Where’s my key?

Ads for MPC (Multi-Party Computation) wallets sound like a beginner’s dream: forget the twenty-four words on a scrap of paper, no seed phrases to lose or leak. The private key supposedly doesn’t exist as a whole anywhere — math has split it into encrypted shares. The wallet is declared non-custodial: your money belongs to you alone, and not even the service’s developers can touch it.

Sounds lovely. Now let’s strip off the packaging and look at how this machinery works in real life — no abstract formulas, no marketing fairy tales.

Anatomy of a trap: half a key is not a key

What is a retail MPC wallet in practice? Your private key isn’t stored on the device in one piece — it’s been cut up. Most often in a “2-of-2” scheme (like Zengo) or “2-of-3” (like Bron). One piece lives in the app on your phone, the other on the server of the company that built the wallet. Sometimes there’s a third share — supposedly with an “independent partner” or in cloud storage, but the rules for accessing it are still controlled by the service.

To send even a single satoshi, your phone has to contact the company’s server and run a joint cryptographic computation. Only at that moment does the blockchain get a valid digital signature.

And now the key technical fact the brochures keep quiet about: without the second share, the piece on your phone is a useless lump of digital garbage. You can’t export it to another wallet. You can’t punch it into Electrum, Bitcoin Core or Mitilena. You can’t do anything with it at all. If the remote server refuses to take part in the joint computation, your bitcoin is locked on that address for good.

“Get lost”: reading the fine print

The makers of these services love to repeat: “But we’re non-custodial! We technically can’t steal your money!”

They don’t need to steal anything. All they have to do is shut the door in your face. Don’t take our word for it — let’s open the user agreements of the people selling this technology the loudest.

Bron. Wallet Terms, version of May 18, 2026:

  • Section 9.4. The service may stop serving you at any time without giving a reason, with a mere 14 days’ notice. “We just don’t want to deal with you anymore” is built into the rules from day one.
  • Section 2.1. If the company decides, at its sole discretion, that your transactions carry a risk of sanctions, AML breaches or any other regulatory issue, it blocks the account immediately and without notice. And right there it spells out the main thing: the company refuses to take part in MPC signing of your transactions.
  • Same section, in plain words: the service honestly warns that this may result in a complete loss of access to your crypto assets, and the company bears no liability whatsoever for that loss.
  • Key export. Thought you’d just grab your key if things went wrong? The agreement describes export as a feature the company may make available in exceptional cases at its own discretion. There is no obligation to hand you a whole key when you’re blocked.

Let’s translate that from legalese into human. You put money in the wallet. Tomorrow an automated AML score or some clerk’s request slaps a suspicious flag on your transfer. Bron’s server pulls the plug and switches signing off for you. You go to support: “Give me my money back, you’re a non-custodial service!” And they jab a finger at the screen: “See Section 2.1? Read it? Agreed to it? Now get lost.”

And there’s nothing you can do. The bitcoin sits on the blockchain, the balance is right there, but you can’t move it a single millimeter.

Zengo. User Agreement, June 2026 version:

  • A 2-of-2 scheme. No third parties: one share is yours, one is the server’s. The server cuts the connection — and the transaction can’t be signed.
  • Blocking. The account is frozen temporarily or permanently if the company “believes” you’ve broken the terms or your behavior “raises suspicion of criminal activity”. Not a court ruling. A suspicion.

The “independent escrow”: a guarantee worth fifteen hundred dollars

Zengo’s marketers push back: “We have Guaranteed Recovery! If Zengo the company shuts down, an independent trustee and an escrow agent will publish the keys to decrypt the server shares, and every user will get their funds back!”

Sounds solid. Let’s peel off the pretty wrapper and see who these people are and what they actually answer to you for.

Zengo handed the key that decrypts the server shares to a company called EscrowTech for safekeeping. The right to order its publication went to a trustee.

