Custody Approaches
Custody Comparison
Multi-Party Computation is often marketed as the modern replacement for — a single, invisible signature produced by a threshold of participants. That elegance hides real trade-offs. Below are some concerns institutional custody teams should understand before choosing MPC over on-chain multisig.
What MPC is
MPC wallets are controlled by cryptographic shares held by different parties. In modern threshold-signature designs, each share is generated independently — the whole never exists in one place, even during setup. When a transaction is signed, the parties run a threshold protocol that produces one ordinary-looking signature.
How multisig differs
On-chain multisig uses several independent keys. The blockchain itself enforces the M-of-N rule: every approval is a distinct on-chain signature, publicly verifiable, with no external coordination service, share holder or vendor able to bypass it.
Private key exposure during some recovery models
Certain disaster-recovery and export designs may reconstruct a complete private key. If this happens, MPC's normal distributed-security advantage temporarily collapses into protecting a single secret.
Why it matters
Recovery / wrench attack
If recovery can ultimately produce a usable private key, attackers can target or coerce the people capable of authorizing recovery rather than attacking the MPC cryptography itself. Recovery generally shifts or introduces trust and can create new abuse paths.
Why it matters
Complex cryptographic implementation
Threshold signing protocols are considerably more complex than conventional signing. Protocol, implementation, state-management and integration errors can create vulnerabilities even when the underlying cryptographic primitives are secure.
Why it matters
Off-chain governance
The blockchain normally sees a standard valid signature rather than the internal MPC approval process. It therefore cannot independently prove that a particular internal M-of-N organizational approval policy was followed. MPC's off-chain nature is a fundamental architectural characteristic.
Why it matters
Policy-engine compromise
Spending limits, whitelists, approval rules and user permissions may exist outside the threshold cryptography. Compromising the surrounding authorization or transaction-building layer can therefore become an important attack path without directly breaking MPC.
Why it matters
Vendor / infrastructure dependency
Signing can depend upon coordinating infrastructure, share availability, authentication services and other systems. Third-party dependency and availability risk therefore remain even though the private key itself is distributed.
Why it matters
Quorum availability risk
Enough MPC participants must be available to perform threshold operations. Lost devices, unavailable shares, network problems or infrastructure outages can interrupt signing or recovery. Older threshold schemes can require a protocol restart when a participant faults; newer robust schemes tolerate it better.
Why it matters
Recovery infrastructure becomes a high-value target
Backup shares, recovery packages, authentication mechanisms and recovery administrators become another security perimeter. Improving recoverability can simultaneously introduce new attack paths.
Why it matters
Insider / collusion risk remains
MPC protects against fewer than the required threshold of compromised participants, but once enough authorized parties or their environments are compromised, the threshold can be satisfied. The quality of organizational separation therefore matters as much as the mathematical threshold.
Why it matters
Greater operational and audit complexity
DKG, distributed shares, share refresh, secure communications, recovery, device enrollment and threshold signing create a relatively large operational surface that must be correctly implemented, monitored and audited.
Why it matters
The other side
Multisig has its own trade-offs
No custody architecture is free. Below are the honest limitations of on-chain multisig — the trade-offs Trustodian designs around, rather than pretends don't exist.
Signer loss can cause permanent lockout
In a 3-of-5 wallet, losing access to 3 signer keys makes the assets inaccessible unless individual signer recovery mechanisms exist.
Why it matters
Threshold collusion
If enough signers cooperate maliciously, they can authorize a transaction. A 3-of-5 wallet is compromised if an attacker controls or coerces 3 signers.
Why it matters
Wrench / coercion attacks
Multisig does not eliminate physical coercion. An attacker can target multiple signers until the required threshold is reached. Geographic and organizational separation are important.
Why it matters
Signer private keys still exist
Unlike MPC, each multisig participant normally has an actual private key. Malware, phishing, device compromise or poor backup practices can expose an individual signer key.
Why it matters
Heavier key-management surface
Organizations must securely manage several independent signer keys, devices, backups, replacements and recovery procedures rather than distributed shares of one signing key.
Why it matters
Blockchain support varies
Multisig implementation differs significantly between Bitcoin, EVM, Solana, Tron and other chains. Some provide native mechanisms while others require smart contracts or chain-specific implementations.
Why it matters
Smart-contract risk
Contract-based multisig introduces another attack surface. A vulnerability in the multisig contract, module, upgrade mechanism or integration could potentially affect the entire vault.
Why it matters
Higher transaction costs
On-chain multisig can consume more blockchain resources than a standard single-signature transaction, potentially increasing network fees — although the impact varies considerably by chain and implementation.
Why it matters
Reduced privacy / visible governance
On-chain multisig can expose information about the wallet's control structure, contract and sometimes signer activity. The transparency that improves auditability can therefore reduce privacy.
Why it matters
Changing signers can be operationally cumbersome
Adding or removing signers, or changing a threshold, may require an on-chain transaction, contract operation or even migration to a new wallet depending on the blockchain architecture.
Why it matters
Recovery Scenarios
Who really controls the funds when things go wrong?
MPC's distributed-security guarantee is strongest during normal signing. Under different recovery paths, the answer to "is a full private key ever reconstructed?" changes — and so does who can ultimately move the money.
| Scenario | What happens | Full PK created? | One person can control funds? |
|---|---|---|---|
| Normal MPC signing | Threshold parties jointly sign | No | No |
| Lost MPC share / soft recovery | Shares are refreshed or replaced using the threshold protocol | No | Usually No |
| MPC disaster recovery | Threshold / recovery parties authorize recovery | Depends on design | Depends |
High Risk Vendor unavailable / hard recovery | Recovery material may reconstruct or export the wallet's full private key | Yes, in some designs | Yes, after reconstruction |
Trustodian On-chain multisig recovery | Individual signer keys are recovered — the vault itself is unchanged | No master vault PK | No, unless enough signer keys are recovered |
Normal MPC signing
Threshold parties jointly sign
Full PK
No
One-person control?
No
Lost MPC share / soft recovery
Shares are refreshed or replaced using the threshold protocol
Full PK
No
One-person control?
Usually No
MPC disaster recovery
Threshold / recovery parties authorize recovery
Full PK
Depends on design
One-person control?
Depends
Vendor unavailable / hard recovery
Recovery material may reconstruct or export the wallet's full private key
Full PK
Yes, in some designs
One-person control?
Yes, after reconstruction
On-chain multisig recovery
Individual signer keys are recovered — the vault itself is unchanged
Full PK
No master vault PK
One-person control?
No, unless enough signer keys are recovered
Deep dive
How Trustodian Multisig compares to MPC and hardware wallets
Four expandable tables — a high-level custody snapshot, a full feature-by-feature breakdown, twenty-four distributed-control failure modes, and hardware-wallet signing configurations. All are collapsed by default so the page reads cleanly; open whichever you want to read.
The Trustodian approach
On-chain multisig — because the blockchain itself is the auditor
Trustodian's vaults are on-chain multisig accounts on every chain we support — native P2SH / P2WSH script multisig derived under BIP-48 on Bitcoin, native on XRP and Cardano; battle-tested smart-contract multisig (Safe on EVM, Squads on Solana) elsewhere. Either way, the network itself validates the approval. There is no MPC coordinator, no share-refresh cycle, no off-chain policy engine whose compromise moves funds — just standard, verifiable, on-chain cryptography.
MPC and Multisig remain legitimate tools for specific institutional use cases. The points above are trade-offs, not a rejection — every custody architecture makes them somewhere. Multisig makes them on-chain and in the open.