Multisig vs MPC Wallets: Security Tradeoffs for Institutions

By the Guardian team Updated November 2026 5 min read

Quick answer. Choose multisig when approvals must be provable onchain, and MPC when you need one signing setup across many chains at lower fees. Neither stops a tampered signing screen, so verify every transaction on a second device.

Watch: Multisig vs MPC Wallets: Security Tradeoffs for Institutions 1:41

Video transcript

Multisig and MPC both stop one person from moving funds alone. They enforce it in different places, and that decides what auditors can verify and whom you depend on.

Multisig needs several separate keys, and the chain checks each one. MPC splits one key into shares that produce a single ordinary signature.

Multisig shows every signer and approval publicly. MPC needs no contract, can cost less in fees, but keeps approvals in provider logs.

MPC adds a risk multisig lacks: some implementations could leak the full key. Fireblocks disclosed the BitForge flaws in 2023, affecting more than 15 wallet providers, blockchains and open-source projects.

Multisig is not immune either. Bybit lost about 1.5 billion dollars when a compromised developer machine disguised a malicious transaction. Safe's review found no flaws in its contracts.

Radiant Capital lost about 50 million dollars the same way. Hong Kong's SFC says these weaknesses apply to MPC too. Verify every transaction on a second device.

Choose multisig for approvals provable onchain and no vendor in the quorum. Choose MPC for one setup across many chains, lower fees and a policy engine. Hybrids carry both sets of risks.

Guardian pentests threshold signers and reviews multisig transactions before they are signed. Read the full comparison, or talk to Guardian at guardian.security.

Multisig and MPC both stop one person from moving funds alone. They enforce it in different places.

That choice decides what auditors can verify, which chains you can use and whom you depend on.

For vendor picks, see our MPC provider comparison and multisig wallet comparison. This post compares the two designs.

How Each Works

A multisig wallet holds funds under a script or contract that needs a set number of separate keys, such as 3 of 5. The chain checks each signature against that threshold.

An MPC wallet splits one key into shares held by separate parties. The shares compute a signature together, and the chain sees one ordinary signature.

BitGo's developer docs class multisig as onchain cryptography and MPC as offchain cryptography. Nearly every tradeoff below follows from that.

Multisig vs MPC Compared

Factor	Multisig	MPC
Threshold enforced by	The chain	The signing protocol, offchain
Onchain view	Every signer and the threshold	One address, one signature
Chain support	Native on most UTXO chains; contracts elsewhere	No contract needed
Fees	Higher: each signature goes onchain	Lower: one signature goes onchain
Policy	Threshold onchain; more rules need modules or guards	Vendor policy engine, offchain
Key rotation	Owner swap onchain; same address	Shares re-randomized; same address
Vendor dependency	Open contracts; interface often hosted	Provider may hold a share and run policy
Recovery	Remaining signers replace a lost key	Backup share or recovery kit
Audit trail	Public, onchain	Provider logs

Transparency and audit trail

With multisig, anyone can read the owners, the threshold and which keys approved each transaction. That suits boards, auditors and token holders who want proof.

MPC puts one combined signature onchain. Who approved a transfer lives in the provider's logs, so ask how you can export them.

Chains and cost

Most UTXO chains, such as Bitcoin, support multisig natively, BitGo notes. On account-based chains like Ethereum, multisig needs a smart contract deployed on each chain.

MPC needs no contract, and BitGo says all account-based chains support it. It can also cost less, since one signature goes onchain instead of several.

Policy, rotation and recovery

A multisig threshold cannot be skipped. Rules beyond it need Safe modules or guards, which Safe's docs call security-critical.

MPC policy runs in the provider's engine, offchain. Where it runs, and who can change it, varies by vendor.

In a Safe, owners are added, removed and replaced onchain. A lost key can be swapped out the same way, while enough signers remain to meet the threshold.

MPC rotates differently. Fordefi's share refresh "re-randomizes your organization's key shares," while keys, addresses and funds stay the same.

Its docs add that device backups made before the upgrade cannot stay valid across refreshes. Plan refresh and backup together.

