Institutional Wallet Architecture: Multisig vs MPC for Treasury Management

Managing crypto assets securely and efficiently is critical for institutions. Two popular wallet architectures – Multisig (multisignature) and MPC (Multi-Party Computation) – offer distinct approaches to safeguarding funds. Here’s the core difference:

• Multisig wallets require multiple signatures (e.g., 3 of 5) to approve transactions. They operate on-chain, providing transparency but are limited to specific blockchains and require manual coordination.
• MPC wallets split a single private key into shares, enabling off-chain approvals and faster transactions across 150+ blockchains. They offer flexibility but depend on third-party providers and advanced cryptography.

Key Takeaways:

• Multisig: Better for smaller teams, static setups, and transparent governance.
• MPC: Ideal for high-volume, multi-chain operations with faster approvals.

Quick Comparison:

The right choice depends on your institution’s scale, risk tolerance, and transaction needs. Many use a mix: MPC for hot wallets and multisig for reserves.

How Multisig Wallets Work for Treasury Management

Key Features and Security of Multisig Wallets

Multisig wallets operate on a simple but effective principle: no single person has complete control over the funds. Instead, they rely on an M-of-N threshold system, where at least M signatures from a group of N authorized keys are required to approve any transaction. For example, a company might use a 3-of-5 configuration for its board of directors or a 5-of-7 setup for added security in cold storage environments.

This setup eliminates the risk of a single point of failure. For an attacker to gain access, they would need to compromise multiple independent keys. At the same time, every transaction approval is recorded on the blockchain, creating a transparent audit trail. This concept mirrors traditional banking practices, like dual-control systems, where multiple keys are needed to access a vault.

"Multisig establishes a collective consensus mechanism, similar to the dual control process in traditional financial systems or the mechanism of opening a safe at a bank that requires many different keys." – Tan Phat Digital

The way multisig wallets are implemented varies by blockchain. Bitcoin supports multisig at the protocol level using methods like P2SH (Pay-to-Script-Hash) or Taproot/MuSig2, which aggregates signatures. On Ethereum and other EVM-compatible blockchains, multisig functionality is achieved through smart contracts. A prominent example is Safe (formerly known as Gnosis Safe), which has handled trillions of dollars in transactions as of 2026. These smart contracts also offer additional features, such as spending limits for smaller operational expenses and integration with DeFi protocols.

However, multisig wallets come with their own risks. A notable example occurred in July 2017 when a flaw in the Parity multisig implementation allowed attackers to steal around 150,000 ETH (worth $30 million at the time) and later caused $300 million in Ethereum to become permanently frozen. These incidents highlight the importance of using well-audited, widely-accepted implementations instead of custom-built solutions.

Another challenge is operational rigidity. Adjusting the list of authorized signers or changing the threshold typically requires an on-chain transaction, which can sometimes necessitate migrating to a new wallet. To mitigate risks, treasury managers often store keys on separate hardware wallets located in different physical locations. This geographic dispersion reduces the chances of a local disaster or coercion compromising the entire treasury.

These principles form the foundation of secure and efficient treasury management practices.

Multisig in Practice: Common Use Cases

The transaction process in a multisig wallet typically involves four steps:

• Initiation: Entering the recipient’s address, transaction amount, and other details.
• Review: Authorized cosigners review and digitally sign the transaction.
• On-chain signature collection: The blockchain accumulates the required number of signatures.
• Broadcast: The transaction is finalized and sent for validation.

For large-scale treasury operations, tiered approval policies are often used. Smaller transactions might only require 2-of-3 signatures, while larger, high-stakes transactions may demand 5-of-7 approvals. This approach helps balance security with operational efficiency.

One essential practice is avoiding blind signing. In 2024, an attack on Bybit exploited altered user interfaces to hide malicious transaction details. This incident underscores the importance of verifying transaction information directly on hardware wallets.

Modern multisig wallets have also evolved to include advanced features. For instance, they now support ERC-4337, enabling gas fee payments in stablecoins and social recovery mechanisms. Some even integrate AI tools to scan destination addresses for potential threats, adding another layer of security.

sbb-itb-7e716c2

How MPC Wallets Work for Treasury Management

Core Principles and Advantages of MPC Wallets

MPC wallets rely on Distributed Key Generation (DKG) to divide a private key into separate shares, stored across multiple environments. This ensures the key never exists in its entirety – not during creation, storage, or even transaction signing.

"The result is a wallet where the fundamental private key never exists at any point in time – it’s a mathematical abstraction that only emerges through collaboration." – Cobo

When a transaction needs approval, MPC systems use Threshold Signature Schemes (TSS). These schemes allow a designated number of key shares, or quorum, to work together to generate a valid signature without ever reconstructing the full private key. For example, in a 3-of-5 setup, any three authorized participants can sign a transaction while the key remains fragmented.

One of MPC’s standout features is its off-chain flexibility. Transactions can be processed quickly and across more than 150 blockchains, even those that don’t support native multisig functionality. Fireblocks, for instance, has processed over $10 trillion in digital asset transactions and secured more than 550 million wallets using this approach. Cobo, another major player, has handled over $200 billion in transactions since 2017 without a single security breach.

