Does MPC Wallet Custody Actually Protect You From Quantum Computers? The Answer Institutional Custodians Aren't Advertising
Published by: QubitChain Research
URL: qubitchain.io/blog/mpc-wallet-custody-quantum-computer-threat-threshold-ecdsa
Category: Institutional Security, Post-Quantum Cryptography
Reading Time: Approximately 11 minutes
Last Updated: August 2026
TL;DR - Quick Answer
MPC wallets distribute private key shares so no single party ever holds a complete key. That is a real security improvement against single points of compromise, and it is not what protects you from a quantum computer. The signature threshold ECDSA produces is an ordinary ECDSA signature, and Shor's algorithm breaks the elliptic curve discrete logarithm problem underneath it regardless of how many parties helped create it. Threshold ML-DSA research advanced meaningfully in 2025, but no major custodian runs it in production today.
Multi-Party Computation wallets now secure a large share of institutional crypto custody. Fireblocks, Coinbase, Binance, BitGo, ZenGo, and a growing list of banks including ING have all built their custody stacks around threshold signature schemes, largely threshold ECDSA. The pitch is straightforward: no single device or employee ever holds a complete private key, so there's no single point of compromise. It's a real security improvement, and it has held up well against the kind of attacks it was designed for.
Definition: MPC Wallet
A wallet architecture where a private key is never assembled in one place. Instead, the key is split into shares distributed across multiple parties, who jointly compute a valid signature through a cryptographic protocol, typically threshold ECDSA, without any single party ever reconstructing the full key.
None of that addresses what happens when the signature scheme underneath it stops being secure. And that's the part institutional custody providers have been quiet about.
What MPC Wallets Actually Solve
To understand the gap, it helps to be precise about what threshold ECDSA is actually doing. In a standard MPC wallet, n parties each hold a share of a private key. When a transaction needs signing, a subset of those parties, say any 3 out of 5, run a multi-round protocol that jointly produces a valid ECDSA signature. The math typically relies on Paillier homomorphic encryption to let parties compute on encrypted shares of the key without ever decrypting them to each other. The most widely deployed protocol families are known by their authors' initials in the literature: Lindell17, GG18, and GG20.
The output of all this cryptographic choreography is a completely ordinary ECDSA signature. It is, by design, indistinguishable from a signature produced by a single private key on a single device. That indistinguishability is a feature; it means MPC wallets work with any blockchain that already supports ECDSA without requiring any changes to the chain itself.
It's also exactly why MPC doesn't touch the quantum problem.
The Attack Surface MPC Actually Closes
MPC wallets are genuinely effective against a specific category of threat: single points of compromise. If an attacker breaches one server, steals one laptop, or coerces one employee, they get a key share that is, on its own, mathematically useless. They need to compromise enough parties to reach the signing threshold, which is a meaningfully harder operational problem than stealing a seed phrase off one device.
This is not a hypothetical benefit. In 2023, Fireblocks disclosed a vulnerability nicknamed BitForge (CVE-2023-33241) that affected implementations of the Lindell17, GG18, and GG20 protocols across more than a dozen wallet providers, arising from improper zero-knowledge proof handling in the Paillier key setup. It was a serious flaw, and it illustrates the actual risk profile of MPC systems: bugs in the multi-party protocol implementation, not architectural gaps in the concept itself. Researchers at Fireblocks, Nikolaos Makriyannis and Ilan Yomtov, later published a systematic study documenting practical key-extraction attacks against several deployed MPC wallet implementations, some requiring as few as a single malicious signing session to extract a full key.
These are real, well-studied risks, and the industry has responded to them with better implementations, formal verification work, and more rigorous zero-knowledge proof checking. What none of that work touches is the mathematics of ECDSA itself.
| Threat | Does MPC address it? | Why |
|---|---|---|
| Stolen laptop or seed phrase | Yes | A single share is mathematically useless on its own |
| Breached single server | Yes | Attacker must reach the signing threshold across parties |
| Insider coercion of one employee | Yes | No individual holds a complete key |
| Protocol implementation bugs | Partially | BitForge showed real key-extraction flaws in deployed code |
| Shor's algorithm on a CRQC | No | Attacks the elliptic curve math, not the key storage model |
| Harvest Now, Decrypt Later | No | The on-chain public key is exposed identically either way |
The Attack Surface MPC Doesn't Touch At All
Here's the part that gets lost in most custody marketing material. Shor's algorithm, run on a sufficiently powerful quantum computer, breaks ECDSA by solving the elliptic curve discrete logarithm problem directly. It doesn't care how the private key was generated, how many parties held shares of it, or what protocol was used to produce the signature. It attacks the mathematical relationship between a public key and its corresponding private key, a relationship that exists identically whether the private key sat on one hardware device or was distributed across five MPC nodes on three continents.
