MPC wallet development is the process of building a crypto wallet whose private key is never created in one place: key shares are generated on separate devices or servers, and a threshold of them, such as 2 of 3, jointly produce a normal signature. That removes the single point of failure of a seed phrase while keeping fees low and working on almost any blockchain. A production MPC wallet needs an audited threshold signature protocol, a policy engine, a recovery design and secure share storage.
Security risks keep growing. Chainalysis counted more than $3.4 billion in crypto stolen in 2025, with the February Bybit compromise alone accounting for $1.5 billion. That is why exchanges, custodians, fintech apps and consumer wallets increasingly use multi-party computation (MPC) to protect keys.
However, MPC is also widely misunderstood: it is not multisig, it does not stop a team from approving a bad transaction, and its security depends on who holds the shares. This guide explains how MPC wallets work, how they compare with multisig and smart accounts, the steps to build one, the providers and protocols to know, realistic costs, and the real incidents that show where MPC fails.
Key Takeaways
- No full key ever exists. An MPC wallet uses distributed key generation and threshold signatures, so no device, server or person ever holds the complete private key.
- One signature on-chain. Unlike multisig, MPC produces a single standard signature, which keeps fees low and works on Bitcoin, Ethereum, Solana and most other chains.
- Protocol choice matters. Use a current, audited protocol such as CGGMP21, DKLs23 or FROST; the 2023 BitForge flaws hit wallets running older GG18, GG20 and Lindell17 implementations.
- MPC protects keys, not decisions. A policy engine, clear signing and independent share holders are what stop insider theft and manipulated approvals.
- Build costs start at Pixel's wallet base. Pixel Web Solutions starts crypto wallet development from $5,000; MPC custody, policy engines and institutional governance add scope, typically 12 to 20 weeks for institutional builds.
What Is an MPC Wallet?
An MPC wallet is a crypto wallet that manages its private key with multi-party computation (MPC), a branch of cryptography that lets several parties compute a result together without revealing their secret inputs to each other. In a wallet, the "result" is a transaction signature, and the secret inputs are key shares.
Here is the key point most guides get wrong: an MPC wallet does not create a private key and then split it. Instead, the parties run distributed key generation (DKG), so each one creates its own share and the full key never exists anywhere, not even for a moment. When the wallet needs to sign, a threshold of shares (for example 2 of 3) runs a threshold signature scheme (TSS) and outputs one ordinary signature.
To the blockchain, an MPC wallet looks exactly like a single-key wallet. As a result, MPC wallets are used for:
- Consumer wallets without seed phrases, where one share sits on the phone and another with the provider or a cloud backup.
- Exchange and fintech custody, where shares are split across servers, hardware security modules (HSMs) and teams.
- Institutional treasuries and funds, with approval policies on top of the shares.
- Embedded wallets inside apps and games, where users sign in with email or passkeys.
For the wider landscape, see the guide to the types of crypto wallets.
How an MPC Wallet Works
An MPC wallet runs through four stages over its life:
- Distributed key generation (DKG): each party generates a secret share and exchanges commitments and zero-knowledge proofs. Together they derive one public key, and therefore one wallet address, without ever assembling the private key.
- Threshold signing: when a transaction is approved, at least t of n parties exchange messages and each produces a partial result. These combine into one valid ECDSA or EdDSA signature.
- Key refresh (proactive security): shares are re-randomised periodically while the address stays the same. Old shares become useless, so an attacker must steal enough shares within one refresh period.
- Recovery: if a device is lost, the remaining shares can re-issue a new share to a replacement device, again without rebuilding the full key.
The curve follows the chain: secp256k1 ECDSA for Bitcoin and EVM chains, ed25519 EdDSA for chains such as Solana, and Schnorr for Bitcoin Taproot.
MPC Is Not Shamir Secret Sharing
Shamir Secret Sharing (SSS) splits an existing key into pieces and reassembles the full key whenever it signs or recovers. That moment of reassembly is a single point of failure. TSS never reassembles the key. Some "MPC" products use SSS only for backup, which is acceptable, but ask any vendor exactly when, if ever, the full key exists.