MPC also offers unmatched adaptability for treasury teams. They can add or remove signers, or adjust approval thresholds, without changing wallet addresses or initiating on-chain transactions. Modern implementations enhance security by storing key shares in Trusted Execution Environments (TEEs) like Intel SGX or Apple Secure Enclave, which provide hardware-level isolation for cryptographic operations.

That said, MPC isn’t without risks. The May 2023 Multichain incident highlighted potential vulnerabilities when centralized practices are paired with MPC. In this case, the protocol’s CEO was detained, and attackers exploited centralized control over MPC node servers. By accessing a single cloud account, they reconstructed keys and stole $130 million. This underscores the importance of decentralizing key shares across various locations, organizations, or hardware environments to eliminate single points of failure.

These cryptographic safeguards form the backbone of MPC’s ability to deliver secure, adaptable solutions for institutional use.

MPC Wallet Use Cases in Institutional Settings

The cryptographic strengths of MPC allow a quorum of parties to collaborate off-chain to generate a single signature, which is then broadcast to the blockchain. This streamlined process is a game-changer for treasury operations.

SBI Holdings has been using an MPC solution since 2018, deploying it across global banks and exchanges. This initiative powered the first institutional MPC wallet and set a precedent for secure digital asset management. In 2023, DZ Bank adopted an MPC-based custody solution. Nils Christopeit, Product Manager for DZ Bank, remarked:

"Our requirements around security, scalability and future-proofness of our digital asset custody initiative were highly complex, and Ripple Custody proved to be the only solution fit for purpose and able to support our target operating model".

MPC also enables automated workflows. Treasury teams can establish role-based access control (RBAC) to define specific roles, such as initiators, reviewers, and co-signers, ensuring clear separation of duties. Real-time policy enforcement further enhances security by integrating automated checks for transaction velocity, whitelisted addresses, and jurisdictional compliance directly into the signing process. Thanks to its protocol-agnostic nature, MPC can manage assets across multiple blockchains – Bitcoin, Ethereum, Solana, and others – using a single key structure.

Recovery mechanisms are another critical consideration. Unlike traditional wallets, MPC doesn’t allow for simple regeneration of lost key shares. Institutions must plan ahead by configuring redundant or escrowed recovery shares during the initial setup to prevent permanent asset loss. Additionally, partnering with an MPC provider that includes a "Governance Layer" adds an extra layer of security by enforcing transaction limits, whitelists, and role-based approvals before signatures are generated. Given the complexity of MPC, institutions should prioritize solutions that have undergone thorough third-party audits and proven their reliability in real-world scenarios.

Multisig vs MPC: A Detailed Comparison

Comparison Table: Multisig vs MPC

The table below lays out a side-by-side comparison of multisig and MPC wallet architectures, focusing on their suitability for institutional treasury management. While both offer robust security, they come with distinct trade-offs.

Multisig wallets are relatively inexpensive to deploy, with costs limited to gas fees. On the other hand, MPC wallets typically come with annual fees ranging from 5 to 25 basis points of assets under management, plus transaction fees of $0.50 to $5 per operation. However, MPC’s single-signature model can lead to significant savings on gas fees compared to multisig’s multiple on-chain signatures.

As Fireblocks explains:

"Multi-sig was designed for an era where Bitcoin was the only chain, operational scale wasn’t a concern, and the threat model was simpler. MPC was built to solve the problems multi-sig left open."

Multisig offers transparency, which can be a double-edged sword. While it supports public accountability by making all signers and approval thresholds visible on-chain, this also exposes governance structures to potential risks. In contrast, MPC operates off-chain, resulting in a single on-chain signature that keeps the underlying process hidden.

Key Takeaways from the Comparison

The table highlights the key differences, but here’s how each type of wallet tends to perform in practice:

Multisig is ideal for smaller teams and static treasuries.
For organizations with stable governance structures, the on-chain transparency provided by multisig can be an advantage. However, its chain-specific design means separate implementations are needed for different blockchains, such as Bitcoin and Ethereum.

MPC excels in high-volume, multi-chain operations.
For treasury teams managing diverse assets across 150+ blockchains, MPC provides the flexibility to enforce policies programmatically. Fireblocks, for example, has used MPC to process over $10 trillion in digital asset transactions. Its ability to rotate signers and adjust thresholds off-chain – without changing wallet addresses or incurring gas fees – makes it a strong choice for growing organizations. That said, the May 2023 Multichain incident, where $130 million was stolen due to a compromised centralized cloud account, underscores the importance of operational discipline even with advanced cryptography.

Ultimately, the decision between multisig and MPC comes down to the institution’s scale, transaction needs, and security priorities. Many organizations managing over $50 million in assets adopt a hybrid approach: using MPC wallets for high-velocity operations (typically 5–10% of funds) while reserving multisig or HSM custody solutions for long-term holdings.

Decision Framework: Selecting the Right Wallet Architecture

Factors to Consider in Making Your Choice

When deciding on the best wallet architecture, it’s important to balance operational needs with regulatory requirements. For instance, if your operations involve frequent transactions, MPC (multi-party computation) offers a clear advantage with its automated policy engines, enabling near-instant approvals. In contrast, multisig (multi-signature) wallets rely on manual coordination, which can slow down transaction speeds. This difference is particularly relevant for organizations managing high-frequency operations.

