Google has disclosed a cryptographic security service initiative aimed at decentralizing private key control across multiple independent computing environments, with the goal of commercialization by early 2027. As financial institutions seek stronger protection for digital assets, the service is currently in private testing.
According to CoinDesk, Google’s Multi-Party Compute (MPC) is currently in private testing with several major financial institutions and will be publicly demonstrated at the company’s first Digital Assets Symposium in New York. Alphabet, Google’s parent company, has already begun using this technology to secure its own digital assets on Ethereum and Solana.
Meanwhile, the company has not disclosed the names of the financial institutions participating in the test, nor has it revealed which assets Alphabet holds through the system. Pricing has not been announced, and the planned commercial launch depends on the completion of the preview project.
Google launches an MPC security solution for institutional crypto custody
Google Multi-Party Compute uses encryption to split private key control among multiple independent parties. Authorized parties jointly sign blockchain transactions without needing to centralize the full private key in one location, reducing dependence on a single device or administrator.
Following the architecture proposed by Google, institutions can distribute signature shares across their own devices, Google Cloud, and other cloud service providers. Banks can set up approval rules such as 2-of-3 or 5-of-7, requiring the specified number of approvals before authorizing a transfer.
The service also includes transaction policies that verify requests before signing begins. Institutions can restrict receiving addresses, set transfer limits, or require additional approvals—all of which run within Google’s Confidential Space environment.
Previously, Google released technical guidance in April 2023 on how organizations could use Confidential Space to build distributed signing systems. The newly proposed product will integrate this capability with signing policies and recovery tools into a dedicated service.
Google’s existing Cloud Key Management Service and Cloud HSM products already protect encryption keys. The new service specifically addresses the authorization and recovery needs of digital assets, as blockchain transactions are typically irreversible once completed.
Private key exposure highlights weaknesses in cryptographic infrastructure
As Google plans to roll out its services, stolen credentials remain a persistent source of cryptocurrency losses. Chainalysis estimates that 43.8% of stolen cryptocurrency in 2024 was related to private key compromises.
An incident involving Humanity Protocol in June demonstrated that multi-signature credentials can also be exposed through a compromised device. According to a report published by crypto.news following its investigation, the attackers obtained seven private keys from a developer’s computer and used them to gain administrative control.
Stolen credentials enabled attackers to perform unauthorized transactions and contract modifications on Ethereum and BNB Smart Chain. Humanity Protocol stated that the attack utilized valid signatures generated from compromised keys, rather than any vulnerability in its blockchain contracts.
Google's approach aims to prevent excessive centralization of signing authority. However, its security still depends on how customers segment key shares, protect administrators, and manage approval policies.
An October analysis on institutional crypto custody controls found that even with decentralized credentials, operational risk cannot be eliminated if multiple signing parties share the same administrative privileges or recovery system.
Google enters a market dominated by professional托管 service providers
This proposed service will bring Google’s cloud infrastructure closer to established digital asset security providers such as Fireblocks, Fordefi, and BitGo. Institutions are already using these specialized platforms to manage wallets, control transaction approvals, and track asset movements.
Google is targeting banks that want to maintain direct control over their custodial operations while using external technology. The service will provide signing infrastructure without requiring financial institutions to transfer ownership of their private keys to Google.
In September, UniCredit was exploring digital asset custody and brokerage infrastructure, while European banks were developing services related to cryptocurrencies and tokenized securities. Fireblocks has also provided wallet and tokenization technology to the Qivalis bank alliance.
Google has not disclosed performance benchmarks comparing its proposed system to existing commercial products. The identities of testing partners remain confidential, so the initial scale of institutional participation is unclear.
AI threats raise questions about the future security of wallets
Google has positioned this service, to some extent, as a response to cyberattacks driven by increasingly powerful AI tools. According to a Chainalysis report, scams associated with AI tool providers averaged $3.2 million in profits per incident in 2025, compared to an average of $719,000 for scams without such associations.
This comparison measures the earnings from different types of scams; it does not prove that AI caused higher losses or that MPC could have prevented these scams.
Ethereum researcher Justin Drake has warned that future advances in AI could undermine the cryptographic assumptions that secure blockchain wallets. Currently, publicly available AI systems cannot derive standard Bitcoin or Ethereum private keys by cracking the underlying signature algorithms.
Google stated that the proposed service will support ECDSA and Ed25519 signatures upon launch. Its architecture is also designed to be compatible with future post-quantum cryptography upgrades, although the company has not yet disclosed a timeline for implementing these signature methods.
Except for the timeframe of early 2027, the company has not disclosed a more precise commercial release date, nor has it identified which institutions will be the first to adopt the service after the private testing phase.