MPC vs Multisig vs Smart Accounts
These three approaches all remove the single point of failure, but they work very differently. Many production wallets combine them.
| Factor | MPC (TSS) wallet | Multisig wallet | Smart account (account abstraction) |
|---|---|---|---|
| Where approval happens | Off-chain, between key share holders | On-chain, by the script or contract | On-chain, by contract code |
| Keys | Shares of one key; full key never exists | Several complete, independent keys | Any signer type, including passkeys, MPC or multisig |
| On-chain footprint | One normal signature | Several signatures, visible quorum | Contract wallet with custom rules |
| Fees | Same as a normal wallet | Higher, more signatures to verify | Higher than a basic wallet, can be sponsored |
| Chain support | Almost any chain | Native on Bitcoin; smart contracts on EVM and others | Mostly EVM chains (ERC-4337, EIP-7702) |
| Change signers | Refresh or re-share, same address | Usually update the contract or create a new wallet | Update rules in the contract |
| Transparency | Policy is off-chain and private | Quorum is public and auditable | Rules are public and auditable |
| Main risk | Weak protocol implementation or concentrated share holders | Signers approving a manipulated transaction | Smart contract bugs |
| Best for | Exchanges, fintechs, multi-chain custody, seedless consumer wallets | DAO treasuries, public funds | Mainstream apps, gasless UX, spending limits |
If on-chain auditability matters most, as it does for a DAO treasury, multisig is often the better fit. The guide to multi-signature wallet development covers that model. If you need many chains, private policies and normal fees, MPC wins. For consumer apps, a smart account with an MPC or passkey signer underneath gives the best experience.
MPC Protocols to Know in 2026
The protocol is the core of an MPC wallet. Here are the main families:
| Protocol | Signature type | Notes |
|---|---|---|
| GG18 / GG20 | Threshold ECDSA | Widely deployed early protocols; older implementations were exposed by the BitForge flaws (CVE-2023-33241) when zero-knowledge proofs were missing or weak |
| Lindell17 | Two-party ECDSA | Simple two-party design; some implementations were also affected by BitForge |
| CGGMP21 | Threshold ECDSA | UC-secure, non-interactive signing with identifiable aborts and built-in key refresh |
| DKLs (DKLs19, DKLs23) | Threshold ECDSA | Oblivious-transfer based; DKLs23 signs in three rounds |
| FROST | Threshold Schnorr and EdDSA | Standardised by the IETF as RFC 9591 in 2024; suits Taproot and ed25519 chains |
Standards bodies are catching up too: NIST runs a multi-party threshold cryptography project to evaluate threshold schemes. For a new build, choose a maintained, audited library, such as Coinbase's open-source cb-mpc, rather than writing cryptography from scratch.
MPC Wallet Development: 8 Steps to Build Your Wallet
Here are the eight steps to develop an MPC wallet for your use case.
1. Requirement Gathering
Define the wallet's purpose, users and custody model. Decide the threshold (2 of 2, 2 of 3, 3 of 5), who holds each share, the chains you need, recovery expectations and approval policies. Be clear on integration needs with exchanges, payment systems or DeFi.
2. Conceptualization and Tech Stack Selection
Choose the protocol and library, then the stack. A common setup is Rust or Go for the cryptography core, WebAssembly for browsers, native bindings for iOS and Android, a Node.js, Go or Rust relay backend over WebSockets, and cloud KMS, HSMs or trusted execution environments (TEEs) for server-side shares.
3. UI/UX Design
Design an interface for seamless wallet operations: sign-in, balances, sending, approvals and recovery. For institutional wallets, design the approval queue so every approver sees exactly what they are signing.
4. Core Wallet Development
Build the wallet's core features and add-on modules: blockchain integrations, transaction building, fee estimation, address book, notifications and the admin console. Where you use smart accounts on EVM chains, this is also where contract integration happens.
