MPC wallet vs seed phrase: 2026 comparison and threat model
By Al Jobson · 10 min read · September 2026
Multi-party computation replaced the single-object private key with a joint signing protocol. In 2024 Scam Sniffer counted $494M lost to signature phishing on wallets that still ship a BIP-39 seed[1]. That number is the entire reason MPC-based wallets exist for retail users. This is what changed with MPC, what it cost, and which shape fits which user.
The two designs, precisely
BIP-39 seed phrase. At setup the wallet generates 128 or 256 bits of entropy, encodes it as a 12 or 24-word mnemonic, and derives every subsequent private key from that seed using BIP-32[2][3]. The mnemonic is the wallet. Anyone who types it into any compatible wallet gets full control.
MPC threshold signing. The private key never exists as a single object anywhere. Two or more parties each hold a share and interactively compute a signature that verifies against one on-chain public key. From the chain's perspective it looks like a normal signature. From the wallet's perspective there is nothing to lose, phish, or extract, because there is no single object to lose.
Two protocol families dominate the deployed MPC wallet market. The reference protocols for threshold ECDSA are GG18 and GG20 by Gennaro and Goldfeder[4], used by Fireblocks, Coinbase WaaS, and most institutional stacks. Two-party retail wallets typically use Lindell's 2017 construction[5]. ZenGo, Portal, and Turnkey are the best-known retail examples.
Where each design fails
| Failure mode | Seed phrase (BIP-39) | MPC threshold signing |
|---|---|---|
| Phishing (fake restore UI) | Primary loss vector, $494M in 2024[1] | Nothing to type, closed[6] |
| Physical seed extraction | Kraken Security Labs, 15 min, $75[7] | Not applicable, no single seed |
| Blind signing / approval phishing | Present[8] | Present, same UI failure |
| Protocol implementation bugs | Very rare, 10+ year track record | TSSHOCK 2023 broke GG18/GG20[9] |
| Provider disappearance | Not applicable, no provider | Loss of access unless escape hatch[10] |
| Coercion / wrench attack | Poor, attacker gets seed[11] | Varies, depends on policy engine |
| Recovery UX | Write 12 words, restore anywhere | Key refresh with provider (retail) |
| Auditability by user | Simple, 10+ year public standard | Requires reading the specific protocol |
The MPC audit record, 2023 to 2025
MPC security is protocol-dependent, not automatic. The industry has learned this the hard way three times in three years.
- TSSHOCK (2023). Verichains disclosed a class of attacks against GG18 and GG20 in which a malicious party can extract the full private key over the course of the signing protocol[9]. Multiple deployed wallets shipped patches. If a vendor is using an unpatched GG18/GG20 implementation, the "no single key" property is a lie.
- Trail of Bits reviews (2023 onward). Independent audits of MPC implementations have continued to find subtle protocol bugs, side-channel leaks, and share-verification gaps[12]. The generic lesson: use audited libraries, keep them current, and read the audit reports before you trust the marketing.
- NCC Group findings. Multiple advisories published across 2023 to 2025 on threshold-signature libraries used by MPC wallets[13].
By contrast BIP-39's failure modes are ancient and well-understood. The protocol is trivially auditable by a user with 10 minutes and a wiki page. The attacks on it are all social, not cryptographic.
Provider dependency, the retail MPC catch
Most retail MPC wallets use the two-party Lindell construction: your device holds one share, the vendor's backend holds the other. Signing requires both. This is what makes phrase-free onboarding possible. It is also the reason that vendor disappearance can lock users out.
Every serious retail MPC vendor ships an escape hatch: a way to export a Shamir-style backup that recovers the wallet without the vendor. If the vendor you are evaluating does not, treat that as a first-order red flag. It means the vendor is on the critical path forever.
ZenGo, Coinbase Wallet (via WaaS), and Portal all publish their escape-hatch models[14]. Fireblocks and Copper have separate institutional models that assume the customer is running key infrastructure themselves. If you are a retail user, read the recovery flow before you fund the wallet.
MPC vs Shamir plus enclave, the seedless subcategory choice
"Seedless" is not one design. It is a category. Two main shapes:
| Property | MPC threshold signing | Shamir + enclave (VEYRNOX, Trezor SLIP-39) |
|---|---|---|
| Private key exists as one object? | Never | Yes, sealed inside Secure Enclave / StrongBox; never exported |
| Security floor | Hardness of MPC protocol | Hardness of the enclave chip[15] |
| Provider dependency | Provider holds one share (retail) | None; shares are user-held |
| Audit ecosystem | Small, protocol-specific | Apple SE and Android StrongBox are heavily reviewed platform components |
| Recovery | Key refresh via provider | Reconstruct m-of-n Shamir shares |
| Best for | Institutional, policy-driven signing | Retail self-custody, no third-party on critical path |
The choice is not "MPC or nothing". For institutional users MPC with a policy engine (Fireblocks, Copper, Anchorage) is the category answer[16]. For retail users the enclave-plus-Shamir shape gives up the "never one object" property but gains a security floor set by Apple and Google's silicon-team work, and drops the vendor dependency.
