MPC Wallet vs Multisig vs HSM: Which Custody Model Fits Your Platform

Key Takeaways

• Wallet compromise and phishing or social engineering accounted for more than 60% of the $1.31 billion lost to Web3 security incidents in H1 2026, far outpacing smart contract bugs.
• The April 2026 Drift exploit bypassed multisig protection by getting signers to approve transactions that looked routine, putting the signing workflow on equal footing with the custody model itself.
• While HSMs protect key material inside certified hardware, multisig enforces on-chain approval rules, and MPC distributes signing so a private key is never assembled, each leads on distinct operational criteria: MPC on on-chain coverage and fee efficiency, multisig on native transparency, and HSMs on auditor familiarity.
• Platform type shapes the architecture, from high-volume exchanges using MPC to custodians anchoring on HSMs, leading to hybrid architectures that combine MPC, HSMs, and multisig under a unified policy engine.
• Choose MPC when you need broad chain coverage and operational flexibility; multisig when on-chain transparency matters more than fee efficiency; HSMs when certification and auditor comfort drive the mandate; a hybrid when you have more than one of those requirements at once.

On April 1, 2026, Drift Protocol lost $285 million, more than half of its total value locked. Over the preceding week, attackers used social engineering to obtain pre-signed transactions from members of Drift’s Security Council multisig.

The signers believed the transactions were harmless or routine, yet each carried hidden instructions to transfer administrative control. Solana’s durable nonce feature allowed the signatures to be held and executed days later, and a recent migration to a 2-of-5 multisig with zero timelock left no window to detect the attack before two pre-signed transactions executed one second apart. Investigators have linked the attack to actors associated with North Korea.

Drift was not an isolated case. Wallet compromise ($444.5 million) and phishing or social engineering ($366.3 million) together accounted for more than 60% of the $1.31 billion lost to Web3 security incidents in H1 2026, while code vulnerabilities accounted for $151.6 million. The same blind-signing pattern was behind the February 2025 Bybit breach, where signers approved a disguised cold-to-hot transfer that handed control of a multisig cold wallet to the attacker.

Neither the Drift nor the Bybit attack broke the underlying cryptography. Each succeeded by getting authorized signers to approve a transaction whose true effect they couldn’t see. That makes a working knowledge of each custody model more important for institutions, not less.

Multi-Party Computation (MPC), Multisig, and Hardware Security Module (HSM) each place key material, the approval step, and the audit trail in different places, and each leaves a different gap for attackers to probe. Institutions also hold larger balances, client assets, and regulatory obligations, so misreading a model’s limits carries a higher cost.

A team that understands each model’s strengths and weaknesses can assign each to the wallet tier it protects best, then close the remaining gaps with approval policy and signing controls. The sections below compare MPC, multisig, and HSM as distinct custody models, examine what recent incidents reveal about signing workflows, and show how institutional-grade custody combines all three.

How MPC, Multisig, and HSM Protect Private Keys

The three models are often grouped together as “secure custody,” yet each protects keys through a fundamentally different mechanism. How each model generates, stores, and uses a key determines its strengths, limitations, and operational fit.

MPC splits the key so a complete version never exists.

In place of a single private key, MPC generates encrypted key shares distributed across independent parties or devices. Through a threshold signature scheme, those parties jointly produce one standard signature without assembling the complete key at any point, including during key generation and signing. On-chain, the result appears as an ordinary single-signature transaction. With no complete key present anywhere in its lifecycle, the security focus shifts from protecting a single secret to securing the infrastructure and policies that coordinate the shares.

Multisig requires multiple distinct keys to approve on-chain.

A multi-signature wallet is a script or smart contract that enforces an M-of-N rule, such as three of five signers approving before funds move. Each signer holds a separate full private key, and the blockchain verifies the required combination before executing the transaction. The policy and every approval are recorded on-chain, producing a transparent, tamper-evident record. The trade-offs are chain-specific implementations and higher gas costs on smart contract networks due to the additional logic.