5. Implementing MPC Technology
Implementing MPC follows three stages:
- Distributed key generation: each party creates its own share and the group derives the wallet's public key. No master key is ever created.
- Share distribution and storage: shares are stored on the user's device (secure enclave or Android Keystore), on the provider's servers (HSM or TEE) and in an encrypted backup, according to your threshold design.
- Threshold signing: when a transaction is approved, the required shares jointly produce the signature. Wallet access to funds is enabled only through this process.
Add key refresh on a schedule and after any suspected compromise.
6. Policy Engine and Security Features
MPC protects the key, but a policy engine protects the decision to sign. Add transaction limits, address whitelists, time locks on large transfers, role-based approvals and clear-signing screens. Then add advanced encryption, multi-factor and biometric authentication, device attestation and anomaly monitoring.
7. Testing and Security Auditing
Test performance, failure cases (a party offline mid-signing, a corrupted share, network partitions) and recovery. Commission an independent audit of both the cryptographic library integration and the wallet code before launch.
8. Deployment and Maintenance
Deploy to production with monitoring, alerting and incident runbooks. Keep libraries patched, refresh shares regularly, and re-audit after any change to key or signing code. The wallet should be upgradable as your business and the threat landscape change.
These eight steps give you a secure MPC wallet. Next, here are the features that set MPC wallets apart.
Key Features of an MPC Wallet
These features highlight the difference between MPC wallets and traditional crypto wallets.
Distributed Key Management: Key shares are generated and stored separately, so no single breach of a device or server exposes the key.
Threshold Transaction Signing: A set number of shares must cooperate to sign, which makes every transaction subject to the wallet's approval rules.
Seedless Account Recovery: MPC wallets can recover access without a seed phrase. For instance, Zengo's recovery kit combines email authentication with a recovery file stored in the user's cloud, with an optional 3D face lock as an extra factor.
User-Friendliness: The interface works like any other crypto wallet, so users get stronger security without extra steps.
DeFi Integration: MPC wallets can sign any transaction a normal wallet can, so they connect to DeFi apps for trading, lending and staking, often through WalletConnect.
Multi-Chain Support: Because the output is a standard signature, one MPC system can support Bitcoin, EVM chains, Solana and others from the same key infrastructure.
Signer Rotation Without New Addresses: Shares can be refreshed or reassigned when staff or devices change, while the wallet address stays the same.
Benefits of MPC Crypto Wallet Development
Here are the main benefits of developing an MPC wallet for your business:
- Strong security and control in asset management, with no single point of failure.
- Higher user trust, thanks to seedless onboarding and reliable recovery.
- Lower on-chain fees than multisig, because only one signature is published.
- Support for almost any blockchain from a single key infrastructure.
- Flexible governance, with approval policies that can change without moving funds.
- An architecture that suits regulated custody, where controls and audit trails are required.
- Additional revenue from premium custody, recovery or institutional features.
- Scalable infrastructure that adapts to consumer, business and institutional use cases.
These benefits make MPC a strong fit for startups planning to build a cryptocurrency wallet app business, as well as for exchanges and fintechs adding custody.
Real-World Use Cases of MPC Wallets
Here are the main use cases, with examples of how MPC is used today.
Institutional Asset Management and Custody: Institutional investors and custodians use MPC to split control across teams, servers and HSMs. Fireblocks, for example, runs MPC-based custody infrastructure for exchanges and funds.
Consumer Seedless Wallets: Zengo pioneered a two-party MPC wallet with no seed phrase, and many consumer apps now use the same model so users never have to write down 24 words.
Embedded Wallets in Apps: Wallet infrastructure such as MetaMask Embedded Wallets (formerly Web3Auth) uses threshold ECDSA and EdDSA so users of games and fintech apps sign in with email or social logins.
Exchange Hot and Warm Wallets: Crypto exchanges use MPC to sign withdrawals automatically within policy limits, while keeping shares split across separate systems.
