MPC vs multisig for crypto exchanges: approvals, recovery and withdrawal operations

Multisig and MPC both stop one stolen key from emptying a wallet, as long as the threshold is set above one and nobody can route around it, but they put the rule in different places. Multisig puts it on the blockchain: a transaction is valid only with M signatures from N separate keys. MPC splits one key into shares and the signing protocol needs a threshold of them, so the chain sees an ordinary single-key wallet, and the business rules (who must approve what) live in the MPC platform’s policy engine.

For an exchange, the signature scheme is often not what decides the outcome. Three well-documented exchange losses of 2024 and 2025, at Bybit, DMM Bitcoin and WazirX, were not reported as cryptographic breaks: the attacks targeted what was being signed, or who was asking.

We build custody software that has run in production at the EX5 exchange since 2024. It uses a third model, an M-of-N policy inside the application, so this guide compares all three, then covers the custody choices around them: your own software, a custody provider or MPC wallet-as-a-service.

What is the difference between MPC and multisig?

On-chain multisig

A multisig wallet is defined on the chain. Each signer holds a complete private key, and the network checks that enough of them signed before it accepts a transaction.

• Bitcoin has had M-of-N conditions in script (OP_CHECKMULTISIG) since its early versions; pay-to-script-hash (BIP 16), active since April 2012, made them usable through ordinary addresses. Litecoin and Dogecoin, built from Bitcoin’s code, ship the same createmultisig call.
• EVM chains have no multisig in the protocol, so it is a smart contract. Safe is the common one, with owners, a threshold, and optional modules and guards. Safe deployments and features differ by network, so check the ones you need.
• TRON and the XRP Ledger build it into accounts, each with its own rules.

The rule is public and enforced by the network, so an auditor can read it and no server can override it. The costs are separate engineering per chain, higher fees, and signer changes that are themselves on-chain transactions.

MPC and threshold signatures

In MPC custody generated with distributed key generation, the private key is never assembled in one place. Several parties (servers, a phone, an HSM, a vendor’s co-signer) each hold a share, and a threshold of them run a protocol that produces one normal ECDSA or EdDSA signature. These are threshold signature schemes (TSS); BitGo, for example, says its MPC implementation is TSS.

To the chain, an MPC wallet is one address with one signature. So one stack covers most chains, a transaction costs the same as any single-key transfer, and shares can be refreshed without moving funds to a new address (the protocol behind Fireblocks’ MPC-CMP includes a periodic refresh).

The cost is complexity. The protocols are intricate and implemented by relatively few teams; NIST finalised its first call for threshold scheme submissions only in January 2026. And the business policy deciding who must approve what runs in the platform’s software, separately from the cryptographic threshold, so check that no administrator or alternative signing path can bypass it.

The third option: an approval policy in your own software

Many exchange withdrawals are approved neither on-chain nor inside an MPC protocol. The exchange’s own system checks the policy (amount bands, whitelists, delays, how many officers approved) and only then signs with a key held in a keystore or HSM. This is application-level M-of-N.

It works the same on every chain, costs no more than a single-key transfer, and the policy can be as detailed as your risk team wants. Its weakness is that each wallet’s key exists whole in the keystore or HSM, so safety depends on isolating that key and on a policy engine that cannot be bypassed. Ledger Enterprise takes a related approach, enforcing governance rules inside an HSM.

The models combine: an MPC wallet still needs an approval policy, and cold reserves can sit in on-chain multisig while hot wallets run on MPC or an application policy.

MPC vs multisig vs application-level approvals

	On-chain multisig	MPC / TSS	Application-level M-of-N
Where the quorum is enforced	The blockchain	The signing protocol (threshold); business rules in the platform’s policy engine	Your custody software, before it signs
Keys	Separate keys, one per signer	Shares; with distributed key generation the full key is never assembled	One key per wallet, in a keystore or HSM
Chain coverage	A different mechanism per chain	Chains whose signature algorithm the platform supports	Every chain the software integrates
Transaction cost	Usually higher: extra signatures or a contract call	Same as a single-key transfer	Same as a single-key transfer
Replacing a signer	An on-chain change; on Bitcoin, a new address	Reshare, if the product supports it; address unchanged	Update the approver list; address unchanged
What the chain shows	Threshold and signer set	One address	One address; evidence is your audit log
Typical failure modes	Signers approving a tampered transaction	Implementation flaws; shares concentrated in one place	Weak key isolation; a bypass of the policy engine
Vendor dependence	Low; the script or contract is public	High without a tested key export	Low if self-hosted, especially with source code
Typical use, in our experience	Cold reserves, treasury	Hot and warm wallets on many chains	Hot and warm withdrawals, sweeps, refills

Which chains support native multisig?

