MPC Wallet: Is Crypto Finally Moving Beyond Seed Phrases?

An MPC wallet is a cryptocurrency wallet that implements multi-party computation to replace the single full private key, which is usually stored in a single location. In practice, in an MPC wallet, multiple separate key shares are created in order to create a valid signature for the blockchain, as opposed to reassembling the private key.

What Is an MPC Wallet?

This architecture may offer consumer and institutional custody. The actual number of shares, where they are stored, and how many are needed to sign will depend on the threshold scheme selected by the wallet provider.

What Does MPC Mean in Crypto?

MPC stands for Multi-Party Computation, a subfield of cryptography in which multiple parties jointly compute the output of a function while keeping their inputs private. An application of MPC to crypto custody is threshold signing, where a number of parties collaboratively sign a transaction without allowing any single party to know the private key in its entirety.

This is the basic idea of how MPC crypto security works: instead of using a single secret key that authorizes all transactions, the control of the signing power is distributed among multiple participants, who must comply with the protocol.

How MPC Wallets Differ From Traditional Crypto Wallets

Unlike in most self-custody wallets, which generate private keys from a recovery seed that must not be lost, stolen, or leaked, in an MPC crypto wallet, signing is separated from possession of cryptographic shares that may be stored in a combination of user device(s), servers, and other secure environments.

This need not affect how the blockchain needs to be designed: MPC systems can ultimately produce ordinary signatures such as ECDSA signatures or EdDSA signatures valid on supported blockchains. The trade-off when using an MPC system is likely to be mainly in the domain of key management and signing, rather than in requiring a special account on the blockchain. 

Feature	MPC Wallet	Traditional Seed-Phrase Wallet
Key management	Private key material is distributed across multiple shares	Private keys are typically derived from a recovery seed
Transaction signing	Required shares jointly produce a valid signature	Transaction is signed with the relevant private key
Seed phrase	May operate without a traditional seed phrase	Commonly uses a 12- or 24-word recovery phrase
Single secret	No complete private key needs to exist in one location during signing	Recovery seed is a critical secret that must be protected
Recovery	Depends on the wallet’s share and recovery architecture	Usually performed with the recovery phrase
Main trade-off	More complex architecture and provider-specific recovery	User must securely protect and preserve the recovery phrase

Why MPC Wallets Do Not Need a Traditional Seed Phrase

An MPC wallet without a seed phrase does not require a single master recovery secret. The signing authority is distributed into multiple shares. For instance, Zengo publishes a two-share MPC mechanism. One share is generatedgo’s servers. Other structures and thresholds are possible in other MPC products

This does not mean that recovery does not exist: MPC wallet recovery is implemented through other means defined by the provider or the wallet model. These other means do not involve a standard 12- or 24-word seed phrase. Users should understand the recovery process of their MPC wallet before storing long-term funds within it.

How Does an MPC Wallet Work?

An MPC wallet uses distributed cryptographic signing. Rather than signing with a single key, several different endpoints hold partial keys, which they combine into a valid signature once a threshold number of key shares participate in signing. Under this model, the entire private key does not need to be assembled.

In practical terms, how does an MPC wallet work comes down to two linked processes: distributed key generation and threshold signing. Their exact protocols, number of participants and required quorum vary between wallet architectures.

Private Key Shares and Distributed Key Generation

In Distributed Key Generation (DKG), each participant creates the key material required to create a secret share for each participant, without one participant creating and seeing the entire private key as plaintext. At the same time, the participants create the public key for the wallet.

The shares can be stored separately on mobile phones, in the cloud, on hardware, etc., which is a key MPC wallet security feature, as compromising one location does not compromise all of the information needed to perform a signing action.

What Is Threshold Signature Technology?

Threshold Signature Scheme (TSS) describes how a subset of participants can create a valid digital signature together. In a t-of-n network, the threshold t is the minimum number of the n participants who can produce a signature.

A threshold signature wallet can produce a standard signature that is verified using the underlying signature scheme’s normal verification process. This is in contrast to multisig schemes, where multiple signatures are placed in a blockchain transaction and must be recognized.

How an MPC Wallet Signs a Transaction

When a transaction receives the necessary authorizations, the authorized parties run an MPC signing protocol and provide their respective share for computing the signature, without reconstructing the private key.

The signature can then be sent to the target blockchain and verified as a regular signature. The number of rounds of communication and other details may differ depending on the specifics of the MPC protocol in question. For example, the implementation of MPC-CMP used by Fireblocks differs from earlier threshold-signing protocols.

