MPC vs Smart Contract Wallets: Security, Recovery and Custody

On 21 February 2025, signers at the exchange Bybit approved what looked like a routine transfer from a cold wallet. The screen they saw was fake. Behind it, attackers had swapped the wallet's logic, and about $1.45 billion left the exchange in one of the largest thefts in financial history. The smart contracts did exactly what they were told. The weak point was the moment a human decided what to sign.

That incident sits at the centre of the most important design argument in digital asset custody. One camp splits the private key into pieces using multi-party computation (MPC). The other moves the security rules into the wallet itself, as a smart contract on the blockchain. Both exist to kill the single private key, the failure point behind most crypto losses. They do it in very different ways, with different costs, recovery models and blind spots.

The problem both are solving

A standard crypto wallet is controlled by one private key. Whoever holds it can move everything, instantly and irreversibly. Lose it and the funds are frozen forever; leak it and they are gone. For an individual that is stressful. For a company holding customer money it is unacceptable, which is why exchanges, fintechs and funds spent the past five years building alternatives.

The numbers explain the urgency. Chainalysis found that private key breaches at centralised services made up 88% of stolen value in the first quarter of 2025, according to The Block. Individuals suffered too, with 158,000 personal wallet compromises over the year. The question is not whether to move beyond the single key. It is which replacement fails more gracefully.

How MPC wallets work

In an MPC wallet the private key never exists in one place. Instead, two or more parties each hold a share, and a cryptographic protocol lets them jointly produce a valid signature without ever assembling the full key. A typical consumer set-up keeps one share on the phone, one with the wallet provider and one in an encrypted backup. A typical institutional set-up spreads shares across servers, hardware modules and the devices of named approvers.

Three features make MPC attractive:

• It looks ordinary on-chain. The output is a normal signature from a normal address. It works on any blockchain that uses standard signatures, which is why multi-chain businesses like it.
• No extra gas. Because the chain sees a single signature, there is no on-chain overhead per transaction.
• Shares can be refreshed. Providers can rotate shares without changing the address, so a leaked share can be made useless.

The trade-off is that the rules live off-chain. Spending limits, approval quorums and allow-lists are enforced by the provider's software, not by the blockchain. If that software, or the provider itself, fails, the user depends on whatever recovery process the provider designed. MPC is also hard to audit from outside: the chain cannot show you how many parties approved a transaction.

How smart contract wallets work

A smart contract wallet, often called a smart account, puts the control logic on the blockchain. The wallet is a program that decides which signatures count, how many are needed, what limits apply, and how keys can be replaced. Multisig contracts were the first version; Safe, the largest, held $35.25 billion across 61.11 million accounts at the end of March 2026, according to its quarterly report.

Two standards made smart accounts mainstream on Ethereum and compatible chains:

• ERC-4337, live since March 2023, created a separate flow for "user operations". Bundlers package them, a shared EntryPoint contract verifies them, and paymasters can cover gas so a user can pay fees in USDC or have an app pay for them, as Alchemy's overview explains.
• EIP-7702, activated in Ethereum's Pectra upgrade on 7 May 2025, lets an ordinary address delegate to smart account code without moving funds or changing address. By October 2025 it was live on 25 mainnets, according to Turnkey.

Adoption has moved quickly. Citing BundleBear data as of 16 September 2026, Eco reported 1.28 billion cumulative ERC-4337 user operations from 66.6 million accounts, and 247.2 million EIP-7702 authorisations, with 57.8 million wallets holding a live delegation. Not every delegation is benign; security researchers have flagged contracts designed to sweep funds from users tricked into signing.

Side by side

In practice, the line is blurring. Many consumer smart wallets use passkeys or MPC to control the signer, then wrap it in a smart account for recovery and gas sponsorship. Many institutions run MPC for daily operations and keep reserve funds in an on-chain multisig. Hybrid is the default for anyone serious.

MPC hides the rules inside a company; smart accounts publish them on-chain. Neither protects you from signing the wrong thing.

Recovery is where they really differ

Ask what happens when a phone falls into the Hooghly. With an MPC consumer wallet, the user logs in on a new device, proves identity to the provider, and the provider helps generate a fresh share. Convenient, but the provider has a strong say in who gets access. With a smart account, recovery is written into the contract: a set of guardians, perhaps a spouse, a hardware key and a recovery service, can approve a new signer, often after a waiting period so a thief cannot drain funds immediately. LCX notes that some wallets deliberately build in such delays, trading speed for safety.

