Is an MPC Wallet Non-Custodial? (2026)
An MPC wallet can be custodial or non-custodial. It depends on who holds enough key shares to sign and whether you can recover or export without the provider.
Sometimes. MPC (multi-party computation) is a way of producing a signature from a key that has been split into shares, and it can be used on either side of the custody line. An MPC wallet is non-custodial when no one other than you holds enough shares to sign alone, and when you can recover access or export a usable key without the provider’s cooperation. If the provider can sign by itself, or if leaving depends on its permission, it is custodial or close to it, however advanced the cryptography.
For the basics of custody, recovery, and why “not your keys” matters, start with What is a non-custodial wallet?. To compare specific products, including hardware, phrase-based, and MPC wallets, see Best non-custodial wallets.
Disclosure: This guide is published by Nika, a non-custodial trading app. We build a product in this category, so we are not neutral. Product claims below link to each company’s own documentation. Access to perpetuals and prediction markets is subject to the underlying protocols’ terms and availability.
The short version
- MPC is a signing method, not a custody model. Exchanges, institutions, and consumer self-custody apps all use it.
- Count the shares. In a threshold setup, any group that meets the threshold can sign. Custody sits with whoever can meet that threshold without you.
- Check the exit. If the provider disappears or refuses to cooperate, can you still sign, recover, or export a full private key? The answer separates self-custody from dependence.
- A share alone is not a key. Below the threshold, a share should not let anyone sign or rebuild the key, provided the protocol is implemented correctly.
- MPC removes one risk, not all of them. It removes the single stolen phrase or file. It does nothing about a malicious transaction you approve yourself.
What is an MPC wallet?
An MPC wallet splits the authority to sign across several parties, such as your phone, a cloud backup, and a provider’s server. Each party holds a share. When you send a transaction, the parties holding enough shares run a protocol together and produce one signature, without any of them revealing its share to the others.
The most common form is a threshold signature. A “2-of-3” setup has three shares, and any two can sign. A “2-of-2” setup needs both. The Internet Research Task Force’s FROST specification (RFC 9591, June 2024) describes a threshold Schnorr scheme in exactly these terms. Each participant holds a share of one private key, and the security model assumes an attacker controls fewer than the threshold number of participants. The same document notes that FROST signatures made with its Ed25519 settings can be checked by an ordinary Ed25519 verifier. To the blockchain, the result looks like a normal single-key signature.
NIST runs a multi-party threshold cryptography project that describes threshold schemes as an application of MPC for spreading trust across parties. It published a first call for multi-party threshold schemes (NIST IR 8214C) in January 2026. That process is still under way. As of October 2026, there is no NIST standard that a wallet can point to as proof that its threshold scheme is correctly designed or implemented.
Two details matter for custody:
- How the shares were created. In some setups, shares are generated separately so the full key never exists in one place. In others, one party creates the full key and then splits it. RFC 9591 calls that party a “trusted dealer”. Whoever played that role once had the whole key.
- Signing shares vs backup shares. Some wallets split only a backup of the key, not the signing process. MetaMask’s social login is a useful example. It splits the secret that protects an encrypted copy of your recovery phrase across several server nodes. Your device still rebuilds the full phrase locally to sign. That is threshold cryptography used for recovery, not MPC signing. For how MetaMask, Trust Wallet, and Coinbase Wallet handle custody and backups, see Is Coinbase, MetaMask, or Trust Wallet Non-Custodial?.
The custody test for MPC wallets
The older test, “do you hold the private key?”, stops working when nobody holds a whole key. Two questions replace it.
1. Who holds enough shares to sign without you? List every share and who controls it: your device, your cloud account, the wallet provider, the app you signed up through, or an escrow agent. If any party other than you can meet the threshold on its own, that party can move your funds. That is custody, whatever the marketing says.