What Happens When One Key Share Is Compromised?

In other words, obtaining fewer shares than required to meet the signing threshold is insufficient to produce a valid transaction signature, as opposed to the single-key compromise scenario of standard single-signature wallets.

The compromised share results in a security violation, depending on the threshold, share distribution, and implementation. An attacker could form a threshold of shares by corrupting a sufficient number of participants. Some architectures for MPC allow for the option of key-share refresh or rotation, wherein compromised material can be changed without changing a wallet’s address. 

Stage	What Happens	Security Purpose
Key generation	Participants generate separate cryptographic key shares	Avoids concentrating the complete private key in one participant
Share storage	Key shares are kept across separate devices or environments	Reduces reliance on a single storage location
Transaction request	A transaction is prepared and submitted for authorization	Starts the signing workflow
Threshold signing	The required participants use their shares to jointly calculate a signature	Allows signing without reconstructing the complete private key
Blockchain verification	The resulting signature is submitted to the blockchain	Network verifies it using the applicable signature scheme
Share compromise	A compromised share can be replaced or refreshed in some implementations	Can limit exposure without necessarily changing the wallet address

MPC Wallet vs. Seed Phrase: What Changes?

The primary difference in MPC wallet vs seed phrase is how the user’s signing credentials are protected and recovered. While a regular HD wallet derives the entire key pair from a single recovery seed, the threshold signing schemes used in MPC wallets have a distributed authorization structure where no party holds the complete private key.

The Single Point of Failure in Traditional Wallets

Seed phrases, being portable, create a single point of failure: the person who has the seed phrase can recover the wallet. Otherwise, recovering the wallet is impossible without creating a second wallet, as the user has lost both their access to the wallet and the usable recovery phrase.

The problem is that the recovery phrase is an important secret that must be protected from being stolen, disclosed by mistake, physically damaged, and perhaps most importantly, lost forever.

How MPC Changes Private Key Management

MPC extends this model by distributing the secret cryptographic information to multiple participants. Threshold-signature protocols allow multiple parties to jointly produce a valid signature without giving each party a full private key.

As such, MPC wallets can prevent single complete private keys from being exposed in the signing process, and split the security assumptions and guarantees of the key among different systems. The actual MPC wallet benefits depend on the underlying protocol and implementation.

Is MPC Really More Secure Than a Seed Phrase?

There is no universal answer to are MPC wallets safe relative to seed-based wallets. MPC has the advantage that revealing one signing share does not enable the attacker to access the wallet, while revealing traditional recovery phrases allows an attacker to control the derivation of all accounts from the phrase.

However, these threat models differ: seed-based hardware wallets could keep keys offline in principle. And for example, an MPC solution has its own implementation, endpoint, and recovery issues. Thus, security considerations for MPC wallets cannot be considered a generalized consequence of any MPC implementation, but rather are specific to the individual wallet architecture.

What Happens If You Lose Access to an MPC Wallet?

Unlike traditional wallets, which can be re-instantiatedsometimes cannot, and so may need to be re-instantiated39 phrase

That makes the recovery design critical. Users need to know what shares or credentials they will need to get into a device, whether a provider is involved in recovery, and what will happen if a device or service evaporates. However, seedless designs can lead to vendor dependence or single points of recovery failure.

MPC Wallet vs. Multisig vs. Hardware Wallet

MPC, multisig, and hardware wallets protect the signing authority by splitting up the cryptographic key into shares, by requiring several independent keys to sign a transaction, or by storing private keys in hardware, respectively.

MPC Wallet vs. Multisig

The main difference in MPC wallet vs multisig is where the threshold is enforced: for a multisig, the threshold is enforced on-chain (according to each blockchain’s own capabilities), while the different MPC participants cooperate off-chain to produce a single valid signature.

This affects portability. For example, in MPC vs multisig, MPC can use a standard signature scheme and work in supported networks, while multisig would need to be a separate scheme for each blockchain.

MPC Wallet vs. Hardware Wallet

The difference between MPC wallet vs hardware wallet is bigger than just online versus offline storage: hardware wallets are physical devices that store the user’s private keys offline. For instance, Ledger stores and manipulates keys in an isolated Secure Element, separate from the device that is connected to the Internet.

While MPC addresses signing authority distribution, not key storage, these solutions are not necessarily exclusive: an MPC architecture can store a share of a signing key in a hardware-isolated or offline enclave.