HSMs protect the key inside certified, tamper-resistant hardware.

A hardware security module is a physical device, certified to standards such as FIPS 140-3 or Common Criteria, that generates and stores keys so they never leave the device in plaintext. Signing occurs inside the hardware boundary, and the key material remains sealed even from the operators using it. HSMs have decades of history in traditional banking and payments, which explains their strong recognition among auditors and regulators. On their own, however, HSMs protect a single key and do not distribute trust or enforce multi-party approval the way MPC and multisig do.

These models answer different questions. HSMs harden where a key is stored, multisig enforces who approves on-chain, and MPC determines whether a complete key exists at all. A detailed breakdown of the MPC and multisig trade-offs is available in MPC Wallets vs Multi-Sig Wallets: Choosing the Right Key Model for Your Stack.

How MPC, Multisig, and HSM Compare Across Key Criteria

Each model carries a distinct profile across the criteria that operations, security, and compliance teams evaluate.

No single model leads across every criterion. MPC typically performs strongest on chain coverage and fee efficiency, multisig on native transparency, and HSMs on auditor familiarity. The advantages that matter most depend on how a platform operates.

What the Drift and Bybit Incidents Reveal About Signing Workflows

In both the Drift and Bybit incidents, the custody model held up cryptographically, and the multisig contracts executed exactly as instructed. The failure occurred one layer above, at the human approval step, and that layer is exposed under every custody model.

Signers in both cases approved transactions that appeared legitimate while malicious logic sat underneath. The broader pattern across 2026 incidents is examined in ChainUp’s report on North Korea crypto hacks in 2026, including the Drift and KelpDAO exploits. Defending against this pattern requires controls that operate alongside the custody model:

• Transaction simulation. Every transaction should be simulated in a trusted environment that displays its true effect before a signer approves it, independent of what the requesting interface renders. A “routine transfer” that actually rewrites wallet ownership surfaces during simulation.
• Independent verification of signing payloads. Signers should confirm transaction details through a separate, trusted channel and verify the raw payload against expected parameters. This closes the blind-signing gap both attacks exploited.
• Policy engines with allowlists, limits, and timelocks. Hardcoded rules, including approved destination addresses, per-transaction and daily value caps, and mandatory delays on new recipients and administrative changes, prevent a single disguised approval from draining a wallet. Drift’s zero-timelock configuration removed exactly this detection window.
• Hardened, separated signing devices. Dedicated signing devices, isolated from general browsing and email, reduce the exposure of the approval step to malware and phishing. Key separation matters as much as device hygiene: in June 2026, Humanity Protocol lost $36 million after an attacker obtained enough multisig keys from a single compromised laptop to meet the signing threshold.

Selecting MPC, multisig, or HSM is a necessary step, and the signing workflow around the model determines whether that choice holds under a targeted attack. ChainUp’s analysis of the Bybit hack and its lessons for crypto custody and security examines these controls in further detail.

Which Custody Model Fits Each Platform Type

The right architecture depends less on abstract security rankings and more on how a platform moves funds day to day. Fit typically breaks down by platform type as follows.

High-volume exchanges run constant hot and warm wallet activity across many chains, including withdrawals, rebalancing, and market-making flows. Speed, low per-transaction cost, and broad chain coverage take priority, which is why MPC usually anchors the hot and warm tiers. Cold reserves, moved rarely and deliberately, are frequently held under multisig or HSM-backed storage. Tiering keeps only operational balances in fast-moving wallets, which limits exposure if an incident occurs. The role of the middle tier is covered in Crypto Warm Wallets: What They Are and When to Use Them.

Fintech apps embedding crypto typically prioritize fast integration, a clean user experience, and support for the assets on their product roadmap. MPC’s chain-agnostic signing and address stability during signer rotation make it a practical foundation, since staff and device changes do not force address migrations that would disrupt users.

