Threshold signatures versus multiple signatures: Which is more secure?

Your signature model is not a "side task"

If you hold or transfer real assets, then your signature model is not a "side task". It is the core itself-the control surface, the gate between intention and loss.

In serious encryption operations, there are two mainstream models: classical multi-signature and threshold signature. From the outside, they are quite similar; but the internal mechanisms are quite different. The right choice depends on how you weigh cryptographic risks, human processes, costs on the chain, and the scope of damage if something goes wrong.

This article will maintain a pragmatic style: explore what each model actually protects, how it fails in a real environment, and where costs and audit trajectories fall. Finally, a directly usable decision matrix is provided.

Comparison of core points

Security model: Multiple signatures enforce the quorum through on-chain scripts or contracts; threshold signatures (TSS/MPC) complete the quorum confirmation offline, generating a signature that is regarded as a single key on the chain.

Costs and Footprints: In the Taproot/Schnorr environment, FROST or MuSig2 can compress inputs to approximately 57.5 vB, while 2-of-3P2SH is approximately 296 vB and 3-of-5P2WSH is approximately 350 vB. In high-threshold scenarios, costs can be reduced by approximately 80%.

Failure Mode: TSS can suffer round-of-the-clock abuse or denial of service attacks at the protocol level; multi-signature risks key loss, policy errors, or N-of-N deadlock. Most significant losses stem from key or permissions issues, not mathematical loopholes.

Auditable: Multiple signatures can be proved directly on the chain;TSS is like a single signature on the chain, so strong off-chain logs and certificates are required for auditors to verify.

Application scenarios: TSS is suitable for scenarios where low-cost, high-throughput, and EOA is preferred; multi-signature is suitable for conservative operations, focusing more on on-chain policy visibility and simple recovery than on cost savings.

What each model actually protects

Both methods prevent a single signer from transferring funds after being breached, but they anchor trust in different places.

Multi-signature in practice

Multi-signature encodes policies onto the chain. On Bitcoin, it appears as a P2WSH or Taproot script path; on Ethereum and other EVM chains, it is a smart contract wallet. Quorum checks are conducted on-chain. If the threshold is not reached, the network will refuse to spend. The logic is very direct.

Advantages: is transparent to auditors and can be restored through basic tools. Disadvantages: On Bitcoin, if the Taproot keypath form is not used, a high threshold results in more space on the chain; on EVM contracts, gas costs are higher than simple EOA. In addition, if the Taproot path is not used carefully, some strategies may be spotted by on-chain analysts.

Threshold signature in practice

Threshold signatures divide the private key into multiple copies and coordinate through an off-chain signature protocol, allowing t-of-n participants to generate an aggregate signature. Only one signature from a single key is seen on the chain. In the ECDSA environment, it may be a GG18 or GG20 style MPC; in the Schnorr environment, you will hear FROST or MuSig2.

Advantages: has a smaller, cleaner footprint on the chain, and provides a familiar EOA interface for DApps. [TAG Security depends on the distributed protocol and its coordination mechanisms, as well as the off-chain monitoring and logging system you are running.

Footprint, Cost, and Privacy on the Chain

Cost and fingerprint identification become critical when you sign hundreds or thousands of times a day, or rotate cold storage infrequently but involve large amounts of input.

On Bitcoin, fee calculations have changed with the advent of Taproot and modern Schnorr-based schemes. According to the July 2026 escrow comparison, the input for FROST or MuSig2 is approximately 57.5 virtual bytes, while the classic 2-of-3 P2SH input is approximately 296 vB and the 3-of-5 P2WSH is approximately 350 vB. In the high-threshold example, fees are reduced by approximately 80%.

On Ethereum, TSS lets you appear as a single EOA, completely avoiding contract execution overhead. On busy paths, this can create significant gas differences. But the cost is that you give up contract-level security barriers and visibility that can be critical to treasury management.

In terms of privacy, TSS is better because everything looks like a single key. When using multiple signatures, unless you use Taproot carefully, certain policy details will be leaked at the time of spending.

Professional tip: If you prioritize Bitcoin and care about fees, using FroST or MuSig2 's Taproot keypath spending can save costs and protect policy privacy. But it is important not to skip the operational enhancements needed to make the TSS operate safely in practice.

