What Is an MPC Wallet? Key Shares, Risks and Examples

An MPC wallet is a crypto wallet whose private key never exists in one place. The key is split into "shares" held by different parties, for example your phone and the wallet provider's server, and those parties run a cryptographic protocol called multi-party computation (MPC) to sign transactions together without ever rebuilding the full key.

The result is a wallet with no seed phrase to write down and no single file or device that, if stolen, empties your account. That is a real security gain, with trade-offs around vendor dependency and recovery. This guide explains how key shares work, how MPC compares with multisig and seed phrase wallets, which providers use it, and what has gone wrong in the past.

What is an MPC wallet?

Every normal crypto wallet is controlled by a private key: a large secret number that produces the signatures a blockchain accepts. In a standard wallet that key is derived from a seed phrase, and whoever has the phrase has the funds.

Multi-party computation is a branch of cryptography that lets several parties compute a result together while each keeps its own input secret. Fireblocks, which builds MPC infrastructure for institutions, describes it as a method that splits a private key into separate shares distributed across independent parties, so that "the complete key is never assembled in one place, at any point in time". The academic foundations date back to the early 1980s; applying them to crypto wallets is much newer.

Wallets usually use a specific part of MPC called a threshold signature scheme (TSS). A threshold scheme is described as "t-of-n": any t of the n share-holders can sign, but fewer than t learn nothing useful. Zengo, a consumer MPC wallet, explains that TSS assumes at least a threshold of the parties are honest and not controlled by an attacker at the same time. The approach is mature enough that the US National Institute of Standards and Technology runs a Multi-Party Threshold Cryptography project; its call for threshold schemes, NIST IR 8214C, was published in final form on 20 January 2026.

How MPC key shares work

An MPC wallet goes through three main steps.

1. Distributed key generation. Each party generates its own random share. Together they compute the wallet's public key, and therefore its address, without any of them learning the full private key.
2. Signing. When you send a transaction, enough parties to meet the threshold each run their part of the protocol. The output is one ordinary signature. The blockchain cannot tell it came from an MPC wallet.
3. Share refresh and backup. Many providers can rotate shares while keeping the same address, so an old, leaked share becomes useless.

Common setups include:

• 2-of-2: one share on your device, one on the provider's server. Both must take part in every signature. Zengo uses this model, with one share on your mobile device and the other on the Zengo server.
• 2-of-3: a device share, a provider share and an encrypted backup share. Any two can sign or recover. Binance's Web3 Wallet launched with three key-shares, two of which are controlled by users.
• Larger quorums for companies, with shares on separate servers, enclaves or staff devices behind a policy engine.

MPC vs multisig

MPC and multisig wallets both remove the single point of failure, but they do it in different places.

Multisig's main advantage is transparency: the 3-of-5 rule is public and enforced by the chain itself. MPC's advantages are portability, privacy and, on some chains, lower fees.

MPC vs seed phrase wallets

A seed phrase wallet gives you one complete secret. That is simple and fully under your control: with the 12 or 24 words you can restore the wallet in any compatible app, with no company involved. It is also the reason so many people lose funds, through phishing sites that ask for the phrase, photos in cloud storage, or fake wallet apps.

An MPC wallet has no phrase to phish. Stealing your phone alone, or breaching the provider's server alone, should not be enough to move funds. Recovery uses familiar factors instead of a word list. Zengo's recovery kit, for example, has required two factors since 23 May 2024: email authentication and an encrypted recovery file in your cloud storage, with a 3D face scan optional unless you enable certain paid features.

The trade-off is portability. You cannot normally type an MPC wallet into another app the way you can a seed phrase. If the provider disappears, your ability to sign depends on whatever export or recovery path it built. For more on the wider choice, see our guide to non-custodial wallets and hot vs cold wallets.

Examples of MPC wallets and providers

These are well-known names, described from their own material. This is not an endorsement or ranking.

• Zengo (retail). A consumer wallet built on a 2-of-2 device and server model, with open-source MPC code on GitHub. Zengo's site claims more than two million wallets secured since 2018; that is the company's own figure.
• Binance Wallet (retail). Launched as the Binance Web3 Wallet on 8 November 2023 inside the Binance app, using MPC with three key-shares instead of a seed phrase. Decrypt reported that one share is protected by Binance, one sits on your device and one is encrypted with a recovery password in iCloud or Google Drive, and that losing both the password and the device can make the wallet unrecoverable.
• Fireblocks (institutional). Sells MPC custody and wallet infrastructure to exchanges, banks and fintechs. Its own protocol, MPC-CMP, needs one signing round versus nine for the older GG18 protocol, according to Fireblocks, and supports keeping a share offline for cold storage.
• Coinbase Developer Platform (developers). An instructive case. Coinbase's earlier Wallet API v1 and its Wallet-as-a-Service product were MPC-based, but its CDP Wallets v2, announced on 28 May 2025, use a different design: keys are generated and used inside an AWS Nitro Enclave, a trusted execution environment, with "no MPC, no key shards", in Coinbase's words.