Qualified custodians and banks operate under the heaviest certification and examination burden. Auditor and regulator familiarity carries significant weight, which is why HSM-anchored architectures remain common: hardware certifications map directly onto controls examiners already recognize. Many pair HSMs with MPC or multisig to add distributed approval on top of certified hardware. The broader mechanics of institutional crypto custody shape how these layers are assembled.

Payment providers need predictable, high-throughput signing with tight controls on where funds can go. Allowlisted destinations, value limits, and straight-through processing take priority over public on-chain transparency. MPC with a strong policy engine fits this profile, often with HSM-protected shares for added assurance.

Corporate and DAO treasuries move funds infrequently but must demonstrate governance to boards, token holders, or auditors. Multisig’s native on-chain audit trail is a clear advantage here, since any party can independently verify that funds moved only when the configured threshold approved. Individual signers often protect their own keys with MPC or hardware to guard against personal device compromise.

Every platform type in the table combines at least two models. Each model covers a gap the others leave open: MPC removes the single complete key, HSMs certify where key material lives, and multisig makes cold-reserve approvals verifiable on-chain. Depending on one model alone leaves the remaining gaps exposed, which is why institutional-grade custody assembles all three into one architecture.

How Institutional-Grade Custody Combines MPC, Multisig, and HSM

Institutional-grade custody treats MPC, multisig, and HSM as layers within a single architecture, each assigned to the risk it handles best. Three patterns define how those layers fit together.

A common hybrid pattern stores MPC key shares inside HSMs or trusted execution environments (TEEs). This combines MPC’s distributed trust with hardware-grade protection: no complete key exists, and each share sits behind certified tamper resistance. A single compromised signing node does not expose a usable key, and the hardware boundary raises the cost of attacking any individual share.

Another common pattern layers custody by wallet type: hot, warm, and cold. MPC handles hot and warm flows where speed and chain coverage matter, while multisig secures cold reserves where slow, transparent, on-chain approval is an advantage. Scheduled sweeps move surplus from hot wallets into cold storage, keeping operational exposure low. The trade-offs across each tier are outlined in Hot vs Cold vs Warm Wallets: Which Crypto Wallet Solution Should You Choose?

A policy engine spanning every tier ties the architecture together. Rather than each wallet enforcing its own isolated rules, a unified engine applies allowlists, value limits, approval quorums, and time delays consistently across MPC hot wallets, multisig treasuries, and HSM-backed storage. This layer is where the signing-workflow lessons from Drift and Bybit are put into practice, enforcing independent verification and transaction limits regardless of which underlying model signs. The case for this layered approach is examined in 2026 Institutional Custody Architecture: Why MPC Alone Is Not Enough, and the structure of converged setups is detailed in The New Infrastructure of Enterprise Custody: Merging Multi-Sig and MPC in 2026.

What to Evaluate in a Custody Infrastructure Provider

Once the model mix is mapped to the platform, the next step is assessing whether a provider can deliver it. The following criteria warrant close scrutiny:

• Certifications. SOC 2 Type II and ISO 27001 serve as baseline evidence of operational controls. For HSM-backed offerings, confirm FIPS 140-3 validation, since FIPS 140-2 certificates moved to NIST’s historical list in September 2026 and are supported only for existing systems.
• Key share distribution options. Confirm where shares can be stored, whether across cloud providers, on-premises hardware, HSMs, or TEEs, and whether shares can be diversified geographically and technically to avoid a single point of failure.
• Policy engine. The engine should support allowlists, value limits, tiered approval quorums, time-locks, and transaction simulation. This is the layer designed to catch disguised transactions like those in recent incidents.
• Chain coverage. Confirm support for every chain the product requires today and a credible path to the chains on the roadmap.
• KYT integration. Know-your-transaction (KYT) screening should connect to the approval flow so that suspicious destinations are flagged or blocked before signing, not after funds leave.
• Recovery procedures. Establish exactly how funds are recovered if signing devices are lost or destroyed, and whether the provider runs tested disaster-recovery drills.
• Deployment model. Weigh SaaS convenience against self-hosted control. High-compliance custodians often require self-hosted or on-premises options, while fintechs may prefer managed infrastructure for faster deployment.