MPC Wallet vs. Exchange Custody

In exchange custody, private keys are held by the exchange. Customers spend their funds through their accounts with the exchange. In self-custody, the signing credentials belong to the customer rather than the exchange.

The fact that MPC is used does not say anything about self-custody. Who has the shares and the reconstruction process makes the custodianship model. In that sense, the cryptography is separated from the practical question as to who has the control for signing the transaction.

Which Wallet Model Offers the Best Security?

No wallet architecture offers the strongest protection for all threat models. Hardware wallets focus on offline isolation of keys, multisig on distributing keys, and MPC on distributing shares and threshold signing. Each approach consequently guards against different failure scenarios.

Security is relative to implementation and user behavior regarding the wallet. Hardware wallets can be exploitedols depend on endpoints and approvals

Feature	MPC Wallet	Multisig	Hardware Wallet	Exchange Custody
Key model	Distributed key shares	Multiple independent private keys	Private key stored on a dedicated device	Keys controlled by the custodian
Signing	Threshold participants jointly produce a signature	Multiple separate signatures are required	Device signs transactions with its private key	Exchange signs on the user’s behalf
Threshold	Enforced through the MPC protocol	Typically enforced on-chain	Usually not inherent	Determined by exchange infrastructure
Offline storage	Possible, depending on architecture	Possible	Core security feature	Depends on the custodian
User controls keys	Depends on implementation	Yes in self-custodial setups	Yes	Generally no
Main trade-off	Protocol and implementation complexity	Blockchain-specific support	Physical device and recovery management	Reliance on a third-party custodian

Are MPC Wallets Safe?

MPC wallet security distributes signing authority so no single component holds the complete private key. As a result, in case of a compromised component, key secrecy might still be preserved if the malicious actor is not able to reach the threshold.

Security will vary depending on the protocol, share distribution, endpoints, and recovery design and implementation.

How MPC Reduces the Risk of Key Theft

In an appropriately constructed MPC system, the shares of the private key are disparate, and the transaction can be signed without reconstructing the private key from its shares, making it more difficult for the wallet to be compromised

Some implementations can refresh or rotate shares without changing the blockchain address, minimizing the amount of partial key material that gets revealed.

The Risks MPC Wallets Cannot Eliminate

MPC does not eliminate all attack surfaces; for instance, the devices, authentication systems, approval workflows, recovery flows, and underlying infrastructure can all be targeted, especially if recovery is poorly designed.

These MPC wallet security risks are not purely cryptographic: if sufficient participants or a targeted implementation are compromised, an attacker could sign transactions or exfiltrate data.

Phishing, Malicious Transactions and Social Engineering

MPC does not help users who are deceived into signing a malicious transaction. Attackers can attack the MPC signers by masquerading the malicious transaction as a benign transaction.

Transaction simulation, allowlists, and policy controls can reduce these issues, but they are augmentations of MPC rather than native characteristics of the technology.

Why the MPC Implementation Matters More Than the Label

Thus, one should not consider MPC as a single security standard. NIST distinguishes theoretical security of a threshold scheme from its practical deployment, including platform and communication technologies.

Vulnerabilities found in older GG18 and GG20 implementations demonstrate why this matters. MPC crypto security ultimately depends on protocol design and review, and on endpoint security and faithful implementation.

The Biggest Advantages of MPC Wallets

The most important MPC wallet features are its ability to distribute trust and its placing of the authority of crypto transactions in a threshold of private keys. Threshold cryptography also increases the secrecy and robustness of the key, as cryptographic operations can always be performed without reconstructing the key.

No Single Private Key to Lose or Steal

In a threshold architecture, the secret key material is shared among multiple parties, and thus the sharing allows the key to remain secret when fewer than the threshold of parties are compromised

This eliminates the central compromise that, if any one of the shares was seized, it could be used in place of a conventional private key, but the parties have to compute it together.

Flexible Recovery and Key Rotation

Some MPC implementations permit rotation of key shares at the same blockchain address. For example, Fireblocks allows for different authorized devices and signers while keeping the originating assets at the same blockchain address, avoiding the need to send to a new address.

Recovery is implementation-specific. A provider may implement recovery as encrypted backups, by using replacement shares, or by multi-party recovery. Users should be aware of what method a system is using before using it.

