MuSig2 and FROST in 2026: Taproot’s Invisible Multisig

For most of Bitcoin’s history, a multisignature wallet announced itself. A 2-of-3 vault or a 3-of-5 treasury was written into the transaction as a script, every participating public key exposed the moment the coins moved, every extra key and signature adding bytes and fees. Anyone watching the chain could read the policy off the spend: this address needs three of five keys, and here they all are. Taproot, activated in November 2021, and the Schnorr signatures it brought, quietly ended that. In 2026 the change stopped being a whitepaper promise and became the plumbing under real custody.

The proof is on a balance sheet. BitGo, the institutional custodian that runs Taproot key aggregation in production, debuted at No. 273 on the 2026 Fortune 500 with $16.2 billion in 2025 revenue, the first digital-asset infrastructure company to make the list (BusinessWire). Bitcoin itself trades around $79,600, a market value near $1.6 trillion and roughly 37% below its October 2025 record of $126,080 (CoinGecko). The price gets the headlines. The way its keys are held is being rebuilt underneath, and the two schemes doing the rebuilding are called MuSig2 and FROST.

Taproot Rewired Bitcoin’s Signatures

Every Bitcoin transaction is authorized by a digital signature. Until Taproot, that signature used ECDSA, the same algorithm since 2009. Taproot added a second option, Schnorr signatures, defined in BIP-340 by Pieter Wuille, Jonas Nick and Tim Ruffing, and that single addition is what makes aggregation possible. The reason is a property mathematicians call linearity: Schnorr signatures and the keys behind them can be added together, so the sum of several valid parts is itself one valid whole. ECDSA’s verification equation does not add up so cleanly, which is why a decade of Bitcoin multisig had to list every key separately instead of combining them.

With Schnorr, a group of signers can fold their public keys into one aggregate key and produce one aggregate signature that verifies against it. On-chain, the result is indistinguishable from a payment made by a single person. Taproot supplies the container for that trick. BIP-341, by Wuille, Nick and Anthony Towns, makes a single tweaked public key, the key path, the default way to spend, while BIP-342 keeps a script path tucked inside a Merkelized tree, a MAST, for fallback conditions you only reveal if you use them. Taproot outputs carry the bc1p prefix and went live at block 709,632 on 14 November 2021 (CoinDesk). Put simply, Taproot is the container, Schnorr is the pen, and MuSig2 and FROST are the two ways many hands can hold that one pen.

From OP_CHECKMULTISIG to Aggregation

Bitcoin has had multisig almost from the start, but it took years to become usable. The OP_CHECKMULTISIG opcode let a script demand M signatures out of N listed keys; pay-to-script-hash (P2SH), introduced in 2012, made it practical by hiding the script behind a hash until spend time. The 2-of-3 became the default custody pattern for exchanges, funds and careful individuals: two keys to move funds, a third for recovery. SegWit in 2017 moved the script into the witness (P2WSH), trimming fees and fixing transaction malleability.

What none of that fixed was disclosure. When a P2SH or P2WSH multisig spends, the redeem script is revealed, and with it the exact policy and every public key. The chain shows the world that a given pile of coins is guarded by, say, three of five keys, and it prints those keys. That is a privacy leak, and to some security engineers it is a targeting signal: a visible high-threshold vault tells an attacker exactly where the large, well-defended balances sit. It also costs money. An ordinary native-SegWit multisig input runs about 104.5 virtual bytes (Bitcoin Optech), and every additional key and signature adds weight that the spender pays for. Taproot’s pitch was to collapse the cooperative case into a single key and a single signature, taking the privacy leak and most of the cost with it.

MuSig2, Explained

MuSig2 is the scheme that delivers that collapse. Standardized as BIP-327, titled MuSig2 for BIP340-compatible Multi-Signatures, by Jonas Nick, Tim Ruffing and Elliott Jin, it was created in March 2022 and now carries the status Deployed (bitcoin/bips); the underlying research was published by Nick, Ruffing and Yannick Seurin at CRYPTO 2021. In the BIP’s own words it lets multiple signers create a single aggregate public key and cooperatively produce ordinary Schnorr signatures valid under that key. Nothing about the resulting spend says multisig.