  • The trustee is Joulus Gazit & Co., an Israeli tax bureau. Zengo’s agreement states in black and white that it “does not guarantee the completeness or accuracy of the information … and is not liable for any errors in actions taken in reliance thereon, including with respect to the release of any funds.” The bureau’s latest audit, dated October 6, 2026, says Zengo has enough money “at least until January 1st, 2027”. What is that conclusion based on? Direct quote: it “trusted on the inquiry made with the company and its legal advisers”. In other words, the bureau simply asked Zengo whether it had money, got a yes and stamped it.
  • The escrow custodian is EscrowTech, a private Utah firm of roughly 14 people. Its actual contract with Zengo is confidential. But under EscrowTech’s standard agreement, it “acts hereunder as a depository only”. In a dispute it must keep the deposit frozen until a US court rules, and its financial liability is capped at the fees it has received. According to its public price list, the service starts at $1,595 a year.

So the “guarantee” on billions of dollars in user deposits rests on a Utah shop with a liability cap of fifteen hundred bucks and a tax bureau that warned up front it isn’t responsible for anything.

But that’s not even the main point: this whole rescue mechanism kicks in ONLY if Zengo itself is fully liquidated. If the company is doing just fine but has decided to block you personally, the trustee won’t lift a finger. As far as the system is concerned, everything is working as intended. And your key is locked forever.

And how much do you get if they lose the key?

Let’s assume the worst: the server burned down, the backups are corrupted, or the company simply lost the server shares. How much will you be compensated? Open the Limitation of Liability section of Zengo’s agreement: their maximum liability is capped at half the fees you paid the service over the previous 12 months (“half the fees you paid us in the twelve months preceding”).

Had $100,000 in the wallet and paid $100 for a Zengo Pro subscription? The company’s liability ceiling is exactly $50. On the free basic plan? Your compensation ceiling is a big fat zero. Lost everything — got a whole lot of nothing. And that’s not speculation: it’s the official agreement you sign when you create the wallet.

Who actually created your key?

And the last illusion: “But my personal share is generated on my phone! The server doesn’t know it!”

Let’s switch on some logic. The mobile app is written by the very same company, downloaded from a store, and constantly talks to their backend. Who controls the random number generator inside that app? The company’s code. Who built the binary? The same company.

What’s more, under Zengo’s official architecture an encrypted copy of your “personal” share is stored on their servers anyway — they call it backup. The developers claim the decryption key sits separately in your personal cloud. But does the app from the App Store actually keep those promises? An ordinary user looking at a smartphone screen will never know whether the software is sending those 32 bytes of private secret straight to its makers — openly or disguised as routine telemetry.

And if the client share ends up with the company, splitting the key becomes pointless: they already have the server part, they’ve got the client part — that’s a complete private key. At that moment all the MPC math stops protecting you from the service itself: the company can sign any transaction behind your back. And when the balance hits zero or the account gets blocked, you’ll simply be told: “You were banned for breaking the rules, goodbye.”

Both parts of the key are born in the software of one and the same commercial service. The claim that “only you have the key” rests entirely on blind faith in the developers’ word of honor.

The custodian’s perfect alibi

MPC is pitched as the pinnacle of non-custodial security. In reality the user gets the worst of both worlds:

  • From a non-custodial wallet you get zero guarantees: lose your phone or access to your cloud, and the company will just shrug: “We’re non-custodial, we don’t have your key, there’s nothing we can recover.”
  • From a custodial exchange you get one hundred percent outside control: the remote server can refuse to sign for you at any second.

But on a regular centralized exchange you at least have the legal status of a customer: the exchange must follow financial regulations, return your remaining balance when it closes your account, or answer in court. In a retail MPC wallet, the business has built itself the perfect alibi:

“We never touched your money — it’s sitting on the blockchain, admire it all you like. We simply declined to compute a signature with you. And the fact that you can’t send a single cent without our signature — well, you signed the rules yourself. Read them? Agreed to them? Now kindly get lost.”

Nobody’s saying you’ll definitely be robbed tomorrow morning. But all the infrastructure, all the software and all the legal agreements are designed from the outset so that you can be cut off from your money on any given day. And nobody guarantees you otherwise.