Multi-Party Transaction Approval

Threshold signing allows to specify a minimum quorum of signatures that need to be produced to create a valid signature. Therefore, the signing authority can be split across several people or computational endpoints.

Enterprise implementations can also layer this cryptographic threshold with additional approval policies: for example, Fireblocks provides transaction policy controls and audit trails on top of its MPC infrastructure.

Better Security for Active Crypto Users

To provide security against higher value or more frequent transactions, MPC can be used to distribute signing shares across hardware, software, or networks so that a given signing instance never has the full signing key. This does not help against social engineering attacks such as phishing or malicious transactions.

MPC can be used in hot and cold configurations, and some implementations use an offline share combined with other online shares for signing to balance isolation and transaction availability.

Why MPC Is Attractive for Institutions and Businesses

However, businesses need more than custody with private keys. Multi-signature approvals, role-based access controls, policies that change with needs, and robustness against employee and device turnover are all relevant. 

MPC architectures provide distributed controls and, in some cases, can even reconfigure signers while keeping the wallet’s on-chain address unchanged.

This flexibility explains the institutional adoption of MPC-based custody, combining distributed signing with operational controls and accommodating various storage configurations, though ultimately the guarantee depends on the security properties of the given implementation.

The Biggest Risks and Drawbacks of MPC Wallets

Despite these advantages, NIST warns that threshold cryptography comes with security considerations regarding communication interfaces, execution platforms, setup and maintenance; thus, the whole architecture should be treated as a complete system, rather than just the security of the underlying primitive.

Dependence on the Wallet Provider

Some MPC wallets have provider-operated infrastructure holding a share or participating in signing. Coinbase’s documented MPC architecture splits key material between the user’s wallet and a Coinbase server.

Provider dependence thus varies among implementations, and users should consider who controls each share and whether they will have access to the data if the provider ceases operation.

Recovery and Account-Restoration Risks

MPC wallet recovery replaces the familiar seed-phrase workflow with architecture-specific procedures. According to Coinbase’s technical papers, recovery can be achieved by downloading the user’s backed-up share and authenticating against Coinbase or the wallet provider.

This can simplify recovery, but may create new dependencies on authentication, backup, or recovery infrastructure that may not have been a factor in the wallet’s construction.

Compromised Devices and Key Shares

Threshold cryptography refers to schemes whereby components can be compromised while the underlying key remains secret, provided not too many components are compromised.

It does not make compromised endpoints harmless. NIST stresses the issue of practical security in implementations, platforms and communication interfaces. Security trade-offs between confidentiality and integrity depend on the specific system and opponent model.

Smart Contract and Transaction Approval Risks

MPC does not protect the economic security of the transaction being authorized; it only ensures key management and signing security.

A threshold scheme can produce a valid signature for an authorized operation; therefore, application-level risks are not part of the cryptographic scheme: the current NIST standard defines threshold signing as distributed computation of the underlying signature primitive.

For crypto users visiting a Web3 site, this is important because wallet security and transaction safety are separate layers.

Complexity Compared With Traditional Wallets

While MPC avoids the overhead of maintaining a single secret, it requires a complex infrastructure of parties that communicate with each other and store shares as per the protocol’s threshold and security assumptions.

That complexity may not be apparent to the user, but in practice, it makes implementation, testing, and validation especially important, and these are among the major issues identified by NIST. 

Risk Area	What Can Go Wrong	What to Check
Provider dependence	Signing or recovery may rely on provider infrastructure	Who controls each share and what happens if the service becomes unavailable
Recovery	Lost credentials or backups may prevent restoration	Recovery requirements, backup methods and provider involvement
Compromised endpoints	Attackers may target devices or systems holding key shares	Share distribution, threshold design and endpoint protection
Transaction approval	A valid signature can still authorize a malicious transaction	Approval policies, transaction verification and security controls
Implementation	Protocol or software flaws may weaken the security model	Independent audits, testing and technical transparency
System complexity	More components create additional operational dependencies	Architecture, maintenance practices and failure procedures

Who Should Use an MPC Wallet?

MPC wallets are useful for individuals or organizations that desire to have their signing secret split into pieces rather than have it concurrently possessed by a single user. NIST describes threshold cryptography as a way to distribute trust without a single operator being a point of failure.

Individual Crypto Investors

When protecting a standard recovery phrase is considered insecure, or when access should be made available from multiple secured devices, an MPC wallet may be a good option. Some non-custodial implementations of MPC wallets allow users to create key shares and store them on their device.