It is an n-of-n scheme: every designated signer must take part. Signing happens in two communication rounds, which is what the 2 in the name refers to (the first MuSig needed three). Signers first exchange nonce commitments, then partial signatures that a coordinator adds together. The nonce round can be pre-computed, so in practice signing feels almost non-interactive. The danger, and it is a real one, lives in those nonces: each signer uses two secret nonces per session precisely to defeat a class of forgery attacks that broke earlier two-round designs, and reusing a nonce can leak a private key exactly as it can in ECDSA.

Two practical touches made MuSig2 fit real hardware. BitGo engineer Brandon Black realized that the last signer to contribute a nonce can derive it deterministically, which lets a hardware security module sign without keeping state between rounds; he raised the idea with Blockstream’s Jonas Nick, who folded it into the specification (Bitcoin Optech). And because most custody wants some redundancy, wallets pair MuSig2 with Taproot’s script tree: a 2-of-3 becomes three leaves, each holding a two-key MuSig2 aggregate, so the common case still spends as one key while any pair can recover. BIP-373, authored by Ava Chow and marked Complete, added MuSig2 fields to the PSBT format wallets use to pass partial transactions around (bitcoin/bips), and Bitcoin Core has since merged the code to validate them.

The Fee and Privacy Dividend

The savings are not subtle. BitGo’s field report measured a MuSig2 key-path input at 57.5 virtual bytes against 104.5 for the equivalent native-SegWit multisig, close to a 45% reduction, with a Tapscript multisig landing even higher (Bitcoin Optech). Since Bitcoin fees are charged by size, aggregation is a direct discount on every spend, on top of the privacy gain.

The privacy is the quieter prize. Jameson Lopp, chief security officer at custody firm Casa, has long argued that Taproot lets complex wallets “blend in with the crowd” as far as on-chain analytics are concerned, because with aggregated signing you no longer have to reveal which keys were participating (Casa). That indistinguishability is the same property behind other 2026 Taproot privacy work; our look at Silent Payments covers a receiving-side version of the same idea.

There is a catch worth stating plainly. The privacy only holds for the cooperative key-path spend. Fall back to the script path, because a signer is unavailable or a recovery clause triggers, and the structure is revealed after all. And most Taproot volume in 2026 is not private custody: on-chain trackers put Taproot near a fifth of transactions, down from a peak around 42% in 2024, and a large share is Ordinals, Runes and Lightning channel funding rather than the multisig it was built to help. Steve Jeffress, creator of the UTXOracle tool, estimated that the overwhelming majority of Taproot transactions since 2024 are dust, telling ForkLog: “These are not financial transactions. This was not the expected behavior when we created Taproot” (ForkLog).

FROST and the Threshold Model

MuSig2’s n-of-n rule is a limitation. Requiring every signer on every spend is fine for a fixed pair, but institutions want a threshold: any three of five officers, so a vacation or a lost key does not freeze the treasury. That is what FROST provides. Short for Flexible Round-Optimized Schnorr Threshold, it came out of 2020 research by Chelsea Komlo and Ian Goldberg at the University of Waterloo and was standardized in June 2024 as RFC 9591 by the Internet Research Task Force, with authors from the Zcash Foundation, Waterloo and Cloudflare (IETF).

FROST is t-of-n: any t of the n signers can produce a valid signature while the rest stay offline. It reaches that flexibility through distributed key generation, or DKG, which removes the trusted dealer entirely. Each participant generates a random polynomial, publishes commitments to its coefficients and hands out shares, so the group’s private key is never assembled in one place, even for an instant (Spark). Better still, the group can rerun the process to change its threshold or rotate members while keeping the same public key and the same address, so a governance change never has to touch the chain.

On-chain, a FROST signature is just a 64-byte Schnorr signature. As Spark’s engineering team puts it, observers cannot determine the number of operators, the threshold, or even that a Layer 2 protocol was involved. Bitcoin-specific standardization is still in progress: BIP-445, the FROST signing protocol for BIP-340, was assigned to Sivaram Dhakshinamoorthy in early 2026 and remains a draft (GitHub), with a companion distributed-key-generation spec from Blockstream Research offering both a trusted-dealer setup and a dealer-less variant. The honest status check: as of 2026 no mainstream Bitcoin wallet has shipped FROST on mainnet. Where it runs today is inside Layer 2 operator sets, not consumer apps.

