A Threshold-Signing MPC Wallet for Sui With No Single Key Holder
A multi-party computation wallet for Sui that does distributed key generation and m-of-n threshold signing so no single party ever holds the full key.
This is a multi-party computation wallet system for the Sui blockchain. The whole premise is that no single party ever holds the complete private key. Keys are generated in a distributed way, and signing happens through threshold cryptography, so a transaction is authorized by enough independent parties cooperating rather than by one secret sitting in one place waiting to be stolen.
Why MPC Instead of a Stored Key
A conventional wallet has a single point of catastrophic failure: the private key exists somewhere, and whoever gets it owns the funds. MPC removes that object entirely. With distributed key generation, the full key is never assembled at any moment, on any machine. Signing uses a configurable m-of-n scheme, defaulting to 2-of-2, where each participant contributes a partial signature and the parts combine into a valid one without the underlying secret ever coming together.
That changes the security question from "is the key file safe" to "would an attacker have to compromise a threshold of independent parties at once," which is a much harder bar to clear. It is the right architecture when the thing you are protecting is real value on-chain.
Multi-Tenant by Design
The system is built for organizations, not just a single user. Each organization registers and manages its own signers, and can host those signers on its own infrastructure, which keeps a critical piece of trust on the customer's side rather than concentrated in the service. Wallets are scoped per organization so tenants stay isolated from one another.
Around the cryptographic core sits the ordinary but essential production machinery. An aggregator service coordinates the distributed key generation and stitches partial signatures together. Transport is encrypted with TLS enforcement and optional mutual TLS. Sessions are JWT-based with expiration, there are per-organization rate limits, and every operation lands in a complete audit trail. Access comes through several front doors: a Telegram bot for everyday use, a REST API for programmatic access, an SDK for building your own signers, and webhooks for delivering signing requests to external endpoints. It runs over Node with PostgreSQL, optional Redis, and a Docker Compose deployment.
The lesson worth keeping is that the exotic cryptography is only half the product. Threshold signing gets you the guarantee, but it is the tenant isolation, encrypted transport, audit logging, and honest key custody that make it something an organization can actually run.
Have something that needs building, or stabilizing?
These notes are the work log. The paid work runs through Moonshine Labs, my product and engineering studio. Tell us what you're building, or grab a call.
Work with us →