MPC is not for every investor, and the user needs to understand who owns the shares, how they would recover, and what other parties this wallet is dependent on.

DeFi Users and Active Traders

Active users could also benefit from distributed signing and perpetual on-chain access, as institutional MPC platforms already do with configurable transaction approvals, policy controls, and dApp connectivity.

For more casual DeFi interactions, these controls add a layer of protection around transaction authorization, but do not solve issues related to smart contract vulnerabilities, phishing, or malicious signing.

Crypto Businesses and Treasury Teams

In situations where no single employee should control corporate crypto assets, MPC may be well-suited. Threshold schemes distribute trust among participants, and enterprise implementations may include rules about who may initiate and approve transactions.

The model applies to treasury teams needing separation of duties and configurable approval workflows rather than being solely governed by a single master private key.

Institutions and Professional Investors

For institutions holding large amounts of digital assets, governance, access controls, and continuity of operations are required in addition to cryptographic key protection. These may be required with distributed signing, policy-based approvals, custody, or DeFi workflows.

MPC has been used in institutional wallet infrastructure and for large numbers of end users, and although NIST research has discovered attacks against nonsecure threshold-ECDSA protocols and implementations, institutional use does not free the protocol and implementation from detailed analysis.

How to Choose an MPC Wallet

In choosing an MPC wallet, consider that NIST says that threshold-cryptography security depends not only on theoretical properties, but also on implementation, communication interfaces, execution environments, and setup and maintenance.

Check the MPC and TSS Architecture

First, choose a TSS, signature algorithms, and a threshold. NIST mentions that different threshold schemes have different security properties, configurability, platforms, and implementation complexity, so two different MPC wallets could use very different architectures.

The provider should specify how key generation and signing are performed and whether the full secret is ever reconstructed. In the threshold systems described by NIST, the cryptographic operations are also performed under MPC, but secret sharing is never fully reconstructed.

Understand the Key Share Distribution

Check how many shares you have, the threshold, and where the shares are located: devices, servers, or other environments depending on the product.

This is especially important because multiple thresholds, communication interfaces, and whether the components operate on one or multiple devices are architectural features

Review Recovery and Backup Options

Before depositing, review what happens in case the phone, credentials, or some other signing element is lost. Recovery between implementations varies widely and does not necessarily work the same way a seed phrase would.

In evaluating a recovery flow, users should consider its provider dependencies and what backup data must persist. A convenient recovery flow will only be useful if users are aware of its dependencies and security assumptions.

Look for Security Audits and Transparency

Independent audit, technical documentation, and open-s to verify security claims. For example, Zengo publishes details of independent audits, and claims its MPC cryptography is open

NIST says that no implementation is secure just by being audited; testing and validating the implementation is necessary, since secure cryptographic theory does not guarantee secure implementations.

Evaluate Transaction Policies and Approval Controls

For business or institutional use, check whether the wallet supports configurable approval thresholds, roles and transaction policies in addition to signing with cryptography. These aspects will be important for how authorization processes work.

These should be compared to the initial MPC, where threshold cryptography distributes trust in the cryptographic operation, with even more policies existing at the wallet level.

Check Supported Blockchains and dApps

Lastly, make sure that every blockchain, token standard, and dApp environment you want to use are natively supported by their wallet. An MPC architecture cannot always be used for every application.

DeFi users should also go beyond just looking for a list of supported networks, and check whether wallet-connection and transaction-signing methods are supported, as networks can differ in requirements for regular transfer versus smart contract interactions. 

What to Check	Key Question	Why It Matters
MPC and TSS architecture	Which threshold scheme and signature algorithms are used?	Determines the wallet’s underlying security model
Key share distribution	How many shares exist, where are they stored and what threshold is required?	Shows how signing authority and compromise risk are distributed
Recovery and backup	What happens if a device, credential or share is lost?	Determines whether access can be safely restored
Security audits	Has the implementation undergone independent review and testing?	Helps assess whether security claims have been externally examined
Approval controls	Are roles, transaction policies and approval thresholds configurable?	Important for teams and institutional users
Blockchain support	Which networks, tokens and dApps are actually supported?	Ensures compatibility with intended transfers and Web3 activity

Are MPC Wallets the Future of Crypto Self-Custody?

An MPC wallet explained in the context of modern self-custody does not replace all existing wallets, but rather lowers the risk around a single secret. Rather than compose multiple methods of distributed signing and recovery, these implementations use embedded interfaces and authentication currently known to users while maintaining ownership of their respective assets. 