MuSig2, FROST or Tapscript: Which When

So Bitcoin now has three ways to require multiple keys, and they are not interchangeable.

The practical division is clear enough. MuSig2 shines where a fixed set always signs together, above all the 2-of-2 that funds every Lightning channel. FROST is what you want for a true threshold that survives absent signers and lets you reshuffle the roster without moving funds. And OP_CHECKSIGADD Tapscript is the non-interactive fallback for anyone who would rather each signer act independently, with no nonce coordination at all, and accept a slightly larger, slightly more revealing spend in exchange for simplicity.

ROAST: Making Threshold Signing Reliable

FROST has a weakness that matters more in production than in a paper: it is not robust. If one of the selected signers goes offline or misbehaves midway through a session, the attempt fails and has to restart, and a malicious participant can keep triggering that failure to stall the group indefinitely. For a custodian that cannot let a withdrawal hang because one signing box is slow, that is unacceptable.

ROAST, for Robust Asynchronous Schnorr Threshold signatures, is the fix. Published by Blockstream Research in May 2022 with authors including Tim Ruffing, Elliott Jin and Jonas Nick, it wraps FROST rather than replacing it: it runs several signing attempts in parallel and accepts the first that completes, guaranteeing the group makes progress as long as enough honest signers are reachable, even over a network with no timing assumptions (Blockstream). ROAST is the unglamorous piece that turns threshold Schnorr from an elegant idea into something an operations team can depend on, and it is a reason FROST tends to appear first inside tightly run operator networks rather than loose consumer setups.

Where MuSig2 and FROST Run in 2026

For a technology sold on invisibility, MuSig2 is surprisingly easy to find once you know where to look. Ledger added it to its Bitcoin application in version 2.4.0 in April 2025. BitGo runs it for institutional Taproot wallets. On Lightning, where every channel funding output is inherently a 2-of-2, LND graduated Simple Taproot Channels to production in version 0.21 on 11 June 2026, so a channel open or a cooperative close now settles as an ordinary-looking Taproot payment rather than an obvious 2-of-2 (Lightning Labs). FROST, meanwhile, is the engine inside Spark, the Bitcoin Layer 2 from Lightspark, which uses it for a 1-of-n trust model: the user holds one share, an operator set collectively holds another via distributed FROST, and settlements to the base chain are indistinguishable Taproot spends (Spark).

The Institutional Turn: BitGo Reaches the Fortune 500

The clearest measure of how far this has traveled is BitGo. In January 2026 the custodian listed on the New York Stock Exchange under the ticker BTGO, the first digital-asset company to go public that year. Five months later it debuted at No. 273 on the 2026 Fortune 500 with $16.2 billion in 2025 revenue, serving more than 5,500 clients across over 100 countries (Bitcoin Magazine). Just before the IPO, in December 2025, the Office of the Comptroller of the Currency gave final approval for BitGo Bank and Trust, National Association, a federally chartered trust bank, pulling large-scale crypto custody inside the perimeter of national banking supervision.

Chief executive Mike Belshe framed the milestone in institutional terms: “Being named to the Fortune 500 in our first year as a public company is an important milestone for BitGo and for the digital asset industry,” adding that since 2013 the firm had focused on the secure, regulated infrastructure institutions need to hold digital assets with confidence (BusinessWire). What the announcement does not spell out is the cryptography under that infrastructure. When a regulated custodian holds coins in a multisig arrangement that pays single-signature fees and does not broadcast its structure to every chain-watcher, MuSig2 is what makes it work.

What Aggregation Does Not Fix

It would be a mistake to read all this as multisig being solved. Aggregation hides the arrangement and cuts the fee. It does nothing to tell a human being what they are actually approving, and that gap is where the money has really been lost.