For an exchange with many chains, this is where multisig costs the most engineering time. The nine chains our custody software supports:

Chain	Native multisig	Notes
Bitcoin, Litecoin, Dogecoin	Script multisig	On Bitcoin, MuSig2 (BIP 327) aggregates the keys of an n-of-n group into one key, so a Taproot output using it looks like a single signer’s
Ethereum, BNB Smart Chain, Avalanche C-Chain	No; a contract such as Safe, deployed on all three	Execution and signer changes are contract calls that cost gas
TRON	Account permissions: owner and up to 8 active permissions, up to 5 keys each, weighted threshold	Updating permissions currently costs 100 TRX and a transaction with two or more signatures pays 1 TRX extra; both are governance parameters that can change
XRP Ledger	Signer list of 1 to 32 addresses with weights and a quorum	Fee is at least (N+1) times normal for N signatures
Solana	Program-based multisig, such as Squads	The SPL Token program separately supports multisig authorities with up to 11 signers

Five mechanisms for nine chains, each with its own tooling, fees and failure modes. In our experience, that is why exchanges with long chain lists often run daily wallets on MPC or an application policy and keep multisig for a few large cold wallets.

What do the big custody incidents show?

Chainalysis counted more than $3.4 billion of crypto stolen in 2025 up to early December, $1.5 billion of it from Bybit, and said centralized services were losing ever larger sums to attacks on private key infrastructure and signing processes. In the cases below, the reports point at the signing workflow, the infrastructure around it or an implementation flaw, not at the underlying mathematics.

• Bybit, 21 February 2025. According to Safe’s investigation, attackers compromised a Safe{Wallet} developer’s laptop and injected malicious JavaScript into the Safe web app. During a routine transfer from Bybit’s ETH multisig cold wallet to its warm wallet, signers saw the expected destination but signed a delegatecall that replaced the wallet contract’s logic. More than 401,000 ETH left; the FBI put the theft at about $1.5 billion and attributed it to North Korea’s TraderTraitor. NCC Group found the signers’ devices showed unreadable data, so they effectively signed blind.
• WazirX, 18 July 2024. About $235 million left a 4-of-6 Safe multisig: five keys at WazirX, one at Liminal, whose platform also enforced the address whitelist. The approved transaction switched the wallet to an attacker’s contract. WazirX’s preliminary review pointed to a mismatch between Liminal’s interface and what was signed; Liminal disputed this and said its platform remained secure, so there is no agreed root cause.
• DMM Bitcoin, May 2024. 4,502.9 BTC, worth $308 million at the time, was stolen. According to the FBI and Japan’s National Police Agency, TraderTraitor posed as a recruiter to compromise an employee of Ginco, DMM’s wallet software provider, then manipulated a legitimate transaction request from a DMM employee.
• BitForge, August 2023. Fireblocks disclosed flaws in implementations of the GG18, GG20 and Lindell17 threshold signature protocols at more than 15 wallet providers, blockchains and open-source projects. In some GG18 and GG20 implementations, a malicious signing participant could extract the full key after as few as 16 signing sessions. Fireblocks reported no known exploitation at the time.
• Multichain, July 2023. The bridge used MPC, but according to the team’s statement as reported by Odaily, the MPC node servers ran under the CEO’s personal cloud account. After he was detained, the team could not reach them, and more than $125 million left in unauthorised withdrawals.

Three lessons:

1. A quorum sets how many keys an attacker needs, not whether the right transaction gets signed. Check the transaction itself, on devices that show destination, amount and operation type.
2. Your vendor’s laptops are part of your attack surface. At Bybit and DMM, the way in ran through the wallet software provider.
3. Distribution has to be real. Keys or shares that depend on one person, one cloud account or one interface are a quorum on paper only.

How should withdrawal approvals work at an exchange?

Every scheme leads to the same flow: request, risk checks, approval, signing, broadcast, confirmation, reconciliation. Most withdrawals need no person at all; the question is which ones do.

• Hot pays withdrawals automatically, within a target balance and a ceiling per asset. Above the ceiling, funds sweep to warm or cold.
• Warm refills hot after an operator approves.
• Cold holds most reserves and moves only with the full quorum and a time lock.

For moves that need approval, our custody software’s defaults by amount band are:

Band	Approval
Below a floor	1 of 3 officers
Middle	2 of 3 officers
Above a threshold	3 of 5 officers, plus a delay
Cold wallet moves	Full quorum, plus a time lock

On top of that, new withdrawal addresses wait 24 hours before use, and daily caps apply per asset and per customer tier.

