Google to Preview New Crypto Security System in Response to Rising Private-Key Hacks

Google plans to present Google Multi-Party Compute (MPC), a system for protecting and transferring cryptocurrencies and tokenized assets, at Google's first digital assets symposium in New York City on Wednesday. Google said several design partners and major financial institutions are testing the private-preview service, but Google did not name the institutions. Alphabet, Google's parent company, has started securing digital assets on Ethereum and Solana with the technology, although Google did not identify the assets. Google plans to offer the service commercially in early 2027 and has not announced prices.

Google said Google has never previously offered a dedicated MPC custody product for cryptocurrencies. Google's existing production offerings include Google Cloud Key Management Service and Cloud HSM, while the new service combines MPC signing, transaction policies and key recovery. Google published instructions in 2023 for building MPC digital-asset systems with Google's Confidential Space infrastructure. Banks and other financial companies are exploring blockchain-based asset issuance, payments and custody, which require secure authorization of transactions that generally cannot be reversed. Google Cloud digital assets strategy director Rich Widmann said adoption and tokenization have reached an inflection point and regulated institutions need scalable, proven infrastructure to protect clients' assets.

Chainalysis attributed 43.8% of cryptocurrency stolen in 2024 to compromised private keys. DeFiLlama data showed cumulative blockchain-project losses from hacks and exploits of $16.69 billion as of June this year, with roughly 40% attributed to private-key compromises. A March attack on stablecoin protocol Resolv extracted about $25 million through a compromised privileged-account private key and minting-system weaknesses. Attackers stole more than $32 million from at least 17 wallets in June after compromising the private keys of a Humanity Protocol foundation member. The breach also drove Humanity Protocol's token down more than 80%, illustrating losses beyond the assets stolen directly.

MPC distributes private-key control across separate parties or computers and requires distinct pieces of cryptographic information to authorize transactions. Google said the complete key is never held at a single location, reducing the danger of asset theft when one machine is compromised. Google said customers control their key material and Google cannot obtain unencrypted access, including when Google infrastructure holds key shares. Google is also presenting the service as a response to more sophisticated cyberattacks involving artificial intelligence and quantum computing.

Chainalysis found that scams associated with AI-tool vendors averaged $3.2 million in proceeds per operation in 2025, versus $719,000 for other scams, roughly 4.5 times as much. The findings suggest AI may enable larger-scale fraud, but the research does not establish that AI caused the difference in proceeds. Ethereum researcher Justin Drake warned that AI could discover mathematical shortcuts capable of breaking Bitcoin and Ethereum wallet signatures, potentially within months in a worst-case scenario and before sufficiently powerful quantum computers arrive. No AI system has demonstrated that capability, although AI can uncover weaknesses in poorly encrypted tools, as illustrated by last week's certification-authority incident. Google's present MPC safeguards target credential compromises and unauthorized transfers, not a hypothetical defeat of the underlying cryptography.

The service can check transactions against institutional policies before signing, potentially blocking transfers that breach limits or approval requirements. However, legitimate users could still be deceived into approving malicious transactions. Quantum computing presents a separate, longer-term risk, rather than an imminent threat. Google researchers previously estimated that a sufficiently powerful future quantum computer could theoretically calculate a bitcoin private key from an exposed public key in roughly 9 minutes, assuming advanced preparation. No current quantum computer can perform that attack, but about 6.9 million bitcoin have been reported as potentially vulnerable because the public keys are exposed.

Google said the architecture can accommodate future post-quantum cryptography upgrades designed to protect signatures against sufficiently powerful quantum computers. Google said the service is designed to support conventional ECDSA and Ed25519 signing algorithms when generally available. Google supplied no schedule for post-quantum signing, but said upgrades could follow blockchain adoption of the necessary cryptography without institutional system redesigns or operational interruptions.

A bank could place one signing-key share in Google Cloud, another on the bank's hardware and a third with a different cloud provider. Google said a proposed transfer enters Confidential Space, where a policy engine checks institutional rules before signing begins. Possible rules cover transfer amounts, permitted destination wallets and approvals from multiple departments, with checks running in hardware-isolated environments designed to prevent unauthorized information access. Google said signing thresholds can vary, including joint approval by two of three participants or five of seven participants. Google said institutions can spread credentials across institutional hardware, Google Cloud and competing clouds, addressing banks' desire for cloud convenience without surrendering complete credential control to one provider. Google also claimed fast signing and key recovery, but supplied no independently verified performance comparisons against existing custody products.

Google's planned offering would compete more directly with specialist security providers Fireblocks, Fordefi and BitGo, which help institutions protect and authorize blockchain transactions. Google argues that banking relationships and security expertise provide a competitive advantage, and Google presents the service as neutral infrastructure for banks wary of providers competing for the same customers. Institutions would still need to assess provider risks because banks could remain dependent on Google for software, transaction policies and operational infrastructure despite distributing signing credentials. Security also depends on institutional configuration, protection of signing participants and control over changes to transaction-approval rules.