What the numbers say
Chainalysis and TRM Labs both put phrase-based losses well above every other retail attack category through 2024 and 2025[17][18]. Scam Sniffer's 2024 report ($494M drained across ~332,000 addresses via signature phishing) is the sharpest single number: every one of those wallets shipped a seed phrase, and almost none of them lost keys, they lost signatures[1].
MPC-specific losses over the same period are much lower in absolute terms, but the ecosystem is smaller. The TSSHOCK disclosure did not result in a single documented at-scale drain because most vendors patched inside the disclosure window. The lesson: MPC works, when the specific implementation you use is audited, current, and matched to your threat model.
How to pick
- You are a retail user who has lost or nearly lost funds to phishing. Move to any wallet that eliminates the seed phrase from the daily UI. Either MPC or enclave-plus-Shamir works. Read the recovery flow before you commit.
- You want no third party on the critical path, ever. Enclave plus Shamir. Signing key stays on your phone, backup shares stay in your hands.
- You are managing organisational funds. MPC with a policy engine. Multi-approver signing, quorums, audit trails, and compliance integration are the point.
- You need a wallet that works with every existing dApp and every existing bridge. BIP-39 remains the widest-compatibility choice. Almost every wallet imports a 12-word phrase.
- You are at risk of physical coercion. Neither category solves this by default. Look for wallet-level duress features (duress PIN, decoy wallet, threshold policies).
Bottom line
MPC is not a magic replacement for seed phrases. It is a different set of trade-offs. It eliminates seed-phrase phishing and physical seed extraction, which are the two vectors that dominate retail losses. It introduces protocol-audit dependency and, for retail users, vendor dependency on the critical path. Its security is real when the implementation is audited and current, and fragile when it is not.
The BIP-39 seed phrase remains the widest-compatibility, easiest-to-audit design. It is also the design that keeps losing money at scale in 2026. If the ecosystem trend continues, the retail default will move to seedless designs (MPC or enclave plus Shamir) over the next three to five years. The right choice today is not "MPC or seed" but "which shape of seedless matches how you actually hold, spend, and get attacked".
The seedless-without-provider option
VEYRNOX uses the enclave-plus-Shamir shape: signing keys generated and used inside the phone's Secure Enclave (iOS) or StrongBox (Android), backup as m-of-n Shamir shares distributed to locations you control. No MPC provider on the critical path. Full explainer · Shamir primer · Download.
Related reading
Sources
- Scam Sniffer, "2024 Wallet Drainers Report." drainer.io
- BIP-39, Mnemonic code for generating deterministic keys. github.com/bitcoin/bips
- BIP-32, Hierarchical Deterministic Wallets. github.com/bitcoin/bips
- Gennaro, Goldfeder, "GG18/GG20 threshold ECDSA." eprint.iacr.org
- Lindell, "Fast Two-Party ECDSA." eprint.iacr.org
- ZenGo, "How our keyless wallet works." zengo.com
- Kraken Security Labs, Trezor seed extraction. blog.kraken.com
- Ledger, "Clear Signing initiative." ledger.com
- Verichains, "TSSHOCK." verichains.io
- Fireblocks, "MPC recovery model." fireblocks.com
- Lopp, "Known Physical Bitcoin Attacks." github.com/jlopp
- Trail of Bits, "MPC / TSSHOCK analysis." blog.trailofbits.com
- NCC Group cryptography research blog. research.nccgroup.com
- Coinbase Wallet-as-Service documentation. coinbase.com/cloud
- Apple, "Secure Enclave overview." support.apple.com
- Anchorage Digital, institutional custody. anchorage.com
- Chainalysis, "2025 Crypto Crime Report." chainalysis.com
- TRM Labs, "2025 Crypto Crime Mid-Year." trmlabs.com
- SatoshiLabs, SLIP-39. github.com/satoshilabs
- Android, "Hardware-backed Keystore / StrongBox." source.android.com
Al Socrates Jobson, Co-Founder and CTO, Veyrnox LTD · ← Back to Blog