Rules worth adopting whatever scheme you choose:

• Approve on a device that shows destination, amount and operation, not only a hash. If the signing device shows only a hash, decode the exact payload on an independent machine and check destination, asset, amount, chain and operation before approving; matching hashes alone do not prove intent.
• Keep approvers apart: separate devices and networks, and nobody who can both create and approve a transaction.
• Refuse what a wallet never needs. A cold wallet that only sends to your warm wallet should not be able to sign a contract upgrade; on EVM chains a Safe guard can help enforce that, tested together with any modules on the same Safe.
• Put automation behind explicit switches and a daily value cap.
• Reconcile the ledger against the chain continuously. We covered deposit-side checks in why USDT deposits get stuck.

Recovery: what happens when a key, a share or a person is lost?

Plan for three events: a lost key or device, a lost approver, and a lost site or vendor.

• On-chain multisig. The remaining quorum replaces the lost signer: an owner change on Safe, a permission update on TRON, a new signer list on the XRP Ledger. A Bitcoin script cannot be edited, so funds move to a new address. A spare offline key, like the backup key in BitGo’s user, backup and BitGo model, means one lost key never blocks funds.
• MPC. The remaining parties can usually reshare without changing the address. The real questions are who holds the backup and whether you can recover without the vendor. Fireblocks offers a recovery package that loads MPC keys into non-Fireblocks software; BitGo documents that its TSS wallets can be recovered with user and backup shares if BitGo is unavailable, and not at all if both are lost.
• Application-level policy. The remaining quorum revokes a lost approver key and enrols a new one. The wallet keys need encrypted backups in more than one place, a documented key ceremony and a standby site you have actually rebuilt from.

In every model, rehearse it. A recovery path nobody has exercised is a hope, not a control.

What are your custody options as an exchange, broker or wallet company?

Who runs custody is a separate question from how signing works. There are three models, often mixed. For consumer wallet apps, see also how to build a crypto wallet app.

	Self-hosted custody software	Custody provider	MPC wallet-as-a-service
Who controls the keys	You, on your servers or HSMs	The custodian	Shared: you hold some shares, the vendor others
What you operate	Servers, keystores, nodes, approvals	Your ledger and the integration	Your apps, policies and share devices
Licence position	You are the custodian under your licence	The custodian has its own; you may still need one	Depends on the split and your regime; ask counsel
Cost shape	Licence or build, plus hosting and staff	Fees set by the custodian	Subscription or usage fees
How you leave	You keep the system	Transfer assets out	Needs a tested key export

Names you will meet, as their own documentation describes them: BitGo offers multisig and MPC wallets with user, backup and BitGo keys, as cold custody or self-custody. Fireblocks runs MPC-CMP, developed by its team in 2020, with key shares in Intel SGX enclaves. Copper runs MPC custody, and its ClearLoop lets institutions trade on partner exchanges while assets stay in custody. Cobo offers custodial, MPC, smart-contract and exchange wallets on one platform. Their roles differ, so check each against your chains, countries and licence.

How to choose a crypto custody provider or custody software

1. Who can move funds without us, and what happens if that party disappears, is hacked or gets a court order?
2. Which of our chains and tokens work today, in production, and with which mechanism?
3. How do approvers see what they sign: details on a hardware device, or a hash?
4. Where is the policy enforced, can one administrator change it, and is every change logged?
5. How do we recover after losing a device, an approver, a site or the vendor, and when was that last tested?
6. Are client assets on separate addresses from company assets, and how often is the ledger reconciled against the chain?
7. What evidence do auditors and regulators get: audit logs, proof-of-reserves data, a written custody policy, test reports?
8. For a custodian: which licence, from which country, covering which customers?
9. What does it cost at our volume in year three, not only year one?
10. How do we leave: key export, asset transfer timelines, data export?
11. Which threats does the design assume: a malicious administrator, a compromised approver, collusion, a shared cloud account or deployment pipeline?
12. How are withdrawals kept idempotent, and how are nonces, UTXOs, replacement transactions and reorgs handled?

What do regulators expect from crypto custody?

MiCA does not name a signing technology. It treats custody and administration of crypto-assets for clients as an authorised service, and Article 75 asks the provider to:

• agree custody terms with each client and keep a register of positions per client;
• set a custody policy for safekeeping or controlling crypto-assets or their means of access, aimed at minimising the risk of loss through fraud, cyber threats or negligence;
• send clients a statement of positions at least every three months;
• hold client crypto-assets separately from its own, including on the distributed ledger, legally and operationally segregated;
• be liable for losses from incidents attributable to it, up to the market value of the lost assets at the time.

MiCA’s transitional periods could run no later than 1 July 2026, and several member states ended them earlier. Applications elsewhere ask similar questions about segregation, key access, approvals and reconciliation. This is our reading of the texts, not legal advice. The technical file is covered in what regulators ask for.