What the Incidents Show

BitForge: a risk only MPC carries

In August 2023, Fireblocks disclosed BitForge: flaws in implementations of the GG18, GG20 and Lindell17 threshold signing protocols.

It said they affected more than 15 wallet providers, blockchains and open-source projects. Some implementations could leak the full key in 16 signatures.

The GG18 and GG20 flaw was "found at the pseudocode level," so Fireblocks said every vendor implementing those protocols should be considered vulnerable.

So MPC adds a risk multisig lacks: the shared cryptography itself. Multisig's equivalent sits in its contracts, modules and interface.

Bybit and Radiant: the signing screen

Bybit lost about $1.5 billion on February 21, 2025, the FBI says. Bybit was making a routine transfer from an Ethereum multisig cold wallet to a warm wallet.

Safe said a compromised Safe{Wallet} developer machine led to a disguised malicious transaction. Its review found no vulnerabilities in the Safe smart contracts.

Radiant Capital lost about $50 million on October 16, 2024, after three developers' devices were compromised.

Their front ends showed benign transaction data while malicious transactions were signed in the background. Radiant said standard checks and simulations showed no obvious discrepancies.

Both thresholds held. The signers approved what they could not see. Our Bybit hack explainer traces each step.

MPC does not escape this. Hong Kong's SFC says the weaknesses behind recent incidents apply "regardless of the custody solutions used," naming HSMs, MPC and multisig.

The defense is an independent check of every transaction, away from the screen that built it. See how to verify a Safe transaction before signing.

When to Use Which

Choose multisig when:

Approvals must be provable onchain to auditors, boards or token holders.
Your assets sit on Bitcoin or chains with a well-tested multisig contract.
You want no vendor inside the signing quorum.

Choose MPC when:

You need one signing setup across many chains.
Fees matter, as on high-volume withdrawal wallets.
You want a policy engine with limits, allowlists and API access.

Then check your rules:

Hong Kong: the SFC says cold wallet implementations "should not include smart contracts on public blockchains."
Singapore: if you use MPC, MAS expects key shares held by different parties, so no one party can move assets.
Dubai: VARA says custodians should consider multi-signature approaches, and it may require them.

Hybrid setups

The two combine well, in three main ways:

By chain: BitGo offers 2-of-3 multisig and MPC wallets, and uses MPC on Cardano instead of multisig.
MPC as a signer: Safe accepts externally owned accounts as owners, so an MPC wallet can hold one seat.
By tier: MPC for hot flows, and multisig or HSM cold storage where your rules allow. See hot, warm and cold wallets.

A hybrid carries both sets of risks, so test both signing paths.

How Guardian Helps

For institutions, Guardian advises on custody and signing models while they are still decisions, including approval thresholds and key custody.

Its OpSec audit maps where keys live, who holds which share, what a quorum requires in practice and what signers actually see.

The offchain automation pentest tests threshold signers, including what a subset below threshold can force. With Managed Security, Guardian reviews every multisig transaction before it is signed.

Frequently Asked Questions

Should an institution use multisig or MPC?

Multisig if approvals must be provable onchain; MPC for one setup across many chains at lower fees. The two can be combined by chain or tier. Either way, verify each transaction away from the signing screen.

Can an MPC wallet be a signer on a Safe multisig?

Yes. Safe accepts externally owned accounts as owners, and an MPC wallet produces one ordinary signature from one address. The Safe enforces its threshold onchain, while the MPC provider's policy governs that one seat.

Do regulators require multisig or MPC?

Not in the Hong Kong, Singapore or Dubai texts cited here. The SFC says cold wallets should not include public-chain smart contracts. MAS sets rules for MPC key shares. VARA says custodians should consider multi-signature, and may require it.

Which costs less, multisig or MPC?

MPC can cost less onchain: only one combined signature is broadcast, while multisig broadcasts each signature, BitGo notes. On Ethereum, multisig also needs a contract on each chain. Compare MPC provider fees separately.

Sources

Test your signing setup before you commit

Guardian reviews multisig and MPC signing paths, key custody and recovery, and what your signers actually see before they approve.

Talk to Guardian Explore Guardian for institutions