What Is an MPC Wallet? Multi-Party Computation Explained

Every crypto wallet, at bottom, comes down to one question: who can produce a valid signature? Traditional wallets answer with a single private key. Lose it, and the funds are gone. Leak it, and they are stolen. MPC wallets answer differently, by making sure no single key ever exists to lose or leak in the first place.

This guide explains what an MPC wallet actually is, how the cryptography works in plain terms, how it compares to multisig and other approaches, and why Para builds on this model.

What is an MPC wallet?

An MPC wallet is a crypto wallet secured by multi-party computation, a cryptographic technique that splits a private key into independent shares held by separate parties. To sign a transaction, a threshold of those shares cooperates to produce a valid signature, without any party ever holding or reconstructing the complete key. The result is a wallet with no single point of failure.

To a user, an MPC wallet looks and feels like any other wallet. They authenticate, they see a balance, they approve a transaction. The difference is entirely underneath: instead of one file or phrase representing total control, control is distributed across shares that must work together.

How key generation works

MPC wallets typically start with Distributed Key Generation (DKG), a protocol where multiple parties jointly generate a key without any single party ever seeing the whole thing. Each party ends up with its own share, generated collaboratively rather than split after the fact. This distinction matters: a key that is generated whole and then cut into pieces has a brief moment where the complete key existed. DKG never creates that moment at all.

Para uses Distributed Key Generation as the foundation of its wallet architecture. One share is generated for the user's device, protected by a secure enclave through a passkey, and another share lives in Para's infrastructure. Because the full key is never assembled during generation or afterward, there is no single secret an attacker can target.

How signing works

Once a key exists as shares, signing a transaction requires those shares to run a collaborative protocol. Each party performs computation on its own share and exchanges only partial results, never the shares themselves. When enough shares participate, the protocol outputs a single valid signature, the same kind any wallet on that chain would produce.

This is the part people find counterintuitive: the output looks completely ordinary. A transaction signed by an MPC wallet is indistinguishable onchain from one signed by a traditional single-key wallet. The complexity is entirely in how the signature gets produced, not in what it looks like once it exists.

MPC vs. multisig vs. TSS

These three terms get used loosely and interchangeably, but they describe different things.

| Approach | How it works | Onchain footprint | Chain support | |---|---|---|---| | Multisig | Multiple independent keys each sign; a threshold of full signatures is required | Visible as a multi-signature transaction | Requires chain or contract support for multisig | | MPC | Key shares cooperate to produce one signature; no full key ever exists | Looks like a standard single-signer transaction | Works on any chain that accepts a normal signature | | TSS (threshold signature scheme) | A specific family of MPC protocols focused on threshold-based collaborative signing | Same as MPC: a single standard signature | Works on any chain that accepts a normal signature |

Multisig is older and simpler to reason about, but it requires the chain or a smart contract to understand multiple signers, and every additional signer adds onchain cost and complexity. MPC and TSS push that coordination off-chain, into the signing protocol itself, so the chain only ever sees one clean signature. In practice, TSS is best understood as a category of MPC techniques rather than a separate approach: most modern MPC wallets, including Para's, use threshold signing schemes under the hood.

Why no single point of failure matters

The practical benefit of MPC is what it removes, not what it adds. A traditional key or seed phrase is a single artifact that grants total control. That means exactly one thing needs to go wrong: one phishing email, one stolen device, one leaked backup. MPC removes that artifact entirely.

Consider the two failure modes a wallet has to survive. First, a breach of the provider's infrastructure. With server-side custody, this can expose a complete key. With well-distributed MPC, an attacker who compromises the provider's share still needs the user's share too, and does not have it. Second, a compromised login. If a social login is phished, a wallet that ties funds directly to that login is at risk. When a key share is bound to a device secure enclave through a passkey, as Para's is, a phished password does not reach the device-bound share at all.

Neither scenario is purely theoretical. Server-side key breaches and phished logins are the two most common ways wallets get drained in practice. MPC does not make either impossible, but it changes the math: an attacker now needs multiple independent failures to happen at once, rather than just one.

MPC and non-custodial design

Whether an MPC wallet is custodial depends entirely on who holds which shares and whether any single party can reach the signing threshold alone. If a provider holds enough shares to sign without the user, the wallet is functionally custodial no matter how sophisticated the cryptography sounds. Genuinely non-custodial MPC requires that the user's share be necessary for every signature.

Para's Distributed MPC is built this way. The user's device holds a share, protected by a passkey and a hardware-backed secure enclave, and that share is required for signing. Para cannot produce a valid signature on its own, which means Para cannot move a user's funds. This is the practical definition of non-custodial: not a promise, but a structural guarantee built into where the shares live. Our guide on custodial vs. non-custodial wallets walks through the full spectrum between the two.

Where MPC fits in wallet infrastructure

Key management is one layer in a larger stack that also includes authentication, signing coordination, policy, and money movement. MPC solves the key management layer specifically: how a key gets created and used without ever existing whole. It pairs naturally with passkey authentication, since a passkey provides exactly the kind of hardware-backed, phishing-resistant credential that a device-bound key share benefits from. Our passkey wallets guide covers that pairing in detail, and what is wallet infrastructure covers how key management fits alongside the rest of the stack.

MPC also underpins both embedded wallets and broader wallet-as-a-service platforms. It is the cryptographic foundation; embedded wallets and WaaS are the product layers built on top of it.

Para's approach to MPC

Para runs Distributed MPC with Distributed Key Generation, so private keys never exist in full at any point, from creation through every subsequent signature. One share is bound to the user's device through a passkey, secured by a hardware enclave like Face ID or Touch ID. This design is non-custodial, independently audited by Least Authority, and SOC 2 Type II compliant, and it runs at scale across 15M+ wallets and partners including ENS, Vana, and Camp Network. You can see the architecture in action at the Para docs, or compare it against other approaches using our buyer's guide.

Frequently asked questions

What is an MPC wallet?

An MPC wallet is a crypto wallet that uses multi-party computation to split a private key into separate shares, held by different parties. Signing happens collaboratively across those shares, and the full key is never assembled in one place. This removes the single point of failure that traditional wallets rely on.

Is an MPC wallet safer than a normal wallet?

It can be, because there is no single secret to steal or lose. A traditional wallet's entire security rests on one private key or seed phrase. An MPC wallet distributes trust across independent shares, so compromising one share is not enough to move funds, provided the shares are genuinely well distributed.

What is the difference between MPC and multisig?

Multisig requires multiple full signatures from separate keys, visible onchain as a multi-signature transaction. MPC produces a single signature collaboratively from key shares, so it looks like a normal transaction onchain and works on any chain, not just ones with multisig support built in.

What is threshold signing?

Threshold signing means a defined number of key shares, out of the total shares that exist, must cooperate to produce a valid signature. A 2-of-3 threshold, for example, tolerates one share being offline or lost while still preventing any single share holder from signing alone.

Is an MPC wallet custodial?

Not by default. Custody depends on who holds which shares and whether any single party can reach a threshold alone. Para's Distributed MPC keeps a share on the user's device, so Para cannot sign on a user's behalf, which makes the wallet non-custodial.