What Is an MPC Wallet? Key Shares Without a Seed Phrase

An MPC wallet is a wallet that signs using multi-party computation: instead of one private key stored in one place, the key exists only as separate mathematical key shares held by different devices or parties, which jointly compute a valid signature without ever assembling the key. Because a complete key is never created, there is usually no seed phrase to write down, and a stolen share below the signing threshold is cryptographically useless. What MPC does not decide is custody — that depends entirely on who holds the shares, and most consumer MPC wallets keep one share on the provider's servers and require it for every transaction. WATS is not an MPC wallet: it is seed-based self-custody across Ethereum, Arbitrum, Optimism, Base, Polygon, BNB Chain, Solana and TON, where the user holds the keys and WATS never holds a key or a key share.

The wallet where the private key never exists

An MPC wallet secures crypto using multi-party computation: the private key is generated as separate key shares held on different devices or parties, and it never exists in one piece — not at creation, not at signing. The shares jointly compute a valid signature through a threshold protocol, so there is no seed phrase and no single artifact whose theft loses everything.

That sounds like a contradiction — how do you sign with a key that does not exist? The answer is one of the most useful ideas applied cryptography has shipped into consumer products. It is worth understanding before you trust one, because the label "MPC" covers wallets with very different custody realities.

How can shares sign without the key ever existing?

The machinery is a threshold signature scheme (TSS). At setup, the participating devices run a distributed key generation ceremony: each produces its own secret share locally, and together they derive a single public key — your wallet address. No participant ever sees another's share, and no step ever assembles the full private key.

Signing is equally collaborative. Each share-holder computes over its own share, partial results are exchanged, and the output is one ordinary signature — indistinguishable on-chain from one made by a normal single-key wallet. Schemes are described as t-of-n: with 2-of-3, for example, any two shares can sign, so one lost share does not strand the funds and one stolen share cannot spend them.

Does MPC actually fix the seed-phrase problem?

A seed phrase is the entire key in a single artifact. Whoever reads it — a phishing page, a screenshot synced to the cloud, a visitor to your home — controls everything, permanently. That single point of failure has arguably emptied more individual wallets than any smart-contract exploit.

MPC removes the artifact. There is nothing to write on paper, no complete key sitting on any one device, and a stolen share below the threshold is cryptographically useless. Mature implementations add share refresh: shares are periodically re-randomized without changing the address, so shares stolen months apart cannot be combined. It is a genuinely different model — one of several modern alternatives, weighed against each other in seedless vs NFC vs hardware wallet security in 2026.

It is worth being precise about what has moved, though. MPC removes the artifact, not the responsibility. A phrase you can lose is replaced by shares you can lose, and by a recovery process someone else designed. Seed-based wallets attack the same problem from the other end — a single phrase you store offline, with the discipline that requires — and neither approach makes the trade-off disappear.

Who holds the shares in a real MPC wallet?

This question decides everything, because MPC describes cryptography, not custody. Real products sit on a spectrum. Most consumer MPC wallets run a co-signing model: one share on your phone, one on the provider's servers, both required for every transaction. Enterprise MPC custody sits further along — the provider's infrastructure holds the shares, and you hold an account with policies and permissions.

Where a product lands determines whether it is self-custody at all — the same test explored in custodial vs non-custodial wallets. Three honest questions cut through the branding:

• Can you export? Some wallets can reconstruct a full private key on your device as an escape hatch; others make reconstruction impossible by design. Know which one you are buying.
• What if the provider disappears? If its share or its servers must participate in every signature and there is no export path, its outage — or bankruptcy — is your outage.
• Is a lost share recoverable? Who runs recovery, what do they demand from you, and could the same process be triggered by someone who is not you?

For comparison, the answer in a plain non-custodial wallet is trivial: there is no second share and no counterparty in the signing path, so no provider can be offline at the moment you need to move funds. That simplicity is exactly what you are trading away when you choose a co-signed MPC product, and it is worth choosing on purpose rather than by default.

What is the difference between MPC and multisig?

Both distribute signing power; they do it in different layers. MPC works off-chain, in cryptography: the chain sees one standard signature and never learns that several parties produced it. A multisig wallet enforces its policy on-chain: a smart contract or a chain's native script demands multiple distinct signatures, and anyone can read the rules.

	MPC (threshold signatures)	Multisig
Where the policy lives	Off-chain cryptographic protocol	On-chain contract or script
What the chain sees	One ordinary signature	Multiple signatures, visible logic
Chain support	Any chain using the same signature algorithm	Per-chain contracts or native features
Transparency	Policy invisible, private	Policy public, auditable
Changing participants	Reshare without changing the address	On-chain transaction to update signers

Neither is strictly better. Teams that want publicly verifiable governance tend toward multisig; products that want one address behaving identically across many chains, with the policy kept private, tend toward MPC.

What are the trade-offs of MPC wallets?

Vendor dependence. If the provider's share, servers or app are load-bearing and there is no export path, you have traded a seed-phrase single point of failure for a company-shaped one. The cryptography can be flawless while the business fails around it.

Closed implementations. Threshold signing is genuinely hard cryptography, and researchers have repeatedly disclosed exploitable flaws in shipped threshold-ECDSA implementations. Many consumer products are closed-source, so you are trusting audits you cannot read against protocol bugs you cannot see.

Recovery UX. With a seed phrase, any standard wallet can restore your funds. With MPC, recovery is whatever the provider designed — encrypted cloud backups of your share, identity-verified restores, or nothing. That can be friendlier than paper for beginners, but it is bespoke, and bespoke means untested by the wider ecosystem.

How WATS fits in

WATS is seed-based self-custody, not MPC and not multisig — you hold your keys, and WATS never holds a key or a key share, so nothing on the WATS side has to co-sign, approve or stay online for you to spend. Its hardware layer is NFC card–device pairing: the WATS NFC Metal Card is a tap-to-authenticate companion that stores no private keys and no shares, carries a unique card ID and pairs to exactly one device, so it changes who can act on that device rather than where the keys live. The same model runs across all four products — the Chrome extension, the mobile app, the Hot Wallet and the card.

In the WATS Hot Wallet, the network fee for every transaction is charged in one token, ATS, instead of the chain's native gas: via an ERC-4337 paymaster on EVM and an equivalent fee-payer/relayer on Solana and TON. ATS is a LayerZero OFT — one balance across Ethereum, Arbitrum, Optimism, Base, Polygon, BNB Chain, Solana and TON — and collected ATS is burned from 100M toward a 30M floor. That is not a discount; it changes which token pays the fee, not what the transaction costs.

So the practical read is this. If what attracts you to MPC is deleting the seed-phrase artifact, go in with the export and provider-failure questions answered in writing before you fund anything. If what attracts you to it is simply not wanting a company able to freeze you, you do not need threshold cryptography for that — an ordinary non-custodial wallet already gets you there. Installing WATS from the download page, writing down the phrase it generates before funding it, and adding the NFC Metal Card if you want a physical tap step on the device is the concrete version of that path: no provider share in the signing loop, and one ATS balance covering fees on all eight chains.