The Coinbase example is a useful reminder that MPC is one way to avoid a single exposed key, not the only one. Hardware enclaves, smart-contract accounts with social recovery, and passkey-based wallets compete for the same job.

Security trade-offs and known failures

MPC moves risk rather than removing it.

Protocol and implementation bugs

MPC protocols are complex, and complex code fails. On 9 August 2023 Fireblocks' researchers disclosed BitForge, a set of zero-day flaws in widely used threshold signature protocols, including GG-18, GG-20 and implementations of Lindell 17. Fireblocks said that, if left unfixed, the flaws could let an attacker or malicious insider drain wallets within seconds without the user or vendor noticing. It named Coinbase WaaS, Zengo and Binance as affected, among dozens of others. Coinbase and Zengo said the issues were fixed after a 90-day disclosure process and that no customer funds were affected. The academic papers describing the protocols were revised.

Concentrated control

MPC only helps if the shares really are held by independent parties. The Multichain cross-chain bridge used MPC, but in July 2023 the project said that funds and server access had been under its CEO's control and that he had been in police custody since 21 May. DL News quoted a BlockSec researcher saying that although Multichain used MPC, "all the keys are managed solely by the CEO himself". The bridge halted operations. Splitting a key is meaningless if one person can reach every piece. The same lesson applies to crypto bridges generally.

Vendor dependency

In a 2-of-2 setup the provider's server must sign every transaction. If it is offline, blocks your region, freezes an account or goes out of business, you may be unable to move funds until a recovery path kicks in. Ask whether the wallet documents a way to sign or export without the company.

Recovery factors become attack targets

When email and cloud backups replace a seed phrase, they become what attackers go after. A SIM swap or hijacked email removes one layer of protection. Use a strong, unique password and app-based two-factor authentication on the accounts that hold your recovery factors.

MPC does not stop you signing a bad transaction

No key-management scheme protects you from approving a malicious contract. Wallet drainers and approval phishing work the same way against MPC wallets. Reading what you sign still matters.

How to choose an MPC wallet

• Check the custody model. Who holds each share, and can you sign or recover without the provider?
• Look for an exit path. Is there a documented key export or independent recovery tool if the company shuts down?
• Look at the protocol and audits. Does the provider name its protocol, publish audits or open-source the code, and has it addressed public disclosures such as BitForge?
• Check chain support. Make sure it supports the networks and apps you use. Our Sui wallets guide and self-custody wallets guide compare options.
• Match the tool to the amount. Many people use an MPC or hot wallet for daily use and a hardware wallet or multisig for savings.

JewelSwap's apps on MultiversX, Sui and Radix are non-custodial: you connect your own wallet and sign each transaction, so the same key-management choices apply whichever wallet you use with them.

Frequently asked questions

What is an MPC wallet in simple terms?

A wallet whose private key is never stored in one place. Instead, two or more parties, such as your phone and a provider's server, each hold a key share and jointly produce a normal signature when you send a transaction.

Is an MPC wallet safer than a seed phrase wallet?

It removes the single secret that phishing and careless backups target, which helps many users. It adds other risks: you depend on the provider's servers and code, and flaws in the MPC protocol itself have been found before, such as the BitForge issues disclosed in 2023.

Is an MPC wallet self-custodial?

It depends on the share setup. If you control enough shares to sign or recover without the provider, it behaves like self-custody. If the provider's share is always needed, you rely on that company to stay online and cooperate.

What is the difference between MPC and multisig?

Multisig uses several separate keys and is enforced on-chain by a smart contract or script, so the rules are public. MPC splits one key off-chain and produces a single ordinary signature, so it works on most chains but the policy is not visible on-chain.

What happens if an MPC wallet company shuts down?

That depends on its recovery design. Some providers let you export a full key or sign with your own shares; others do not. Check whether a documented exit path exists before you deposit meaningful funds.

Can I use an MPC wallet with DeFi apps?

Usually yes. Because MPC wallets produce standard signatures, most connect to apps through the same browser extensions or WalletConnect-style links as other wallets. Check that the wallet supports the chain you need.

Keep reading

• What is a multisig wallet?
• What is a seed phrase?
• Best self-custody wallets in 2026
• Non-custodial wallets explained
• Best Sui wallets in 2026

This article is educational and is not financial or security advice. Provider details are taken from each company's own pages and from news reports as checked on 12 October 2026, and may change. Sources include Fireblocks, Zengo, Binance, Coinbase, NIST and DL News.