The three largest multisig thefts on record were not broken cryptography. The February 2025 Bybit hack drained roughly $1.5 billion, some 401,347 ETH, after attackers corrupted the interface the signers were looking at so that a routine transfer carried a hidden payload (The Block); the 2024 WazirX (about $230 million) and Radiant Capital (about $50 million) losses followed the same script. In its first-half 2026 report, blockchain-intelligence firm TRM Labs found that infrastructure, key and operational compromises made up a minority of hacking incidents but the large majority of stolen value (TRM Labs). The keys were never the weak point; the approval was.

This is why aggregation is a double-edged upgrade. On the positive side, MuSig2 and FROST erase the on-chain beacon that used to help attackers spot large multisig balances. On the other, the risk simply moves to the signing screen, and there it is scheme-agnostic. After the July 2026 Coldcard firmware disaster sent users rushing toward multisig, Ledger chief technology officer Charles Guillemet pushed back bluntly: “Multisig is not automatically the right answer” (U.Today). More devices, more backups and more coordination, he argued, create new ways to fail, and he pointed to Bitcoin miniscript, clear signing and MuSig2 as a more measured middle path than simply adding signers. The physical dimension matters too: distributing keys across people and places is a defense our report on wrench attacks examines, but only if each signer can verify what they sign.

The Dissent: Why Unchained Said No

Not every serious custody team has embraced aggregation, and the dissent is instructive. Unchained, which specializes in collaborative custody where clients hold their own keys alongside the firm, has deliberately chosen not to use MuSig2 or threshold Schnorr for its vaults. Its engineering write-up, first published in 2021 and updated in April 2026, lays out the reasoning: the interactive schemes were not standardized when the decision was made, coordinating nonces safely across multiple vendors is hard, and reusing a nonce is catastrophic. “Multisig on Taproot is on the other end of the spectrum; no current best practices are defined,” the post states (Unchained).

Instead the firm favors Taproot’s script path with OP_CHECKSIGADD and multiple k-of-k leaves. Each signer signs independently, with no nonce round to coordinate, and the wallet still gains privacy for every branch it does not use. Advisors associated with that conservative stance include Michael Flaxman and Jimmy Song. The disagreement is really about a tradeoff, not a winner. MuSig2’s interactivity is its cost. For a hot institutional wallet with tight operational control, the coordination buys real fee and privacy savings and is worth it. For a client whose keys sit in a home safe, a bank box and a lawyer’s office, non-interactive independence can matter more than shaving virtual bytes off a spend.

Bitcoin Multisig Versus Ethereum Smart Accounts

Bitcoin and Ethereum are chasing the same goal, an account controlled by several parties under a flexible policy, from opposite directions. Ethereum solves it in the execution layer. A smart-contract account, whether through ERC-4337 or the newer EIP-7702 that lets an ordinary externally owned account temporarily behave like one, can encode arbitrary rules: spending limits, session keys, social recovery, automation, all living on-chain as contract state that anyone can read and audit. That expressiveness is the whole premise of the emerging wallet module economy, and of the cross-wallet approach we cover in our EIP-7702 explainer.

Bitcoin solves the same problem in the signature. MuSig2 and FROST push the policy off the chain and into the key material, so the base layer sees only one key and one signature. The tradeoffs mirror each other. Ethereum’s approach is programmable and transparent, but public and heavier, with policy that lives in a deployed contract. Bitcoin’s is private and cheap, but comparatively rigid, with policy that lives in a protocol you run rather than code you upload. Neither is strictly better. The revealing thing is that both ecosystems now treat the same two ideas as baseline: your account should not hinge on a single key, and it should not have to advertise its internal structure to the world.

Regulation, Custody and Moving Your Coins

In the United States, the regulatory line on all of this is easy to misplace. The Securities and Exchange Commission neither approves nor blocks a Bitcoin soft fork; the consensus rules that gave us Taproot sit outside its remit. Where the SEC does bite is custody. The Advisers Act custody rule requires registered investment advisers to keep client assets with a qualified custodian, and a no-action letter in late September 2025 let state-chartered trust companies serve as bank custodians for crypto. Crucially, that guidance did not resolve whether coins held in a multisig or an MPC arrangement satisfy the rule at all, leaving a live question under exactly the schemes this article describes (Hunton). The OCC’s decision to charter BitGo Bank and Trust arguably did more for institutional adoption than any SEC statement, by giving threshold-signed custody a federal banking home.