If your treasury spans several blockchains, multisig wallets can become cumbersome due to their chain-specific implementations. On the other hand, MPC provides a more streamlined solution in such scenarios, as previously discussed.

Regulatory compliance also plays a significant role. For example, U.S. broker-dealers and SEC-registered investment advisers are often required by law to use qualified HSM-based custody solutions instead of self-custody options like multisig or MPC.

Another key consideration is privacy. Multisig wallets expose governance details on the blockchain, making signer identities visible. In contrast, MPC offers greater privacy by concealing signer identities through a single aggregated signature. These operational and regulatory factors are critical in shaping an institution’s treasury strategy.

Tailoring Solutions for Tiered Treasury Strategies

A tiered treasury strategy can help institutions address diverse operational and regulatory needs. Many organizations allocate their assets across different wallet types based on use case and risk level:

• Hot wallets (5–10% of funds): Typically managed with MPC for quick, operational transactions.
• Warm wallets (30–50% of funds): Often handled with multisig for activities requiring more governance oversight.
• Cold storage (40–60% of funds): Secured using HSM-based custody to meet regulatory standards.

This tiered approach establishes clear boundaries for operations. For example, multisig wallets are well-suited for funds actively engaging with DeFi protocols like Aave or Uniswap, where native smart contract compatibility is essential. Meanwhile, MPC is a better fit for CeFi activities, such as managing rapid withdrawals from exchanges.

Transaction size is another factor that can guide wallet selection. Institutions often implement tiered approval thresholds. For instance, smaller transactions under $50,000 might only require a 2-of-3 multisig approval, whereas larger transfers exceeding $1 million may demand a 5-of-7 signature, including participation from executive leadership. MPC systems can automate these approval workflows, routing transactions based on criteria like amount, destination, or asset type.

Finally, it’s crucial to prepare for potential disruptions. Conduct recovery drills twice a year to simulate scenarios such as losing a signer or a hardware wallet. These exercises ensure your team is familiar with recovery procedures and can respond effectively in real-world situations.

Securing crypto with Multi-Party Computation (MPC)

Conclusion

Choosing the right wallet architecture is a key decision for treasury management. As Eco explains:

"The choice between models is the most consequential treasury decision after asset and chain selection – it determines who can move funds, how fast, and what the recovery story looks like".

Multisig wallets provide full self-custody with on-chain transparency, making them a solid choice for reserves actively engaged in DeFi. They excel in native smart contract integration but require manual coordination for signing, which can slow down operations significantly. On the other hand, MPC wallets focus on speed and flexibility. They enable fast, cross-chain transactions through automated policy engines, with platforms like Fireblocks handling over $10 trillion in transactions. However, MPC solutions rely on third-party availability and must maintain strong security measures.

To balance these strengths and weaknesses, many institutions adopt a tiered approach. For example, they might allocate 5–10% of funds to MPC wallets for hot, operational needs, 30–50% to multisig wallets for warm, yield-generating reserves, and 40–60% to HSM-based qualified custody for cold, long-term holdings. This strategy ensures that each wallet type is used where it performs best while diversifying custody risks.

Don’t forget to conduct recovery drills at least every six months to ensure your processes are effective. Align your wallet choices with your operational needs, risk appetite, and compliance requirements to maintain secure and efficient treasury operations.

FAQs

How do we choose the right signing threshold (e.g., 2-of-3 vs 5-of-7)?

Choosing the right signing threshold is all about balancing security, efficiency, and practicality. A lower threshold, like 2-of-3, is easier to manage but comes with reduced security. On the other hand, a higher threshold, such as 5-of-7, boosts security but can make operations more complicated.

To make the best choice, align the threshold with your organization’s security policies, governance framework, and risk tolerance. For example, large-scale or high-value transactions may require stricter thresholds to ensure protection, but you don’t want to overcomplicate processes to the point where they disrupt efficiency. It’s all about finding that sweet spot where security and operational needs meet.

What’s the best way to recover funds if a signer or key share is lost?

The recovery process varies based on the type of wallet architecture in use. For multi-signature (multi-sig) wallets, funds can still be accessed as long as the required number of signatures remains available. On the other hand, Multi-Party Computation (MPC) wallets use predefined protocols that enable secure regeneration of lost key shares without ever exposing the private key. Compared to multi-sig systems, MPC typically provides greater flexibility and resilience when it comes to recovering lost key shares.

How can we reduce third-party risk when using an MPC provider?

Minimizing third-party risk with an MPC provider relies heavily on its cryptographic design. By distributing control across multiple parties, this approach removes single points of failure. It also reduces reliance on any single third party, boosting both security and resilience – key factors in managing institutional treasuries effectively.

Related Blog Posts

• Multisig Wallets and Compliance: Key Regulations
• Best Practices for Multisig Wallet Security
• Ultimate Guide to Institutional Crypto Custody
• Institutional DeFi Yield: Custody and Compliance Frameworks