HYBRID DEVNET · PUBLIC EVIDENCE LIVEVerifiable infrastructure for value, markets, identity, and operational dataInspect the network

Wallets & recovery

How does MPC differ from giving a custodian control of our assets?

3 min read

MPC describes how signing participants cooperate; custody describes who has effective authority over assets. Distributed signing can support a customer-controlled arrangement, but the technology name alone does not tell you who controls approvals, recovery, or enough participants to sign.

One term is about technology; the other is about control

MPC, or multi-party computation, lets participants cooperate in a cryptographic task. A threshold wallet requires an agreed number of participants to contribute to signing. Custody asks a different question: who can effectively decide to move the assets? A service can use sophisticated distributed signing while still having practical control over all the relevant authority. Conversely, distributed signing can be part of a design in which the customer retains essential authorization.

Counting participants is not enough

Five servers do not necessarily mean five independent decision makers. They may share one administrator, organization, or recovery route. Ask who operates the participants, who can change the threshold, and whether customer approval can be bypassed. Include exceptional procedures in that review. A well-presented architecture diagram should make those responsibilities easier to understand, rather than using the number of components as a substitute for explaining who can act.

Compare the experience during a problem

Consider an unavailable provider, a compromised administrator, and an employee leaving the business. Ask what each arrangement allows in those situations, what stops an unauthorized transfer, and what a legitimate customer must do to continue. The aim is not to assume that one technology label settles every risk. It is to choose a supported arrangement whose authority and recovery rules match your needs, and to confirm those rules through documentation and agreed tests before relying on it.

Illustrative example

Compare two deployments with the same threshold but different organizations controlling the participants.

In plain language

Permission, signing, and completion are different

Think of a business bank payment: preparing the instruction, approving it, and seeing it complete are separate events. A wallet workflow also has distinct responsibilities. Authorization means the required person or policy permits a particular action. Signing means the participating systems produce the cryptographic signature needed for that action. Completion means the relevant system has accepted or settled the result under its rules. A screen displaying a wallet, or a service responding successfully, does not combine these steps into one. In Hybrid-Chain, customer authorization is separate from distributed signing participation. When reviewing a status, ask which of these stages it describes, which asset and network it concerns, and whether the evidence is current. This distinction helps prevent a common mistake: treating an informational record as permission to move money. An operator should be able to explain the stage in ordinary language without asking you to share any secret material.

In plain language

Recovery is an authority decision, not just a backup

A backup helps preserve information; a recovery process determines how access or authority can be restored when something is lost or unavailable. Those are related but different jobs. For a business wallet, the plan should say who can start recovery, what evidence they must provide, who approves it, and what old access is removed afterward. It should also explain what happens if the usual person, device, or service cannot participate. A process that quietly lets one provider replace the customer’s authority may change the practical custody model, even if everyday signing uses several participants. Do not assume a support team can override the rules or retrieve lost signing material. Ask for the supported procedure for your exact deployment and rehearse it in an agreed safe environment. Record responsibilities and escalation contacts without storing secret recovery material in the same document as ordinary operating instructions.

Conditions & limitations

Do not assume that multiple servers mean independent control or that every MPC service is self-custodial.

What to do next

Compare operators and administrative boundaries, not only the number of shares.

Compare wallet architectures ↗