transfer pays ordinary single-signature fees.
- **Changing the rule** — multisig changes are on-chain transactions, visible and paid for. An MPC reshare is off-chain and leaves every address unchanged.
- **Privacy** — a multisig arrangement is public by construction; an MPC quorum is not visible on-chain.
- **Failure mode** — multisig is transparent but rigid; MPC is flexible but places weight on the protocol implementation and the recovery path.
- **Protocol generation** — ask which threshold-ECDSA protocol a vendor runs and what a protocol upgrade costs the customer. Ours migrates a vault in place: the public key, every derived address and the existing backup all survive.
- **What to verify** — for any MPC vendor: how many parties they hold, whether yours is mandatory, and whether recovery works without them.

## Related

- [Vaultody MPC](/multi-party-computation)
- [Platform](/platform)
- [Key Management](/features/key-management)
- [Key Shards & Recovery](/features/key-shards-and-recovery)