Failure Mode That Keeps Me Up At Night

Most of the losses in the headlines are not because elliptic curves are breached, but because keys, permissions, or signature processes are compromised.

The security review report for the first half of 2026 counted 344 incidents, with a total loss of US$1.315 billion, of which wallet intrusion was the most expensive loss carrier, with losses reaching US$444 million in 33 cases. This is the background to any TSS discussion with multi-signature: Your operational discipline often determines the outcome more than the mathematics itself.

How TSS fails

TSS is powerful, but there are sharp edges in the protocol. On July 3, 2026, THORChain released a vulnerability report describing an incident on May 15: an attacker used its GG20-based TSS to deliberately fail signature rounds 864 times in approximately two and a half days, leaking enough keying material from other verifiers and stealing approximately $10 million.

This is not a blanket denial of TSS, but it is a resounding reminder that round-based agreements require strict termination rules, activity protection mechanisms, and the ability to detect duplicate manipulation. In addition, there is a need for rapid rotation and share refreshments of programs, and these programs are actually executed rather than just staying on wiki pages.

How to invalidate multi-signatures

The biggest enemies of multi-signatures are lost keys and incorrect policy configuration. In the 2-of-3 model, if two keys are lost and there is no time-delayed recovery path, funds will be frozen. On EVM, contract multi-signature may be escalated to a failure state if the governance key or administrator key is not fixed. People will still forget to set reasonable daily limits, or bypass limits "for speed" and will never re-enable them.

Most of the losses started offline.

To emphasize this point, it was reported that in late July 2026, multiple cross-chain agreements were looted within hours, with a total loss of more than US$35 million. These are not cryptographic failures, but due to key leaks or rights logic flaws.

So the question is not just "which math is safer", but which setting will allow your team to lift the stone less to shoot themselves in the foot.

Operational reality: Who is running what and where is it running

What does your team actually run every day? This partly determines safety and cost.

TSS Operations

Infrastructure: You need a coordinator, network reachability between signers, and a monitoring system to detect failed or suspicious rounds. Cloud deployments are common, but don't ignore HSMs or security enclaves used for share hosting.

Usability: A quorum must be available online to sign. This raises questions about geographical redundancy, DDoS resilience and emergency fallback solutions.

Rotation and Refresh: A good TSS architecture supports refreshing keys without transferring funds. Please perform and practice regularly. Suppose at least one share of the equipment will be lost or damaged at some point.

Supplier Risk: If you use a service provider, you will inherit their process guarantees. Require an export path, independent share custody, and proof that you can audit.

Multi-signature operation

Device: Use hardware wallets in conjunction with the PSBT process on Bitcoin, and use the contract multi-signature interface on EVM. Keep a key offline for cold path.

Recovery: You can change signers by transferring funds to a new address with a new policy, or using a contract upgrade hook. The process is slower and more visible, but straightforward.

Activity: Any subset that reaches the threshold can be signed without a coordinator. This reduces one moving part but does not eliminate human error.

Human factors: Clear processes-who can propose, who can approve, and time-delayed channels for large transfers-are key to the success or failure of most teams.

Audability and compliance expectations

Auditors and regulators like visible controls. Multiple signatures provide this almost for free. The address or contract encodes a policy that can be verified on the chain. On Bitcoin, you can also reserve alternate spending paths after a time lock. On EVM, you can prove role assignments and quotas through contract status.

TSS looks like a single signature on the chain, which is good for privacy and cost, but pushes the burden of proof down the chain. If you have strong logging, signer certificates, SIEM hooks and regular external certificates, this is fine. If not, the auditor will ask: Is this just a step in more hot wallets?

For many vaults, the most labor-saving path is mixed use: TSS is used for high-frequency execution (with significant cost impact), while visible, traditional multi-signatures with time locks are used for cold or warm storage.

Decision Matrix: Make choices for your technology stack

Standards: On-chain costs

Threshold signatures: Taproot FROST/MuSig2 has the lowest cost on Bitcoin and the lowest cost as an EOA on EVM

Multiple signatures: At larger thresholds, P2SH/P2WSH costs are higher, and EVM contract wallets cost more.

