Key Management: Multisig, MPC & Hardware Wallets

01 · Concept — what problem does it solve?

A single private key is a single point of failure in both directions. Someone steals it and the funds are gone. You lose it and the funds are gone. There is no reset and no support desk.

Key management is the set of designs for getting out of that corner, and they fall into three moves. Isolate the key so malware cannot reach it (hardware wallets). Split the authority so no single key is enough (multisig, MPC, secret sharing). Delegate recovery so a lost key is not fatal (social recovery). Each move trades one risk for another, and the useful question is always where did the single point of failure go?

02 · Mechanics

• Hardware wallet. The key is generated inside a secure chip and never leaves it; the device signs on-screen and hands back only the signature. It defeats malware that steals keys from a computer. It does not help if you approve a transaction whose contents you never actually read.
• Multisig (m-of-n). An on-chain smart-contract wallet, such as Safe, that only moves funds when m of its n owner keys sign — commonly 3-of-5. Policy is enforced by the contract and visible to everyone; each signer's key can live on a different device.
• MPC / threshold signatures. The key is never assembled anywhere. Each party holds a share, and together they produce one ordinary-looking signature. On-chain it is indistinguishable from a normal address; the approval policy lives off-chain, in the provider's or protocol's software.
• Secret sharing (e.g. Shamir). A seed is split into shares, any threshold of which rebuilds it. Unlike MPC, the whole key does reappear on one device at recovery time.
• Allowances and permits. Approving a token lets a contract spend it until you revoke. A permit is the same authority granted by an off-chain signature — signing something that looks like a login can be spending.
• Timelocks, allowlists, spending limits. A delay between "approved" and "executed", so someone has a window to notice and veto.

03 · Formulas

Multisig turns a key-theft probability into a quorum problem. If each of n keys is independently compromised with probability p, an attacker needs at least m of them:

P(theft) = Σ  C(n,k) · pᵏ · (1−p)ⁿ⁻ᵏ        for k = m … n

3-of-5, p = 5% per key:
  = 10·p³·q² + 5·p⁴·q + p⁵
  ≈ 0.1128% + 0.0030% + 0.00003%  ≈ 0.116%
single key:  5%          →  about 43× safer

The same arithmetic runs the other way for loss: with 3-of-5 you are locked out once 3 keys are gone, so quorum size is a dial between "hard to steal" and "easy to lose".

The number above is only true if the keys fail independently. That assumption is where the formula breaks, and it is the entire lesson of the next box.

04 · Edge cases & risks

• Blind signing is the gap that remains. Hardware wallets often show only a hash or unreadable calldata for complex transactions. The defence is verifying the destination and the operation type on the device, not in the app that built the transaction — in Bybit the operation switched from a plain call to a delegatecall, a difference the device could show but the interface hid.
• Big losses are rare and small losses are constant. Chainalysis counts about 158,000 personal-wallet compromise incidents in 2025, hitting at least 80,000 victims for $713M — 20% of all value stolen, down from 44% in 2024. Meanwhile the largest single hack is now more than 1,000× the median incident. Those are different threat models, and a bigger quorum only helps with one of them.
• Quorum loss is permanent. Lose enough signers — to death, a lost device, a departed employee — and the funds are as gone as with a single lost key. Inheritance and rotation plans belong in the design, not after it.
• Upgrade keys are keys too. A protocol whose admin key is one EOA is a single point of failure wearing a multisig-shaped costume. See Smart Contract Security.
• The human is the endpoint. Compromised developers, phished signers and coerced holders all bypass the mathematics. Splitting keys across people helps only if those people are not all reachable by the same attack.