On May 15, 2026, THORChain was hit by a targeted exploit that drained roughly $10.7M from one of its vaults, the result of a flawed implementation of GG20, an MPC-based threshold signature scheme. Even when a scheme is theoretically sound, things can easily go wrong while implementing it. So, if you are implementing or auditing MPC, head over to mpcsec.org.

What is mpcsec.org?

At the RWMPC 2025 workshop, a group of practitioners agreed that the field needed a shared, living reference for the implementation mistakes that keep recurring. That conversation grew into a collaborative project, and today we are happy to announce its first public release: mpcsec.org, a guide to common multi-party computation pitfalls maintained with contributors from zkSecurity, Trail of Bits, Partisia, and Zama.

The guide currently covers six categories: input validation, context binding, concurrency and state, insecure subprotocols, failure recovery, and adaptive inputs. It also catalogs improper use of the cryptographic primitives that MPC protocols rely on, since even a well-designed scheme can fail when its building blocks are misused. Each entry walks through a pitfall, how it can go wrong, and how to avoid it, with examples drawn from real deployed libraries like tss-lib, WSTS, MP-SPDZ and Drand.

Auditing with AI assistance

mpcsec.org also ships with a SKILL.md file to help guide LLM-assisted code reviews.

Your Feedback is Invaluable

We hope that this website becomes a reference. Tell us what you think. Share your suggestions, or any new MPC-related bugs, via a PR.

Get in touch

If you would like an extra set of eyes on your MPC stack, reach out at hello@zksecurity.xyz.