Crypto custody FAQ

Is MPC safer than multisig?

Neither is safer in every case. Multisig is enforced by the chain and readable by anyone, but it differs per chain and signers can still approve the wrong transaction, as at Bybit. MPC works across chains, but it depends on a correct implementation, as BitForge showed, and on share holders that are truly independent.

Does MPC leave a trace on the blockchain?

No. An MPC signature is an ordinary single signature, so the chain shows one address and no signer set. That helps privacy and fees, and it means auditors rely on the vendor’s logs to see who approved what.

What do institutional crypto custodians do?

They hold the keys to client assets under their own licence, run storage and approvals, and report holdings. An exchange using one still needs its own ledger, withdrawal flow and reconciliation against the custodian’s statements.

Does a crypto exchange need a custody provider?

Not necessarily. Many exchanges run custody themselves, where their licence allows it, and some keep only part of their reserves with a third party. It depends on your regulator, withdrawal speed and whether you can staff key and node operations.

Can MPC and multisig be combined?

Yes. An MPC-controlled address can be a Safe owner or one key in a Bitcoin multisig, and hot wallets on MPC with cold reserves in multisig is a common split.

What does crypto custody software cost?

Platforms and custodians usually charge recurring fees tied to usage or assets; self-hosted software is a licence plus your own hosting and staff. Our self-hosted custody licence starts at €15,400 one-time, and the pricing page has the configurator.

What is the difference between hot, warm and cold wallets?

Hot wallets are online and sign automatically within limits. Warm wallets refill hot ones after an operator approves. Cold wallets keep their signing keys offline, on air-gapped machines or offline HSMs (an HSM is not cold by itself), and in a well-run setup move only with the full quorum and a delay.

What happens to client assets if a custody vendor fails?

A custodian should keep client assets segregated from its own estate, which MiCA requires of EU custodians. With MPC wallet-as-a-service, you need a tested way to recover keys without the vendor. With self-hosted software the keys stay with you, so the risk moves to your own backups and standby site.

Custody software from BitPolaris

BitPolaris Custody is software you run on your own servers. We do not hold customer wallet keys or client assets, we are not a custodian, and buying software does not give anyone a licence. It has run in production at the EX5 exchange since 2024.

• Hot, warm and cold wallet tiers; cold is air-gapped or HSM-backed, and moves need the full quorum and a time lock.
• A policy engine with an M-of-N approver quorum per asset and amount band, approvals with hardware keys, address whitelists and time delays, daily caps and versioned changes.
• Four-gate automation for sweeps and replenishment, with a daily USD cap.
• Keystores kept apart from the applications, HashiCorp Vault, and HSM integration on request (Thales Luna, YubiHSM 2).
• A reserve monitor that reconciles the ledger against the chain around the clock, with a daily Merkle export for proof of reserves.
• Nine chains with RPC pools and failover.

To be precise: our M-of-N is an approval policy in the application. Approvers sign off with hardware keys, and only then does the system sign with the wallet’s key from its keystore or HSM. It is not on-chain multisig and not MPC or TSS. If you need the chain to enforce the quorum, want no complete key to exist anywhere, or would rather not run servers and key ceremonies, on-chain multisig, an MPC platform or a custodian may suit you better, alone or alongside a system like ours.

The self-hosted licence starts at €15,400 one-time, or €37,800 with source code. HSM integration is €5,250 and a standby site €4,200. Build an estimate, read the Custody product page, or contact us for an architecture review with your security team. Applying for a licence? The Licence Technical Pack maps the custody section to your regime.

Sources

• Multisig: BIP 16, BIP 327 (MuSig2), Safe, Safe smart account concepts, Safe deployments
• TRON multi-signature, XRP Ledger multi-signing, SPL Token MAX_SIGNERS, Squads
• MPC: BitGo wallet types, BitGo on MPC and TSS, BitGo TSS wallet recovery, Canetti, Makriyannis and Peled, threshold ECDSA, Fireblocks security principles, NIST threshold cryptography
• Ledger Enterprise (March 2026), Copper, ClearLoop (The Block), Cobo Wallet-as-a-Service
• Bybit: FBI announcement, NCC Group analysis, The Block, Safe’s findings (The Hacker News)
• WazirX: Halborn, Inc42
• DMM Bitcoin: BleepingComputer on the FBI and NPA attribution
• Fireblocks BitForge disclosure (August 2023)
• Multichain: Cointelegraph, Odaily (July 2023)
• Chainalysis on 2025 crypto theft (December 2025)
• MiCA: Article 75, ESMA single rulebook, AMF on the end of the transitional period (June 2026)

Product names are trademarks of their owners. Descriptions of third-party products come from their public documentation and imply no affiliation.