What is MPC wallet?

A wallet whose private key is never assembled in one place, split instead into shares held on separate devices that sign jointly using multi-party computation.

No single share can move funds, and there is no moment when a complete key exists on any machine, which removes the single point of compromise a normal wallet has. Most institutional custodians and several consumer wallets use this design, and it is the technology behind wallets that offer recovery without a seed phrase.

The point that gets lost is that this is a different guarantee from multisig, not a stronger version of the same one. Multisig is enforced by the blockchain. Multi-party computation is enforced by cryptography running off chain, and by the vendor who implemented it.

How it works

The key is generated in shares, never as a whole. A distributed key generation protocol produces, say, three shares on three devices, such that no device ever learns the private key and no device could reconstruct it alone.

To sign a transaction, a threshold of share holders run a signing protocol between them. They exchange messages that let them jointly produce a valid signature without any of them revealing their share or ever combining the shares into a key. The output is a single ordinary signature.

That last property is the practical advantage over multisig. The blockchain sees one normal signature from one normal address, so fees, compatibility, and privacy are unchanged, and the scheme works on chains that have no native multisig support at all.

Some implementations support proactive refresh, where shares are re-randomized on a schedule so that an attacker who stole one share months ago holds something useless. Policy engines sit on top, requiring particular approvers or limits for particular transactions.

The dependency to understand is recovery. There is no seed phrase to write down. If shares are lost, whether you recover depends entirely on the vendor's backup design, which might be an encrypted share held in your cloud storage, a share held by the vendor, or a social recovery arrangement.

Example

Illustrative setup. A consumer wallet uses a two-of-three scheme: one share on your phone, one encrypted in your cloud backup, one held by the provider.

Day to day, your phone and the provider co-sign, which is why transactions feel like a normal app. Lose the phone, and the cloud share plus the provider's share restore access on a new device. The trade-off is visible in the same sentence: the provider participates in your signing, so a compromised or coerced provider is part of your threat model in a way it would not be for a hardware wallet you hold alone.

Why it matters when you buy

If you use a wallet with no seed phrase, this is probably why, and it changes what your backup plan should be. Before moving meaningful amounts off an exchange into such a wallet, read exactly how the vendor recovers a lost device and what happens if the company ceases to operate. Our guides on choosing a first wallet at First crypto wallet and moving funds off an exchange at Move crypto off exchange cover the comparison.

Related terms

• multisig — the on-chain equivalent guarantee
• private key — what is never assembled here
• hardware wallet — the single-key alternative
• social recovery — a related recovery approach
• shamir backup — splitting a seed, not a signature
• custodian — who typically deploys this design

Questions

Is an MPC wallet self-custody?

It depends on who holds the shares. If a threshold requires the provider's participation, the provider can block you, which is not full self-custody. If you hold enough shares to sign alone, it is.

How is this different from multisig?

Multisig is enforced by the blockchain and visible on chain as several signatures. Multi-party computation happens off chain and produces one ordinary signature, so it works on any chain but relies on the implementation rather than the protocol.

What happens if the vendor shuts down?

That is the question to answer before depositing. Some vendors publish an export or emergency withdrawal path that works without them. Others do not, and that dependency should be understood in advance.