2. Can you recover or leave without the provider? If the provider’s server holds a share that every signature needs, the provider can stop signing, whether by choice, outage, legal order, or business failure. That is not the same as being able to take your funds. It is still a dependency. Self-custody in practice means a documented path to keep signing, or to export a full private key, that does not depend on the provider staying online and cooperating.
| Share arrangement | Who can sign without you? | Custody reading |
|---|---|---|
| 2-of-2: your device + provider server | Nobody | Self-custody only if there is a documented way to recover or export if the provider stops cooperating |
| 2-of-3: your device + your own backup + provider | Nobody; you alone hold two shares | Strong self-custody, provided your backup really is under your control |
| 2-of-3: your device + a backup the provider can unlock + provider | The provider, if it can unlock that backup | Effectively custodial |
| Provider holds every share, or enough to meet the threshold | The provider | Custodial, even though it uses MPC |
| Institutional setup, shares split across the client’s own teams and devices | Depends on the client’s policy | Self-custody for the institution, if no outside party can meet the threshold |
These are simplified patterns for comparison. Real products can add policy engines, time locks, or more parties. Read the provider’s documentation for the exact arrangement.
Real examples, and how they answer the test
These examples show how the test applies. They are not rankings, and each describes the provider’s own documentation as published when we checked in October 2026.
Zengo: 2-of-2 with an independent fallback
Zengo’s security model page describes two independently created shares, one on your phone and one on Zengo’s server. Signing needs both, so Zengo cannot move funds alone. For recovery, Zengo also keeps an encrypted copy of your device share, but the key to decrypt it sits in your own cloud account, so Zengo cannot use that copy by itself. Restoring access relies on factors such as your email, that cloud recovery file, and, for some accounts, a face scan.
The obvious concern with 2-of-2 is what happens if Zengo stops operating. Zengo’s answer is a guaranteed-access arrangement run by independent escrow and trustee companies. If they determine Zengo has stopped operating, they can trigger recovery through a public repository, which Zengo says is designed to let you access and spend your crypto without Zengo. Whether that fallback works when it is actually needed cannot be known in advance. What matters for the test is that Zengo documents an exit that does not need Zengo.
Binance Wallet: 2-of-3, with a backup choice that matters
Binance describes its Binance Wallet (also called Web3 Wallet on some Binance pages) as a keyless MPC wallet with three key shares: one on your device, one in an encrypted backup, and one held by Binance. Any two can sign or restore, so in the standard setup Binance cannot sign with its single share. Binance also says you need to be a verified Binance user to create the wallet, because it sits inside the Binance app.
The backup choice changes the analysis. Binance’s backup FAQ lists a cloud backup encrypted with a recovery password you set, a QR-code backup, and a “Quick Backup” option. With Quick Backup, a third-party provider stores your encrypted share and access depends on passing Binance’s security checks. That is convenient, but it means your second share is reachable through a process the company runs. Binance also documents a conversion to private key wallets that exports full private keys after identity verification in the app. That is a real exit, though it runs through the app.
Fireblocks embedded wallets: a third party in the middle
Fireblocks sells MPC wallet infrastructure that other apps build on. Its developer documentation for its legacy embedded wallet product describes an end-user share on the device and a share on Fireblocks’ servers. The disaster recovery documentation says that if Fireblocks stops operating, a full key takeover for end users needs the app operator (Fireblocks’ business customer) to run its own recovery endpoint using a recovery kit Fireblocks issued to it.
This example shows why the test has to look past the brand. With wallet-as-a-service products, three parties can be involved: you, the infrastructure provider, and the app you signed up through. Check what the app has set up, not just what the infrastructure makes possible.
MPC vs multisig: what is the difference?