Treasury Management: Businesses use MPC with approval policies to manage treasury funds. DAOs, by contrast, often prefer on-chain multisig, such as Safe, because its quorum is publicly auditable; Safe is a smart contract multisig, not MPC.
Cross-Chain Infrastructure: Bridges and payment networks have used MPC to control funds across many chains, although, as the next section shows, this is also where MPC's biggest failure happened.
MPC Wallet Infrastructure Options
Businesses can build on their own MPC library or use wallet infrastructure. Common names in 2026 include Fireblocks, Coinbase (with its open-source cb-mpc library), Zengo, MetaMask Embedded Wallets, Privy (acquired by Stripe in June 2025), Cobo, Safeheron and Dfns. Older lists still mention Qredo, which entered administration in February 2024.
Where MPC Wallets Actually Fail: Lessons From Real Incidents
MPC is strong cryptography, but real losses show three ways it can fail. No competitor guide covers these together, and each one maps to a design decision.
| Incident | What happened | Failure type | Design lesson |
|---|---|---|---|
| Multichain, July 2023 | More than $125 million was withdrawn from the Multichain bridge, whose contracts were controlled by MPC keys; the team later said it lost access after its CEO was detained | Concentrated share holders | MPC is only as decentralised as the people and machines holding shares. Put shares under independent control |
| BitForge, disclosed August 2023 | Researchers showed that flawed GG18, GG20 and Lindell17 implementations could leak the full key after repeated signing; most affected vendors patched after disclosure | Implementation flaw | Use audited, current protocols with full zero-knowledge proofs, and track library advisories |
| Bybit, February 2025 | About $1.5 billion stolen from a cold multisig wallet after signers approved a transaction hidden by a compromised interface | Manipulated approval | Any threshold scheme, MPC or multisig, needs clear signing, independent verification and policy limits |
The lesson: MPC removes key theft from a single device, but it does not remove insider risk or approval risk. Design for all three.
Worked Example: Designing a 2-of-3 MPC Wallet
A 2-of-3 threshold is the most common design for consumer and business wallets. Here is what happens when each share is lost or stolen, which is the analysis every MPC build should do before writing code.
Shares: A on the user's phone (secure enclave), B on the provider's server (HSM or TEE), C in an encrypted backup the user controls (for example, cloud storage protected by a passkey).
| Event | Can the wallet still sign? | Can an attacker sign? | Action |
|---|---|---|---|
| Phone lost (A gone) | Yes, B + C | No, one share is not enough | Use B + C to issue a new share to the new phone, then refresh |
| Phone stolen and unlocked (A stolen) | Yes | Only if they also get B or C; B can refuse via policy | Freeze B's co-signing, recover with B + C, refresh |
| Provider server breached (B stolen) | Yes, A + C | Not alone | Refresh all shares; the old B becomes useless |
| Provider goes out of business (B gone) | Yes, A + C | No | User exports or migrates using A + C, which is why C must be user-controlled |
| Backup and phone both lost (A and C gone) | No, only one share left | No | Funds are locked; this is why two shares must never share a failure point |
This table shows two design rules. First, the backup share (C) must not depend on the provider, or provider failure becomes fund loss. Second, no two shares should share a weakness, such as the same cloud account or the same staff member.
How Much Does MPC Wallet Development Cost?
Pixel Web Solutions starts crypto wallet development from $5,000 for a single-platform non-custodial wallet, and white-label wallets from about $4,500. MPC adds scope on top of that base: the cryptography library integration, share storage, recovery flows, a policy engine, and an independent audit. The crypto wallet development cost guide explains the wider pricing factors.
