Multisig, MPC, and Threshold Signatures: Do They Survive Q-Day?

Here’s the question people actually mean when they ask this one: “I moved my coins into a 2-of-3 multisig, or an MPC custody setup, or a threshold wallet, so I’m covered against quantum, right?” The short answer is no. Not because those setups are weak. They’re some of the best operational security you can run. They just answer a different question than the one a quantum computer asks.

So name the thing all three have in common. Call it the curve underneath. Multisig, MPC, and threshold signatures are all ways of arranging signers around the same piece of math, an elliptic curve, and a quantum computer running Shor’s algorithm breaks ECDSA and Schnorr, the two signature schemes securing nearly every chain’s coins. A large enough quantum computer can derive a private key from its public key once that key is on chain.

What these three really do

In simple terms, all three solve one real problem: a single private key on a single device is a single point of failure.

Multisig splits authorization across several independent keys. A 2-of-3 needs any two of three signatures to move funds, so losing one key, or having one stolen, doesn’t lose the coins. MPC (multi-party computation) goes further. The full private key never exists in one place at all; several parties hold shares and compute a signature together without ever assembling the secret. Threshold signatures are the cryptographic engine under most MPC custody, a t-of-n scheme where any t parties can sign and fewer than t learn nothing.

Grant the credit plainly, because it’s earned. These schemes kill the attacks that actually drain wallets right now. A phished device. A compromised laptop. An insider with too much access. Exchanges, funds, and serious self-custody holders run multisig and MPC for exactly those reasons, and they’re right to. As classical security, this is directionally correct and then some.

None of it touches the curve underneath.

Why Q-Day asks a different question

Shor’s algorithm breaks ECDSA and Schnorr, the two signature schemes securing nearly every chain’s coins, a large enough quantum computer can derive a private key from its public key once that key is on chain. That’s the whole game. Shor doesn’t grind through guesses; it derives the key straight from the curve.

So look at what each scheme puts on chain.

Multisig with separate keys reveals each public key when you spend. An attacker with a working quantum machine has to break two of your three keys to clear a 2-of-3. Two breaks instead of one. On a computer that can do the first break, the second costs the same trivial amount again. Multisig multiplies the attacker’s work by a small integer, and a small integer times “almost free” is still almost free.

Modern multisig often looks worse than that, by design. MuSig2, standardized as BIP-327 and used on Taproot, aggregates several signers into a single Schnorr key and a single signature, indistinguishable on chain from an ordinary single-signer output. One key. One signature. One thing for Shor to break.

MPC and threshold custody land in the same place. The output is one standard ECDSA signature under one standard public key. On chain, an MPC wallet guarding tens of millions looks exactly like a fresh hot wallet. Same curve, same exposure, same break.

That’s the curve underneath doing its quiet work. Rearranging the signers never changed the substrate.

Where the credit is real (and where it stops)

Two honest caveats, because the blanket version of this argument is wrong too.

First, the hash shield applies here exactly as it does to single-sig. On hash-based address types, the keys stay hidden behind a hash until the first spend, multisig included. An unspent multisig output is no more exposed than an unspent single-key one. The hash is what’s protecting you. The multisig is incidental to it.

Second, the small-integer point cuts slightly in your favor at the margin. An attacker does have to break more than one exposed key to clear an m-of-n built from separate keys. At the very least that’s a marginally higher bar than single-sig. Just don’t mistake a marginally higher bar for a wall. A nation-state quantum attacker working down the chain by value, which is the realistic threat model, isn’t deterred by needing two cracks rather than one.

So the credit is real and it’s bounded. These schemes are a serious answer to key theft and a non-answer to Shor.

What actually survives Q-Day

If the curve is the problem, the fix is a signature scheme Shor can’t break. That means post-quantum signatures. ML-DSA (Dilithium, FIPS 204) and SLH-DSA (SPHINCS+, hash-based, FIPS 205) are finalized NIST signature standards, published in August 2024 after more than a decade of public cryptanalysis. FN-DSA, based on Falcon, is expected as FIPS 206 and is still in development.

The architecture isn’t the problem, so you don’t have to throw it away to fix the primitive. Threshold and MPC are general techniques, and researchers are building threshold versions of the post-quantum standards right now. Threshold ML-DSA constructions already run for small signer sets, and NIST is running a formal Multi-Party Threshold Cryptography project to standardize the category. So the t-of-n custody model can, in principle, survive Q-Day, once the thing being thresholded is post-quantum rather than ECDSA.

In practice it isn’t shipping yet. Threshold post-quantum signing is heavier, the protocols are young, and the lattice math creates problems classical thresholding never had. Blind faith that “MPC plus post-quantum” is a solved combination today is misplaced. It’s a research frontier with real results, not a product you can buy.

What you can do today runs on two tracks. Chain-level migration, where the base layer swaps its signatures: per qLABS’ L1 Quantum Vulnerability Index, Cardano is furthest along, XRP is targeting 2028, and Ethereum has live research. And authorization-layer approaches that add a post-quantum lock over an existing wallet without waiting for the base chain to migrate, which is the design behind qVAULT, where a Falcon (FN-DSA) authorization sits on top of the standard key so funds can’t move on a broken ECDSA signature alone. Same logic in both cases: you have to replace the elliptic curve itself. Signer count is beside the point.

The takeaway

Run multisig. Run MPC. They’re among the best things you can do about the threats that empty wallets this year, and none of that stops being true because of quantum.

Just file them under the right heading. Multisig, MPC, and threshold signatures are custody architecture, and Q-Day is a cryptography problem. The curve underneath doesn’t count how many people hold the keys. At the very least, before you call a setup quantum-safe, check whether anything in it has actually replaced the elliptic curve. If the answer is no, you’ve solved a different problem, and solved it well.