Both spread signing authority across several parties. The difference is where the rule lives.
| Single-key wallet | Multisig | MPC (threshold signature) | |
|---|---|---|---|
| Keys | One full key | Several full keys, one per signer | One key, split into shares |
| Where the “M of N” rule lives | Nowhere | Onchain, in the script or smart contract | Offchain, in the signing protocol |
| What the chain sees | One signature | Several signatures, or a contract checking a threshold | One ordinary signature |
| Example | A standard phrase wallet | Bitcoin M-of-N transactions (BIP 11); a Safe smart account that requires a threshold of owners | Zengo, Binance Wallet |
| Chain support | Any chain | Depends on what the chain or contract supports | Any chain whose signature type the protocol supports |
| Can anyone verify the rules? | Not applicable | Yes, the rules are public onchain | No, the policy sits with the parties and the software |
| Changing signers | Move funds to a new key | Usually a contract or script change, sometimes a new address | Shares can often be rotated offchain; depends on the product |
| Custody answer | Whoever holds the key | Whoever controls enough of the signing keys | Whoever controls enough shares, plus the recovery and export paths |
Neither design is safer in every case. Multisig lets anyone verify the rules onchain but costs more to run and depends on chain or contract support. MPC works with standard signatures and can hide the setup, but you have to trust the provider’s description of how shares are held.
What MPC does not fix
- Approving a bad transaction. If you approve a malicious transfer or token allowance, the shares cooperate and sign it correctly. Phishing and blind signing are untouched by MPC.
- A compromised device. If malware controls the phone that holds your share and can drive the app, it can request signatures like you would.
- Provider availability. In a 2-of-2 setup with a server share, an outage or shutdown can block signing until a fallback kicks in.
- Implementation quality. “Uses MPC” names a category. Security depends on the specific protocol, the code, how shares are generated and stored, and whether they are refreshed. Look for published audits or open-source cryptography, and remember that an audit is not a guarantee.
- Export risk. Exporting a full private key is your exit, but once exported, that key is a single secret again, with the same risks as a seed phrase. Treat it that way.
Do MPC wallets have a seed phrase?
Usually not by default. Because no single key exists to encode, most consumer MPC wallets replace the written phrase with recovery factors: a cloud backup, an email login, a password, biometrics, or a combination. That removes the most common self-custody failure, a lost or exposed phrase. In exchange, your recovery now depends on those accounts and on the provider’s process. Some products also let you export a standard phrase or private key later, which turns the wallet back into an ordinary single-key wallet.
How to check an MPC wallet before you fund it
Ask these questions. The provider’s documentation should answer each one in writing.
- How many shares are there, and who holds each one? Include backups, not only signing shares.
- What is the threshold, and can any party other than you meet it?
- What happens if the provider goes offline or shuts down? Look for a documented fallback that does not need the provider.
- Can you export a full private key or phrase, and import it into a wallet you choose? Note any conditions, such as identity checks or app availability.
- Who generated the key? Distributed key generation means no one ever held the full key. A trusted-dealer setup means someone did.
- Is the cryptography audited or open source?
- Which accounts protect your recovery? Secure those email, cloud, and social accounts with strong two-factor authentication.
Which setup suits you?
- Long-term storage of a large balance. A hardware wallet, or a multisig where you hold enough keys yourself, is the more conservative choice.
- Funds shared by several people or a team. Multisig rules are visible onchain, so everyone can check them without trusting a provider.
- Everyday use without a written phrase. An MPC wallet is a reasonable option if the answers to the checklist above hold up, especially the exit path.
- You want the provider out of the picture entirely. A standard phrase wallet or hardware wallet, where only you hold the key.
Where Nika fits
Nika is a self-custody app, and the same test applies to it. Nika’s site says you hold the keys and that Nika never takes custody of your funds. Nika’s wallets use Privy as the wallet infrastructure (key-management) provider, and Nika does not hold users’ private keys. You can create an account with email, Google, or Apple without writing down or managing a seed phrase. Privy’s embedded wallets let users keep custody without managing seed phrases directly, and The Block describes Privy’s wallet stack as abstracting away seed phrases. On the exit question: for Nika’s wallets, both EVM and Solana private keys are exportable (Privy’s export documentation). Exportability gives you a way to use the underlying wallet outside Nika. Per Privy’s documentation, wallets created in an app can only be exported in a web environment, so you may need to use Nika on the web to export your wallet. Protect an exported key as carefully as a seed phrase.