Based on Pixel Web Solutions' published delivery timelines:
| MPC wallet type | Typical build time |
|---|---|
| Embedded wallet SDK integrated into an existing app | 4 to 8 weeks |
| Consumer mobile MPC wallet | 6 to 12 weeks |
| Multi-chain MPC wallet | 10 to 16 weeks |
| Institutional custody wallet with MPC or multisig governance | 12 to 20 weeks |
The biggest cost drivers are:
- Build vs buy: integrating an existing MPC SDK is faster and cheaper upfront but adds per-wallet or per-transaction fees; running your own library avoids vendor fees but needs cryptography expertise and audits.
- Number of chains and curves: each chain adds transaction building, indexing and testing.
- Policy and governance depth: role-based approvals, limits and audit trails for institutions.
- Audits: budget for an independent review of the MPC integration and wallet code, and repeat it after major changes.
- Running costs: HSM or TEE hosting, node and RPC infrastructure, monitoring and share refresh operations, all monthly.
Regulatory Checklist for Custodial MPC Wallets
If your MPC wallet holds or controls a share that can move customer funds, regulators may treat you as a custodian. Check these before launch:
- UAE (Dubai): VARA licenses custody services for virtual assets; Abu Dhabi Global Market firms fall under the ADGM FSRA.
- European Union: custody and administration of crypto-assets is a licensed service under MiCA, which has applied in full since 30 December 2024.
- United States: custodial wallet operators generally need FinCEN MSB registration and state licences, or a trust charter for institutional custody.
- Everywhere: Travel Rule data for transfers, KYC for custodial users, and documented key ceremonies and access controls for audits.
A 2-of-2 or 2-of-3 design where the provider's share can never move funds alone can strengthen the case that a wallet is non-custodial, but get legal advice for your structure.
Why Choose Pixel Web Solutions for MPC Wallet Development?
Pixel Web Solutions is a crypto wallet development company that builds custodial, non-custodial and MPC wallets for mobile, web and browser, with 12+ years of experience in cryptocurrency and blockchain development. Its team designs threshold schemes, share storage on secure enclaves and HSMs, policy engines and recovery flows, and it also delivers DeFi wallet development and white-label crypto wallets for faster launches.
From ideation to a complete MPC wallet, Pixel's process covers tech stack selection, protocol choice, security audits and post-launch support. Planning MPC wallet development? Talk to Pixel Web Solutions for a threshold design review and a scoped estimate.
Frequently Asked Questions
What is an MPC wallet?
An MPC wallet is a crypto wallet that uses multi-party computation to split control of the private key into shares held by different parties. A threshold of shares jointly signs transactions, and the full private key never exists in one place.
Is an MPC wallet more secure than multisig?
Neither is strictly more secure. MPC hides the approval policy off-chain, keeps fees low and works on almost any chain, while multisig makes the quorum public and auditable on-chain. MPC depends on a correct protocol implementation; multisig depends on smart contract or script security. Both need clear signing to stop manipulated approvals.
What happens if a user loses a key share?
In a 2-of-3 design, the remaining two shares can still sign and can issue a new share to a replacement device, after which all shares are refreshed. If too many shares are lost to meet the threshold, the funds are locked, so the backup share must be stored independently.
Is an MPC signature visible on-chain?
No. An MPC wallet produces one standard signature, so its transactions look the same as any single-key wallet's. This improves privacy and lowers fees, but means outsiders cannot audit the approval policy on-chain.
Does an MPC wallet work on Bitcoin and Solana?
Yes. Threshold ECDSA covers Bitcoin and EVM chains, threshold EdDSA covers ed25519 chains such as Solana, and FROST covers Schnorr signatures for Bitcoin Taproot.
How long does MPC wallet development take?
An embedded MPC wallet SDK can be integrated in 4 to 8 weeks, a consumer mobile MPC wallet takes 6 to 12 weeks, and an institutional custody wallet with governance takes 12 to 20 weeks, based on Pixel Web Solutions' delivery timelines. Plan extra time for audits and recovery testing.
Can I build an MPC wallet without writing my own cryptography?
Yes, and you should. Use an audited open-source library or a wallet infrastructure SDK, and focus your engineering on share storage, policy, recovery and user experience.