Why Crypto Is Moving Beyond Seed Phrases

To understand what is an MPC wallet trying to improve, seed management is one of the more important places to start. Embedded MPC wallets can eliminate the need to memorize a traditional seed phrase by distributing key material or providing alternative recovery options such as social authentication or a seedless backup solution.

This can potentially simplify onboarding and recovery for non-cryptographic users. However, this does not remove the recovery risk, which remains dependent on the wallet’s authentication, backup, and key-share architecture.

MPC and the Rise of Embedded Wallets

Embedded wallets integrate blockchain accounts into apps, allowing users to log in using existing credentials, with wallet creation occurring behind the scenes. Fireblocks’ current implementation is a 2-of-2 MPC, where one MPC share is stored on the user’s device and the other on Fireblocks’ SGX-enabled data center.

This process is already being used at scale. In June 2026, Fireblocks estimated that Dynamic had over 50 million end users on embedded wallets across EVM networks, SVM networks, <a href="https://xpertsstudio.com/bitcoin-dowd-flags-nasdaq-convergence-trade/” title=”Bitcoin: Dowd Flags NASDAQ Convergence Trade”>Bitcoin, Sui, and TON.

MPC Wallets and Autonomous AI Agents

Wallets are now being created for AI agents. For instance, in February 2026, Coinbase launched Agentic Wallets to enable decentralized autonomous AI agents to spend, earn, and trade on their behalf with guardrails.

That said, MPC and agentic wallets are not the same thing. As noted by the current Coinbase documentation on Agentic Wallet, this can mean payments and seedless wallets, and the term is sometimes used more generally to mean programmable wallets or wallets that free agents from seed phrases.

Can MPC Make Self-Custody More Mainstream?

MPC can remove some existing friction through decentralizing key management and leveraging existing flows in login, recovery, and embedded wallets. Fireblocks’ existing non-custodial embedded wallets enable simple email, social login, or passkey onboarding processes without the need for seed phrase management.

That makes MPC a credible option in self-custody wallets, but that alone does not guarantee it will replace all other types of wallets. Its success and longevity will depend on whether implementations solve the usability and recovery issues, provide transparent key management, and protect against transaction malleability, among other aspects.

MPC Wallet: Final Verdict

However, whether this is a better security model depends in part on the protocol and implementation chosen. An MPC wallet can alley better

Is an MPC Wallet Better Than a Seed Phrase Wallet?

The MPC wallet vs seed phrase choice depends on the threat mode: an MPC wallet helps to lower the risk of wallet exposure if one of the secrets is compromised, whereas a seed wallet is portable.

Neither model is totally secure. According to NIST, threshold systems also depend on secure implementations, communication interfaces, and execution environments.

The Biggest Advantage and Biggest Risk of MPC

Two important MPC wallet benefits are distributed trust — if fewer than the threshold of parties and the key is intact — and the ability to sign without reconstructing the full secret.

The primary danger is assuming that the MPC provides sufficient protection on its own: researchers have demonstrated key-extraction attacks against compromised threshold-ECDSA protocols and implementations, even at NIST.

What to Consider Before Moving Your Crypto to an MPC Wallet

Before transferring, know your key-share ownership, signing requirements, and how the MPC wallet recovery works if a device is lost or if infrastructure provided by the provider goes down.

This depends on the custody requirements and threat model. NIST lists the security properties that threshold schemes can be compared on, such as their testability and implementability, rather than classifying MPC as one scheme.

Do MPC wallets have private keys?

Yes, with the signing secret being split into several key shares, threshold signing enables a transaction to be signed without reconstructing the full private key somewhere.

Can an MPC wallet be hacked?

All wallets are attackable to some extent, even if it is less so with MPC. Vulnerabilities could potentially be in the protocol, endpoints, recovery mechanisms, or implementation.

Can I recover an MPC wallet if I lose my phone?

Possibly, depending on the model of the wallet, which in some implementations has backup shares or sub systems to recover your wallet if the device is lost.

Is MPC the same as multisig?

No. Multisig uses multiple complete private keys and independent signatures, while MPC secret-shared key shares are combined to compute a signature such that the full key is never reconstructed.

Does an MPC wallet require a seed phrase?

Not always. Many MPC providers substitute a recovery phrase with distributed key shares or other key recovery mechanisms, but this depends on the provider.

Source: bitcoinfoundation.org