Nika brings spot trading, perpetuals, and prediction markets into one app, alongside portfolio tools. Nika AI has no separate AI subscription fee; you pay the standard fees for the transaction or underlying protocol. Review the fees shown in the app before you confirm a trade.
Nika is not a hardware wallet. For a large balance you rarely move, hardware is still the better storage tool.
Related reading
- What is a non-custodial wallet? covers custody, recovery tests, and the main self-custody risks.
- Best non-custodial wallets compares hardware, phrase-based, and MPC wallets by use case.
- Is Coinbase, MetaMask, or Trust Wallet Non-Custodial? compares the Coinbase exchange account, Coinbase Wallet, MetaMask, and Trust Wallet.
- Your exchange just became a bank looks at what custodial exchange accounts mean for users.
FAQ
What is an MPC wallet?
A wallet where the authority to sign is split into shares held by different parties, such as your device, a backup, and a provider’s server. Enough shares cooperate to produce one ordinary signature without anyone revealing their share.
Is an MPC wallet the same as a non-custodial wallet?
No. MPC describes how signatures are made. Custody depends on who holds enough shares to sign without you and whether you can recover or export without the provider. Some MPC wallets are self-custody and some are custodial.
Can the provider of an MPC wallet steal my funds?
Not if it holds fewer shares than the threshold and cannot unlock your backup shares, assuming the protocol is implemented correctly. If it holds or can reach enough shares to meet the threshold, it can sign without you.
What happens to an MPC wallet if the company shuts down?
It depends on the documented fallback. Zengo, for example, uses independent escrow and trustee companies to release what users need to rebuild their keys if Zengo stops operating. Without a fallback like that, a 2-of-2 wallet with a server share could be stuck.
What is the difference between multisig and MPC?
Multisig uses several full keys and enforces the M-of-N rule onchain, where anyone can verify it. MPC splits one key into shares, enforces the threshold offchain, and produces a single ordinary signature.
Do MPC wallets have a seed phrase?
Usually not by default. They rely on recovery factors such as cloud backups, email, passwords, or biometrics. Some let you export a full private key or phrase later.
Is MPC safer than a seed phrase?
It removes the single point of failure of one phrase or file. It does not protect against approving a malicious transaction or a compromised device, and it adds reliance on the provider and your recovery accounts. Which is safer depends on how you manage each.
Is MetaMask social login an MPC wallet?
Not in the signing sense. MetaMask’s social login splits the secret that protects an encrypted backup of your recovery phrase across several servers. Your device rebuilds the full phrase to sign, so day-to-day signing works like a standard phrase wallet.
Sources
- IRTF RFC 9591: FROST threshold Schnorr signatures, June 2024
- NIST: Multi-Party Threshold Cryptography project
- NIST IR 8214C: First Call for Multi-Party Threshold Schemes, January 2026
- MetaMask Help: how social login works
- Zengo Help: security model, shares, and recovery factors
- Zengo Help: what happens if Zengo goes out of business
- Binance: Binance Wallet self-custody and key shares
- Binance FAQ: how to back up Binance Wallet
- Binance FAQ: Binance Wallet questions, including converting to private key wallets and the verified-user requirement
- Fireblocks developer docs: embedded wallet disaster recovery
- Bitcoin BIP 11: M-of-N standard transactions
- Safe docs: Safe smart account overview
- Nika Trade (account creation)
- Nika homepage
- Nika AI (no separate AI subscription fee; standard transaction or protocol fees apply)
- Privy docs: user wallets (non-custodial embedded wallets and key management)
- Privy docs: wallet export (EVM and Solana private keys)
- The Block: Stripe to buy Privy, June 2025
Explore self-custody with Nika
If you want a self-custody app that also brings spot, perps, and prediction markets into one interface, open Nika and check which products are available where you live.
This article is for informational purposes and is not financial, legal, or security advice. Self-custody means you are responsible for your keys, key shares, and recovery materials; losing them can mean losing funds. Transactions on public blockchains are typically final. Wallet designs, features, and terms change; confirm current details with each provider before you move funds.
