Key Ceremony Failures: MPC and Multisig Operational Risk
Bybit lost more than 1.5 billion dollars in early 2025 while running a multi-signature cold wallet exactly as designed. The forensic review confirmed Bybit's own systems were not breached; attackers compromised a Safe{Wallet} developer's credentials, injected malicious JavaScript, and showed each signer a counterfeit interface displaying a routine transaction while they authorized transfer of control to the attacker. Every signature was valid and the cryptography held. What failed was the layer between human intention and cryptographic signature — the operational risk MPC and multisig do not, by themselves, remove. As one custody analyst put it after a year of failures, Prime Trust was regulated, Bybit's wallet was multisig, Zondacrypto had a cold wallet — all three failed, for three completely different reasons. For an allocator, the label on the custody arrangement matters less than the operational reality behind it.
The Primitives and Trust Assumptions
Both schemes eliminate the single private key but enforce trust in different places. Multisig requires M of N independent full keys to sign, enforced on-chain by a contract like Safe; a compromised individual key is still valid but is only one of the required set, and the contract is transparent and auditable. Its trust assumption is that the signers, their devices, and the interface they sign through are independent. MPC (a threshold signature scheme) never assembles a complete key — it distributes key shares across parties, no full key ever exists, and it produces a standard signature that works on any ECDSA or Schnorr chain while allowing share rotation without changing the address. Its trust assumption moves to the share-generation ceremony, the protocol implementation, and the environment where shares compute. The shared truth that matters: neither scheme validates what is being signed. A hardware key protects the signature; it does not tell the signer in honest human terms what the payload does, and a complex contract-wallet payload is an unreadable hash on a small screen. Attackers target the gap between intention and signature, not the cryptography.
Where the Failures Land
Four ceremony and operational failure modes recur. First, interface compromise: the Bybit pattern, where a poisoned front-end or manipulated proposal pipeline shows signers one thing while they sign another — the entire security stack collapsed to a single compromised UI even with multiple valid signers. Second, the setup ceremony: MPC share generation or a multisig's initial signer configuration done on compromised machines, with weak entropy, or without verifying every participant seeds a flaw into every later signature. Third, signer concentration disguised as distribution: N signers sharing a laptop image, a single UI portal, one office, or one hardware vendor are correlated, not independent — the M-of-N math assumes independence the deployment quietly violated. Fourth, the reachability failure: Zondacrypto's inversion, where the backstop wallet depended on one unreachable person, turning the safety mechanism into the single point of failure. The blast radius runs downstream — custody sits upstream of almost every institutional crypto product, so a signing failure at the custodian propagates into every fund, treasury, and product depending on it.
What to Watch, Real Defenses, and the Playbook
Warning signs precede these failures: signers who cannot describe an out-of-band verification step, a single UI or vendor across all signers, "routine" as a word anyone uses about large transfers (routine is precisely the mindset the Bybit attackers exploited), no timelock on large movements, and a setup ceremony with no independent attestation of how shares or keys were generated. Real defenses are specific and now increasingly standard: independent verification of every payload on a second channel before signing; signing devices that decode and display transaction meaning rather than a hash; simulation tools that preview a transaction's actual on-chain effect; timelocks that delay large movements long enough for human review; genuine signer independence across hardware, interface, and geography; and an institutional rule that no transaction is routine. Fake defenses are the dangerous part: treating "we have multisig" or "we use MPC" as a conclusion rather than a starting point, counting N signers without auditing their independence, and trusting a hardware wallet against a payload the signer cannot read. The playbook: run key generation as an attested ceremony with documented independence, put every signing workflow behind second-channel verification and simulation, timelock and policy-gate large movements, and audit the signing workflow — not just the smart contract — because since Bybit that is where specialist auditors focus.
Residual Risk and What Is Improving
The residual risk is irreducible: distributed signing moves the attack surface from the key to the humans, interfaces, and ceremonies around it, and no arrangement removes it entirely. For distributed custody to support 10x institutional adoption, three things must generalize: hybrid MPC-plus-multisig architectures with independent co-signing validation as the default rather than the premium tier; signing-workflow audits treated as seriously as smart-contract audits; and clear-signing hardware — devices showing human-readable transaction meaning — becoming table stakes so the intention-to-signature gap closes at the point of signing. The constructive signal is that the industry learned the right lesson from the most expensive breach in its history: the post-Bybit consensus is not "add more signers" but "validate what the signers see," and the tooling to do it — transaction simulation, second-channel verification, decode-and-display devices, attested ceremonies — is shipping into standard custody stacks. The cryptography was never the weak point; the operational discipline around it is finally catching up to the assets it guards.
For informational purposes only. Not an offer to buy or sell any security. Available only to accredited investors who meet regulatory requirements.