Put differently: MPC solves the problem of who can produce a signature. It does nothing about whether the signature scheme itself can be broken once produced. An MPC wallet secured by threshold ECDSA is, from a quantum adversary's perspective, exactly as vulnerable as a wallet with a single ECDSA key sitting in a hardware module. The public key it exposes on-chain is the same kind of public key. The Harvest Now, Decrypt Later threat applies to it identically: any transaction an MPC-secured institutional wallet has ever signed has exposed a public key that a future quantum computer could use to derive the private key, regardless of how many parties were involved in generating that signature.
This matters more for institutional custody than for individual holders, not less. Custodians secure aggregated assets across thousands of clients. A single custodial hot wallet address compromised via quantum key derivation isn't a personal loss; it's a systemic one, and it's precisely the kind of address that has signed enough transactions over enough years to have a permanently exposed public key.
Is the Industry Aware of This? Yes, and It's Actively Working the Problem
To be fair to the custody industry, this isn't news to the researchers building these systems. The cryptographic research community has been actively working on threshold post-quantum signatures for the past several years, and 2025 saw real progress. A paper published to the IACR's ePrint archive in 2025 presented an efficient, scalable construction for threshold ML-DSA, the NIST-standardized post-quantum signature algorithm, built specifically for multi-party settings. The paper is explicit about why this is hard: adapting Fiat-Shamir-with-Aborts-based lattice signatures like ML-DSA to a distributed multi-party setting introduces coordination and rejection-sampling problems that don't exist in threshold ECDSA, where the underlying elliptic curve operations are comparatively simple to distribute.
There has also been patent activity in this space specifically targeting post-quantum MPC, including proposals for threshold signing schemes built on hash-based one-time signatures rather than elliptic curve or lattice constructions, precisely because hash-based schemes like SLH-DSA have a different and in some ways simpler security profile for distributed protocols.
The honest summary: threshold post-quantum signing is a real, active research area, but it is not yet what's running in production at any major custodian. What's running in production today, across essentially every major MPC custody provider, is threshold ECDSA or threshold EdDSA, both of which inherit the full quantum vulnerability of their underlying elliptic curve. For background on the standard itself, see our explainer on CRYSTALS-Dilithium and ML-DSA.
Why "Blockchain-Agnostic" Is Actually a Liability Here
One of the most-cited advantages of MPC wallets is that they're blockchain-agnostic: because they produce standard ECDSA or EdDSA signatures, they work with virtually any chain without requiring protocol-level changes. That flexibility is genuinely valuable for a custody provider supporting hundreds of assets across dozens of chains.
It's also the reason MPC infrastructure can't unilaterally solve the quantum problem. The signature format an MPC wallet produces is dictated by the chain it's signing for. If Bitcoin, Ethereum, or any other network continues to only accept ECDSA-family signatures, no amount of sophistication in the custody layer changes the exposure once a Cryptographically Relevant Quantum Computer exists. The fix has to happen at the protocol layer, in the signature scheme the chain itself accepts, not in how many parties are involved in producing a signature the chain will still verify using the elliptic curve discrete logarithm problem.
This is the structural reason a blockchain built natively on post-quantum signature algorithms matters more than any improvement at the custody layer. If the underlying chain accepts ML-DSA signatures from genesis, an MPC or threshold implementation built on top of it, once threshold ML-DSA schemes mature to production readiness, inherits genuine quantum resistance. Built on top of a chain that only accepts ECDSA, the most sophisticated custody architecture in the world produces a signature a quantum computer can still break. See how the major chains compare in our blockchain comparison.
What This Means If You're Evaluating Institutional Custody
If your organization is evaluating or currently using MPC-based custody, the quantum question isn't whether MPC protects you. It's a category error to ask that question of MPC at all; MPC was never designed to answer it. The actual questions worth asking your custody provider:
- What blockchain networks hold your assets, and what signature algorithm does each of those networks accept? If the answer is ECDSA or EdDSA across the board, your exposure profile to a future CRQC is identical to a self-custodied wallet on the same networks, MPC notwithstanding.
- Does your custodian have a public roadmap for supporting post-quantum signature schemes as they mature, on any chains that adopt them? Several are watching the threshold ML-DSA research closely, but public commitments remain rare.