Standards: Policy visibility

Threshold signature: Hidden on-chain, requiring off-chain evidence and logs

Multiple signatures: Mandatory on the chain and usually visible, easy to audit

Standards: Operational complexity

Threshold signature: Higher-Requires coordinator, network, turn processing, share refresh

Multiple signatures: Lower-Devices and scripts, fewer active parts

Standard: Failure Mode

Threshold Signature: Protocol-level traps, round abuse, vendor dependence

Multiple signatures: Key loss, wrong threshold setting, governance errors

Standards: Best use

Threshold signature: Market makers, exchanges, automated processes that require cost efficiency

Multiple signatures: Treasury, DAO, foundations that prioritize transparency and resilience

If you prefer TSS, check the following

What are the protocol variants you actually use? Please request an easy-to-understand copy of the paper and external review summary.

What are the termination rules? Will repeated terminations trigger alerts and remedies, or can attackers quietly consume turns?

How often do you refresh your share? How to arrange and justify this process?

Do you have a demonstrable separation of responsibilities between coordinator operations and share custodians?

If you prefer multiple signatures, check the following

Can you afford to lose any single device? What about two? Test first without moving real funds.

Are time locks and expenditure limits for large transfers actually enabled, or are they just written in the policy document?

Who can upgrade or rotate contracts on EVM? How to govern?

Is your address type enough to save money for your transaction volume? Do I need to migrate to the Taproot path?

Common errors and safer default settings

Confuse redundancy with backup: The share of TSS is not a classic seed and cannot be forgotten after writing it on a steel plate. Plan share refreshments and event rotations and record them like an airline checklist.

Skip activity and exception monitoring: If multiple TSS rounds fail in succession, this is an event that requires a call response, not a log entry.

Run N-of-N multisignature "just for a week": It will become permanent. Once a piece of equipment is lost, funds are locked.

Trust the administrator key on the EVM multi-signature: Put upgrade privileges under the same or stricter quorum as spending and increase latency.

Ignoring supply chain risks: Have an alternate hardware wallet and secure firmware path. Review the export and recovery plan of any MPC vendor before joining the job.

Professional Tip: No matter which plan you choose, conduct a complete rotation drill every quarter. Rotate one signer, certify the process, and confirm that downstream systems continue to work. This is the fastest way to discover hidden assumptions.

If you want a fast mind model: TSS optimizes execution performance and privacy, but requires excellent operational hygiene; multi-signature optimizes simple, provable controls, but pays more on the chain and sometimes in the user experience. The safer option is the one your team can run cleanly and cleanly at 3 a.m. on the holidays when the alarm sounds.

FAQs

Currently on Bitcoin, which is more secure? threshold signature or multi-signature? It depends on your operation. With Taproot, TSS using FROST or MuSig2 is very cost-effective and private; multi-signature using Taproot scripts provides on-chain policies and simple auditing. Choose the one you can monitor and recover without "heroism".

Is TSS suitable for the DAO vault? In general, contract multi-signature is still more suitable for vaults because it exposes policies on the chain, allows community verification operations, and supports delays and limits. TSS can serve as a powerful complement to the execution wallet or market-making department.

TSS events for THORChain-Should I avoid using MPC? This is a warning story, not a ban. The vulnerability involves turn manipulation in GG20-based settings. If you use TSS, strict termination processing, monitoring and regular share updates are required. Design should ensure that a noisy participant cannot consume rounds without anyone noticing.

Are losses usually caused by cryptographic vulnerabilities? Very few. Recent bridge thefts and many major losses can be traced to key leaks or rights logic rather than signature algorithm flaws. Processes, authorities, and monitoring often determine the end result.

Can I mix TSS and multi-signature? Yes. Many trading platforms run a TSS hot or warm layer for execution and multiple signatures with latency for cold storage. This division allows you to keep costs low where you need them and retain strong, visible control where you need them more.

Does Taproot eliminate the need for multiple signatures? No. Taproot improves privacy and cost, especially for Schnorr-based solutions, but it does not replace the governance, time-locking, and audit trajectory that many teams expect from multi-signature strategies.

What is the biggest mistake the team makes when switching? Migrate in a hurry without drill rotation and recovery. No matter what you choose, you must conduct desktop deductions and a small amount of capital trial runs. Make sure the alarm is triggered when expected and that everyone knows exactly what they have to do.