Case Studies
MPC Attacks in the Wild
Documented MPC and TSS compromises, including cases where a single malicious participant was able to extract a complete wallet . Real incidents, real losses.
Incidents
9
Confirmed thefts
3
Confirmed losses
>$140M
$7.9M · $125M · $10.7M
Period
2021 – 2026
| Year | Incident | MPC technology | Actual theft? | What was compromised | How it worked | Impact |
|---|---|---|---|---|---|---|
| 2021 | Multichain / Anyswap V3 | MPC/TSS ECDSA | Yes | Full private key derived | Two MPC-generated ECDSA signatures reused the same R value / nonce condition. The attacker mathematically derived the private key from the signatures. The project reproduced the attack. | ~$7.9M |
| 2021 | Alpha-Rays | GG18 / GG20 threshold ECDSA | Vulnerability | Full PK extraction possible | A malicious MPC participant could exploit weaknesses in implementations of threshold ECDSA and recover key material. The research demonstrated complete breaks of affected GG18/GG20 implementations. | Critical vulnerability |
| 2023 | BitGo Zero Proof | GG18-based TSS | Vulnerability | Full PK extraction possible | A critical zero-knowledge proof was missing from the implementation. A malicious participant could exploit the protocol and derive the complete private key. Researchers reported extraction could be achieved very quickly. | Critical; patched |
| 2023 | BitForge — GG18 / GG20 | GG18 / GG20 MPC | Vulnerability | Full PK extraction possible | MPC participants failed to properly validate the attacker's Paillier modulus. A malicious participant could exploit this during signing and eventually recover the wallet's complete private key. | 10+ wallets / libraries identified as vulnerable |
| 2023 | TSSHOCK — α-shuffle | Threshold ECDSA | Vulnerability | Full PK extraction | Ambiguous encoding in zero-knowledge-proof transcripts allowed a malicious MPC participant to manipulate protocol challenges and extract the key. | Multiple implementations affected |
| 2023 | TSSHOCK — c-guess | GG18/GG20-derived TSS | Vulnerability | Full PK extraction | A performance optimization reduced security iterations dramatically. A malicious node could exploit the weakened proof and recover private-key material. | Critical |
| 2023 | TSSHOCK — c-split | Threshold ECDSA | Vulnerability | Full PK extraction | Another flaw in threshold-ECDSA proof / implementation logic enabled a malicious participant to recover the complete secret. | Multiple libraries affected |
| 2023 | Multichain collapse | MPC custody infrastructure | Yes / control failure | MPC infrastructure / key control | Critical MPC node infrastructure was effectively concentrated under the CEO's cloud / device control. After his detention, the organization lost access; subsequent unauthorized withdrawals exceeded $125M. The exact mechanism of the withdrawals was not conclusively established publicly, so this should not be described as a proven cryptographic MPC break. | >$125M |
| 2026 | THORChain Asgard Vault | GG20 TSS/MPC | Yes | Full vault private key reconstructed | A malicious validator participated in legitimate GG20 signing rounds. Several weaknesses allowed progressive leakage of key material. The attacker reconstructed the vault's complete private key, then bypassed the threshold-signing system entirely and directly signed withdrawals. | ~$10.7M |
Multichain / Anyswap V3
MPC/TSS ECDSA
Compromised
Full private key derived
Impact
~$7.9M
How it worked
Two MPC-generated ECDSA signatures reused the same R value / nonce condition. The attacker mathematically derived the private key from the signatures. The project reproduced the attack.
Alpha-Rays
GG18 / GG20 threshold ECDSA
Compromised
Full PK extraction possible
Impact
Critical vulnerability
How it worked
A malicious MPC participant could exploit weaknesses in implementations of threshold ECDSA and recover key material. The research demonstrated complete breaks of affected GG18/GG20 implementations.
BitGo Zero Proof
GG18-based TSS
Compromised
Full PK extraction possible
Impact
Critical; patched
How it worked
A critical zero-knowledge proof was missing from the implementation. A malicious participant could exploit the protocol and derive the complete private key. Researchers reported extraction could be achieved very quickly.
BitForge — GG18 / GG20
GG18 / GG20 MPC
Compromised
Full PK extraction possible
Impact
10+ wallets / libraries identified as vulnerable
How it worked
MPC participants failed to properly validate the attacker's Paillier modulus. A malicious participant could exploit this during signing and eventually recover the wallet's complete private key.
TSSHOCK — α-shuffle
Threshold ECDSA
Compromised
Full PK extraction
Impact
Multiple implementations affected
How it worked
Ambiguous encoding in zero-knowledge-proof transcripts allowed a malicious MPC participant to manipulate protocol challenges and extract the key.
TSSHOCK — c-guess
GG18/GG20-derived TSS
Compromised
Full PK extraction
Impact
Critical
How it worked
A performance optimization reduced security iterations dramatically. A malicious node could exploit the weakened proof and recover private-key material.
TSSHOCK — c-split
Threshold ECDSA
Compromised
Full PK extraction
Impact
Multiple libraries affected
How it worked
Another flaw in threshold-ECDSA proof / implementation logic enabled a malicious participant to recover the complete secret.
Multichain collapse
MPC custody infrastructure
Compromised
MPC infrastructure / key control
Impact
>$125M
How it worked
Critical MPC node infrastructure was effectively concentrated under the CEO's cloud / device control. After his detention, the organization lost access; subsequent unauthorized withdrawals exceeded $125M. The exact mechanism of the withdrawals was not conclusively established publicly, so this should not be described as a proven cryptographic MPC break.
THORChain Asgard Vault
GG20 TSS/MPC
Compromised
Full vault private key reconstructed
Impact
~$10.7M
How it worked
A malicious validator participated in legitimate GG20 signing rounds. Several weaknesses allowed progressive leakage of key material. The attacker reconstructed the vault's complete private key, then bypassed the threshold-signing system entirely and directly signed withdrawals.
What the pattern shows
The recurring failure mode is one malicious participant extracting the whole key.
Across GG18, GG20 and their derivatives, the common thread is not classical cryptanalysis but a family of protocol / implementation flaws — nonce reuse, missing zero-knowledge proofs, weakened iteration counts, transcript ambiguity, missing Paillier-modulus validation — where a single participant deviating from the honest protocol can progressively leak enough state to reconstruct the wallet's whole private key. When that happens, threshold is not merely bypassed — it is retired: the attacker signs unilaterally, as a single-sig wallet would.
On-chain sidesteps this class of failure by construction: there is no single wallet private key to reconstruct. Each signer's key is an independent secret, and the M-of-N rule is enforced by the chain rather than by the correctness of a threshold protocol.
Incidents are compiled from public disclosures, post-mortems and security-research publications. Impact figures reflect reported losses at the time of the event and may be revised as investigations continue. Where an attack mechanism remained publicly unconfirmed, we say so.