- Has your custodian rotated addresses recently, or do institutional hot wallets have long transaction histories with permanently exposed public keys? Address hygiene matters more, not less, once you understand that key custody sophistication doesn't address signature-scheme vulnerability.
The Structural Fix
QubitChain.io was built from its genesis block on ML-DSA as the native transaction signature scheme, meaning every signature the network accepts, whether produced by a single key or eventually by a threshold implementation once threshold ML-DSA reaches production maturity, is post-quantum secure by protocol design. There's no retrofit required, and no custody-layer sophistication needed to compensate for a chain-layer vulnerability that shouldn't exist in the first place.
Full architecture: qubitchain.io/whitepaper. You can also join our waitlist for institutional access updates.
References
- Makriyannis, N., & Yomtov, I. (2024). Practical Key-Extraction Attacks in Leading MPC Wallets. Proceedings of the 2024 ACM SIGSAC Conference on Computer and Communications Security.
- National Institute of Standards and Technology. (2023). Attacks on Threshold ECDSA Wallets, MPTS 2023 Workshop Presentation.
- Fireblocks. (2023). BitForge Vulnerability Disclosure, CVE-2023-33241.
- Threshold ML-DSA Research Contributors. (2025). Efficient, Scalable Threshold ML-DSA Signatures from MPC. IACR Cryptology ePrint Archive, Paper 2025/1163.
- National Institute of Standards and Technology. (2024). FIPS 204: Module-Lattice-Based Digital Signature Standard.
- Shor, P.W. (1994). Algorithms for Quantum Computation: Discrete Logarithms and Factoring. Proceedings of the 35th Annual Symposium on Foundations of Computer Science.
- QubitChain.io Technical Whitepaper v2.0. (2026).
Frequently Asked Questions
Q: Does an MPC wallet protect against quantum computers?
A: No, not in its current production form. MPC wallets protect against single points of compromise by distributing private key shares across multiple parties, but the signature the parties jointly produce is standard ECDSA or EdDSA in nearly all deployed systems. Shor's algorithm on a quantum computer attacks the mathematics of that signature scheme directly, regardless of how many parties were involved in generating it. MPC solves who can produce a signature; it does not change whether the produced signature can be broken by a quantum computer.
Q: What is the difference between threshold ECDSA and post-quantum threshold signatures?
A: Threshold ECDSA distributes an elliptic curve private key across multiple parties who jointly produce a standard ECDSA signature, typically using Paillier homomorphic encryption for the underlying protocol (Lindell17, GG18, GG20). The resulting signature is fully vulnerable to Shor's algorithm on a quantum computer. Post-quantum threshold signatures, such as threshold ML-DSA, distribute a lattice-based key instead and produce a signature based on the Module Learning With Errors problem, which has no known efficient quantum attack. Threshold ML-DSA is an active area of academic research as of 2025 but is not yet deployed in production custody systems.
Q: What was the BitForge vulnerability?
A: BitForge (CVE-2023-33241) was a vulnerability disclosed by Fireblocks in 2023 affecting multiple implementations of the Lindell17, GG18, and GG20 threshold ECDSA protocols across more than a dozen wallet providers. It arose from improper zero-knowledge proof handling during Paillier key setup and allowed key-extraction attacks in some implementations. It is unrelated to quantum computing; it demonstrates that MPC systems have their own classical implementation risks separate from the underlying algorithm's quantum vulnerability.
Q: Is threshold ML-DSA available for institutional custody today?
A: Not yet in production. Research into efficient, scalable threshold constructions for ML-DSA (NIST FIPS 204) has progressed significantly, with peer-reviewed work published to the IACR ePrint archive in 2025 addressing the specific coordination challenges of adapting lattice-based signatures to multi-party settings. As of 2026, major MPC custody providers including Fireblocks, Coinbase, BitGo, Binance, and ZenGo continue to rely on threshold ECDSA or threshold EdDSA in their production systems.
Q: Why can't MPC custody providers just fix the quantum problem themselves?
A: Because the signature format an MPC wallet produces is dictated by the blockchain it is signing transactions for. MPC wallets are deliberately blockchain-agnostic, working across many chains precisely because they output standard ECDSA or EdDSA signatures that any supported chain will accept. If a blockchain's protocol only accepts ECDSA signatures, no amount of sophistication in the custody layer can produce a signature that chain will accept while also being quantum-resistant. The fix requires the blockchain protocol itself to support post-quantum signature algorithms like ML-DSA, which is why chains built natively on post-quantum standards matter independent of custody architecture. See more questions at qubitchain.io/faq.