Neither model needs a seed phrase written on paper, which is the main reason they are spreading. The broader shift is covered in our report on self-custody wallet adoption, and the basic custody choice in self-custody versus custodial wallets.

Wallet-as-a-service and the concentration question

Few companies build wallets from scratch any more. They rent them. Wallet-as-a-service providers offer key management, either MPC or secure hardware enclaves, plus bundlers and paymasters for smart accounts, through an API. A money transfer app or digital bank can then give every customer a wallet without touching cryptography.

This is efficient and it concentrates risk. Two providers, Pimlico and Alchemy, handled about 65% of ERC-4337 user operations as of the first quarter of 2026, according to Eco's summary of BundleBear data. A serious outage or compromise at a dominant infrastructure provider would affect many apps at once. For payment companies, the questions to ask a vendor are blunt: who holds which key share, what happens if the vendor goes bankrupt, and can users leave with their funds without the vendor's cooperation? Firms using stablecoins for corporate treasury face the same diligence.

A worked example: the cost of on-chain rules

Consider a payments firm moving stablecoins for 10,000 transfers a month. Eco puts ERC-4337 validation overhead at roughly 60,000 gas per transaction compared with a plain wallet, and an EIP-7702 authorisation at roughly 50,000 gas.

1. Extra gas per month with ERC-4337: 10,000 x 60,000 = 600 million gas.
2. Assume a low-fee network at 0.01 gwei with ETH at an illustrative $3,000. 600 million gas x 0.01 gwei = 6 million gwei, or 0.006 ETH, about $18 a month.
3. Assume Ethereum mainnet at an illustrative 2 gwei. The same overhead is 1.2 ETH, about $3,600 a month.
4. MPC on the same transfers adds no gas, but the firm pays its key-management provider instead, and gets no on-chain proof of its approval rules.

The lesson: on low-fee chains, the overhead of programmable accounts is trivial and the auditability is nearly free. On expensive chains, high-volume senders have a real incentive to use MPC or batch transactions. Gas prices and token prices move constantly, so firms should rerun the sums with live figures. Chain choice matters more than wallet type for this bill, as we discuss in the best blockchain for stablecoin payments.

The Bybit lesson for institutional custody

Bybit used a multisig smart wallet for its cold storage. Safe's forensic review found no vulnerability in its smart contracts; instead a compromised developer machine let attackers serve signers a disguised malicious transaction, according to a compilation of incident reports by DeepStrike. The FBI attributed the theft to North Korean hackers.

The broader data points the same way. TRM Labs found that infrastructure and operational compromises made up about 15% of incidents in the first half of 2026 but about 76% of losses, per the same DeepStrike summary. CertiK counted $444.53 million lost to wallet compromises across just 33 incidents in that half-year. The losses are concentrated in a few catastrophic failures of keys, credentials and approval workflows.

For custodians, three conclusions follow. First, the signing interface is part of the security perimeter and needs independent verification, for example a second device that decodes and displays the transaction. Second, MPC and multisig are complements: MPC can protect each signer's key while the multisig enforces quorum on-chain. Third, policies such as allow-listed destination addresses and time locks on large transfers matter more than the cryptography. Compliance teams will recognise the same logic in AML and sanctions controls.

This is general information, not security, legal or investment advice. Custody architecture for customer funds should be reviewed by qualified security professionals and counsel.

What to watch next

• Safe's Q3 2026 report, expected late October 2026. Watch whether assets secured keep rising after the record account growth of March.
• Chainalysis crypto crime update, expected December 2026. The key metric is whether private key and infrastructure compromises still dominate losses.
• EIP-7702 delegation quality through 2026. With 57.8 million live delegations as of September, expect more research separating genuine smart account upgrades from malicious sweeper contracts.
• Full-year 2026 security reports from CertiK and TRM Labs, early 2027. They will show whether the first-half pattern of few, huge infrastructure losses held.

The MPC versus smart contract argument is no longer a contest with one winner. It is a question of where each belongs. MPC suits keys that must work across many chains with no on-chain footprint. Smart accounts suit funds that need rules everyone can verify. The firms that get custody right in 2026 use both, and spend as much effort on the approval screen as on the cryptography.

About this researchMuffinPay InsightsIndependent analysis of stablecoins, CBDCs, cross-border payments and digital public infrastructure. Every figure is linked to its source. Read our editorial standards →