For an individual, the more practical question is what happens when you move coins into a Taproot MuSig2 setup. Sending your own coins from a legacy or SegWit multisig to a new Taproot wallet is a transfer to yourself, which in the US is not a disposal and does not by itself trigger capital gains, though record-keeping and state-level rules still apply, as our guide to crypto taxes by state lays out. The only direct cost of migrating is the transaction fee, and once your coins live behind a MuSig2 key-path output, every future spend is both cheaper and quieter than the multisig you left behind.

The Road Ahead: FROST, UX and a Fifth Birthday

The near-term work is unglamorous, which is usually a good sign. MuSig2 is finished and deployed; the remaining effort is user experience and hardware, making stateless signing, PSBT flows and clear signing smooth enough that aggregation never becomes a fresh blind-signing trap. FROST is the opposite: the mathematics is settled in RFC 9591, but the Bitcoin-specific standard, BIP-445, is still a draft, and the ecosystem will not rush a consensus-adjacent primitive. Expect FROST to reach production wallets only after its DKG and its robustness layer have been audited hard and run in anger, which is why Spark and its peers are the proving ground.

One shadow hangs over all of it. Taproot key-path spends publish the full public key on-chain, so a future large-scale quantum computer would threaten any exposed key, aggregated or not; that migration debate, playing out in proposals like BIP-360 and BIP-361, runs on a separate track and changes nothing about multisig today. And a milestone is coming: Taproot turns five on 14 November 2026. Its loudest promised features, covenants and large on-chain contracts, are still being argued over on developer mailing lists. Its quietest one, letting many keys look like a single key, is the piece that actually shipped, scaled through Lightning and institutional custody, and ended up on a Fortune 500 balance sheet. For an upgrade sold as invisible, that is a fitting way to matter.

Frequently Asked Questions

What is the difference between MuSig2 and FROST?

MuSig2 is an n-of-n scheme: every designated signer must take part, and their keys combine into one aggregate key that produces one Schnorr signature. FROST is a t-of-n threshold scheme: any t of the n signers can sign while the rest stay offline. Both settle on-chain as a single key-path Taproot spend that looks like an ordinary single-signer payment. MuSig2 is deployed in production wallets today; FROST is standardized as RFC 9591 but is still mostly used inside Layer 2 operator sets rather than consumer Bitcoin wallets.

Does MuSig2 make Bitcoin multisig cheaper?

Yes. A MuSig2 key-path input is about 57.5 virtual bytes, against roughly 104.5 for an equivalent native-SegWit multisig input, close to 45% smaller, and Bitcoin fees scale with size. Because the spend looks like a single signature, it also stops revealing that the wallet is multisig at all.

Is a MuSig2 spend more private than a normal multisig?

For the cooperative case, yes. An aggregated key-path spend cannot be distinguished from a single-signer payment, so it hides the number of keys and the threshold. The privacy only holds while everyone cooperates; if you fall back to the recovery or script path, the structure becomes visible on-chain.

Has FROST or MuSig2 been hacked?

The underlying cryptography is well studied and, for FROST, standardized in RFC 9591. The main practical hazard in interactive Schnorr signing is nonce handling, since reusing a nonce can leak a private key, which is why robustness work like ROAST and careful implementations matter, and why some custodians still prefer non-interactive Tapscript multisig. The largest real-world multisig losses, including Bybit and WazirX, came from blind signing rather than broken signatures.

Which wallets support MuSig2 in 2026?

Ledger added MuSig2 to its Bitcoin app in version 2.4.0 in April 2025, BitGo runs it for institutional Taproot wallets, Lightning implementations such as LND use it for Simple Taproot Channels, and Bitcoin Core has merged the plumbing for MuSig2 fields in PSBTs. FROST, by contrast, is used mainly by Layer 2 systems like Spark rather than mainstream wallets so far.

Marcus Okafor is a senior editor at HOGE Wire, covering Bitcoin’s base layer, custody and the cryptography that holds it together.