A qualified provider should answer each criterion with specifics and supporting evidence. Vague responses on recovery or policy enforcement indicate gaps to resolve before any commitment.

Building a Layered Custody Architecture

MPC, multisig, and HSM function as complementary layers, each strong where the others are weaker. HSMs provide certified hardware protection and auditor confidence, multisig provides transparent on-chain governance, and MPC provides chain-agnostic efficiency without a single complete key. Relying on any one of them leaves a known gap open. Institutional-grade custody combines them according to transaction volume, chain mix, and regulatory expectations, then governs the full stack with a policy engine and signing workflow built to catch a disguised transaction before approval. The fundamentals behind this approach are covered in Digital Asset Custody: Essential Guide for Institutions and MPC Wallets: The Future of Secure Crypto Custody.

ChainUp’s White Label MPC Wallet provides the wallet infrastructure for this layered approach:

• Broad chain coverage. MPC signing across 200+ supported chains, with new chains and tokens activated within minutes.
• Policy engine at the signing step. Multi-approval workflows, segregation of duties, address allowlisting and blocklisting, and full audit trails.
• Tiered wallet architecture. Hot, warm, and cold wallet tiers, with autosweep consolidating sub-wallet balances into an omnibus wallet at reduced gas cost.
• Integrated transaction screening. Know Your Transaction (KYT) monitoring identifies 43 risk types and traces funds up to 20 layers deep across 12,000+ tokens, with real-time alerts.
• Proven operations. Alignment with SOC 2 and ISO security standards, a zero-incident security record, and over 99.99% service uptime across 300+ organizations.

Deployments are available for crypto exchanges, payment platforms, and banks. Ahead of the next custody review or wallet architecture decision, explore how White Label MPC Wallet supports policy-based signing across every tier and every chain on the platform roadmap.

Frequently Asked Questions

What is the difference between MPC and multisig wallets?

Multisig enforces its approval rule on-chain: multiple distinct private keys must sign, and the blockchain verifies the M-of-N threshold before funds move. MPC enforces a similar multi-party approval policy off-chain through cryptography, where key shares jointly produce one standard signature, so no complete key is ever assembled and the chain records a normal single-signature transaction. Multisig provides native on-chain transparency, while MPC provides broader chain coverage and typically lower gas costs on EVM networks.

Is an HSM more secure than MPC?

Neither is universally more secure, since each protects against different risks. An HSM seals a full key inside certified tamper-resistant hardware, which auditors and regulators recognize well, but it still protects a single key. MPC removes the single key entirely by splitting it into shares. Many platforms combine the two by storing MPC shares inside HSMs.

Can MPC and HSM be used together?

Yes, and it is a common hybrid pattern. MPC key shares can be stored inside HSMs or trusted execution environments, combining distributed trust with hardware-grade protection. No complete key exists, and each share sits behind certified tamper resistance, raising the cost of compromising any single node.

Which custody model do crypto exchanges use?

High-volume exchanges typically tier their wallets. MPC often handles hot and warm flows where speed, low fees, and multi-chain support matter, while cold reserves are held under multisig or HSM-backed storage that moves rarely and deliberately. Tiering keeps only operational balances in fast-moving wallets to limit exposure.

Does multisig work on every blockchain?

No. Multisig implementations are chain-specific: Bitcoin uses native script-based multisig, EVM chains use smart contract wallets, and support varies across other networks. This per-chain dependency is one reason platforms operating across many networks often favor MPC, which produces a standard signature compatible with any chain that accepts single-signature transactions.