Jun 2026
Nobody holds the money key
The most secure wallet is the one whose private key was destroyed the instant it was born.
Here is the uncomfortable truth about every cryptocurrency you own. There is one number, somewhere, that controls all of it. Whoever has that number has your money. Not "can request" your money, not "is authorized" to move it. Has it. The whole edifice of decentralization sits on top of one secret that, by design, must exist somewhere, and that somewhere is the single juiciest target in the system.
This is the key custody problem, and it has eaten more money than any exploit. Mt. Gox lost 850,000 BTC. The QuadrigaCX founder died and took the keys to roughly 190,000 BTC and ETH with him to the grave, locking out 76,000 users. Stefan Thomas has 7,002 BTC on an IronKey drive and two guesses left before it encrypts itself forever. Every one of these is the same failure: a key existed, in one place, and that place was a single point of catastrophe.
Split the secret so the whole never assembles
The fix is older than Bitcoin. In 1979 Adi Shamir, the S in RSA, published a scheme to split a secret into n shares so that any k of them reconstruct it and k-1 reveal literally nothing. The math is a polynomial of degree k-1. The secret is the constant term. Hand out points on the curve. Fewer than k points and the curve could be anything, so the shares leak zero information, not "hard to crack" information, provably zero.
Shamir's scheme has a fatal flaw for our purposes, though. To use the key, you reassemble it. For one moment the whole secret sits in one machine's memory, and an attacker who owns that machine in that moment owns everything. You moved the single point of failure, you did not delete it.
The real trick is to never assemble the key at all. This is threshold signing, and it is what makes the headline literally true: nobody holds the money key, because the money key never exists as a thing you can hold.
Signing without ever having the key
Threshold signature schemes (TSS) take the split further. Each party holds a share of the private key, and they cooperate to produce a valid signature without any party ever learning the others' shares or reconstructing the full key. The verifier sees a single, ordinary signature. The blockchain has no idea three machines in three datacenters argued it into existence. To the chain it is just a signature from one public key.
For Bitcoin and Ethereum the relevant curve is secp256k1 with ECDSA, and threshold ECDSA is genuinely hard because the signing equation has a division baked in, which does not split cleanly across parties. The 2018 papers by Gennaro and Goldfeder, and by Lindell, made it practical. Schnorr signatures, which Bitcoin shipped in 2021 with Taproot, are linear and split far more cleanly, which is why FROST-style threshold Schnorr is now the elegant default when you have the choice.
The payoff is concrete. A 2-of-3 setup means an attacker who fully compromises one share gets nothing. Lose a share to a dead laptop or a fired employee and you still sign with the other two. There is no moment, ever, when the complete key is addressable in a single address space. You have not protected the single point of failure. You have abolished it.
Why this is not just multisig with extra steps
People hear "k of n" and say "that's multisig, Bitcoin had that in 2012." It is not the same, and the difference is where the threshold lives. On-chain multisig publishes the policy. The world sees a 2-of-3 P2SH address, sees which three keys, sees that two signed. That is a fingerprint, a bigger transaction, a higher fee, and an information leak about your security setup. Worse, the multisig rules are chain-specific. Bitcoin's script multisig and an Ethereum multisig contract share no code.
Threshold signing pushes the whole thing below the chain. The policy lives in cryptography, off-chain, invisible. Output is one key, one signature, indistinguishable from a lone hardware wallet. Same protocol works on any chain that speaks ECDSA or Schnorr, because the chain only ever sees the final signature. The threshold is a property of the math, not a feature you beg each blockchain to support.
This is not free. TSS protocols are rounds of interaction between parties, they need solid networking and liveness, and a botched implementation can leak key material through side channels that single-key signing never exposes. The 2018 schemes have known subtleties, and several early libraries shipped bugs that could exfiltrate shares. The honest position is that threshold signing trades a custody problem you understand for a protocol-correctness problem you must get exactly right. But the prize is real: a system where the most valuable secret in your stack is one that was never, at any instant, in any one place. Nobody holds the money key. That is the point.
So we built it
This is not a roadmap slide for us, it is in the code. Verse splits the mint key across guardians with Shamir, and any threshold of them sign with a two-round protocol that never assembles the key. The output is a signature byte-identical to a single-key mint, so the wallet that already exists accepts it with zero changes. No node, ever, holds the money key. The honest cost is the one above: more rounds, more liveness to get right, an implementation you cannot fumble. We took it, because the failure we deleted, one number on one machine, is the one that actually drains networks.