What Is FROST Threshold Signing? A Plain English Guide
Traditional Bitcoin multisig is well understood: require signatures from three out of five keys before funds can move. FROST does something more elegant. It lets a group of participants each hold a fragment of a single key, with no individual fragment being usable on its own. The final signature looks identical to a single-key signature on-chain. Nobody watching the blockchain can tell it required multiple parties to produce.
This is not a minor technical detail. It is the difference between Bitcoin custody that announces its security model publicly and Bitcoin custody that keeps it private.
Why Bitcoin custody needs threshold signing
A standard Bitcoin private key is a single point of failure. If you lose it, the funds are gone. If someone steals it, the funds are gone. This is well understood.
The classic solution is multisig: split control across multiple keys so that no single key loss or theft is catastrophic. Standard multisig works. But it has two weaknesses.
First, it is visible on-chain. A standard 2-of-3 multisig address looks different from a single-signature address. Anyone watching the blockchain can identify it as multisig and infer something about the custody structure behind it.
Second, it is computationally expensive for large threshold schemes. A 5-of-9 multisig requires all nine public keys to appear in the spending transaction. That takes up block space and increases fees.
FROST solves both problems.
What FROST actually stands for
FROST stands for Flexible Round-Optimized Schnorr Threshold. Each word matters:
Flexible: the threshold can be set to whatever combination suits the use case. You could do 2-of-3, 5-of-9, 11-of-20, or anything else.
Round-Optimized: FROST minimises the number of communication rounds required between signers. Earlier threshold signing schemes required multiple back-and-forth rounds of communication. FROST gets it done in two rounds in most implementations, or even one in some variants.
Schnorr: FROST is built on Schnorr signatures, the scheme Bitcoin adopted with the Taproot upgrade in 2021. Schnorr signatures have useful mathematical properties that make threshold schemes practical. The big one: multiple Schnorr signatures can be aggregated into a single signature that is indistinguishable from a regular one.
Threshold: the signing process requires a threshold number of participants (e.g., 3 out of 5) to cooperate. No individual participant can sign alone.
How a FROST signing process works
Start with key generation. A trusted setup process distributes key shares to each participant. No single participant ever sees the full private key. The process is designed so that the full key never exists as a single value anywhere. Each participant receives a share, and any threshold number of shares can cooperate to sign.
When a transaction needs to be authorised, the participants who want to sign communicate with each other in two rounds. In round one, each participant generates a commitment and sends it to the others. In round two, each participant uses the commitments to generate their partial signature and shares it. A coordinator combines the partial signatures into a final signature.
The final signature is a single Schnorr signature. It looks like any other Bitcoin transaction on-chain. No multisig visible. No threshold structure visible. Clean.
Why Ducat uses FROST for vault custody
When you deposit Bitcoin into a Ducat vault, you are not sending it to a company. You are sending it to a vault controlled by a FROST threshold setup where you hold one of the key shares.
This is what makes Ducat non-custodial in a meaningful sense. The protocol cannot move your Bitcoin without your participation. There is no company database of private keys. There is no custodian who can be hacked, sanctioned, or pressured into freezing your funds.
The FROST setup also means the vault's security does not announce itself on-chain. An observer cannot look at your vault address and immediately understand how it is secured. This is better operational security.
For more on how this works in the context of a Bitcoin loan, see our guide to and the .
FROST vs standard multisig: key differences
| Feature | Standard Multisig | FROST |
|---|---|---|
| On-chain visibility | Multisig structure visible | Looks like single-sig |
| Block space usage | Scales with number of keys | Single signature always |
| Key generation | Keys exist independently | Shares distributed, full key never assembled |
| Communication rounds | No coordination needed | 1-2 rounds between signers |
| Flexibility | Fixed threshold | Flexible threshold |
FROST vs MPC wallets
FROST and MPC (Multi-Party Computation) wallets both distribute signing authority. They get confused regularly, but they are different.
MPC wallets were designed before Taproot. Most use ECDSA, the older signature scheme, and wrap the signing process in a generic multi-party computation layer. This works, but the resulting signature is still an ECDSA signature. It does not benefit from Schnorr's aggregation properties. The on-chain footprint is the same as a regular transaction, but the cryptographic machinery underneath is heavier and more complex.
FROST is purpose-built for Schnorr. It is simpler, more efficient, and designed specifically for the post-Taproot version of Bitcoin. The signing rounds are fewer. The mathematical proofs are tighter. And because Schnorr signatures aggregate cleanly, the whole system produces smaller, cheaper transactions.
For Bitcoin custody in 2026, FROST is the better tool. It was designed for this exact job.
Where to learn more
FROST was introduced in a 2020 paper by Chelsea Komlo and Ian Goldberg. The cryptographic details are dense, but the core idea is accessible: split a key into shares, require a threshold to sign, produce a clean single signature.
Bitcoin Optech tracks FROST developments and covers how the protocol fits into the broader picture of Bitcoin script and signing improvements.
The practical applications for self-custody, vault protocols, and institutional holdings are still being built out. Ducat is among the first production deployments of FROST for a lending protocol on Bitcoin mainnet.
FROST is an active area of research. Implementation details vary between projects. Always review audit reports and understand the before depositing funds with any protocol.
