Google is reportedly preparing to introduce a Multi-Party Computation (MPC) service focused on institutional cryptocurrency custody, potentially expanding its role in digital asset security. The move comes as a newly disclosed vulnerability in Fireblocks’ MPC library highlights the risks that can persist within systems designed to protect cryptographic keys.
The proposed Google service is reportedly undergoing private testing with major financial institutions. The technology is also being used to secure digital assets on Ethereum and Solana, with commercial availability expected in early 2027.
The developments have renewed attention on the reliability of institutional crypto custody solutions. On October 26, CERT/CC disclosed a flaw in Fireblocks’ MPC library that could weaken safeguards designed to keep cryptographic key shares secure.
Google MPC Could Strengthen Institutional Crypto Custody
Multi-Party Computation allows several participants to approve transactions collaboratively without combining a complete private key in one location. Each participant retains an individual key share, and the shares work together to produce a transaction signature.
By distributing signing authority, MPC can reduce the risks associated with a single compromised device or malicious insider. However, this approach cannot eliminate vulnerabilities in the software responsible for handling the key shares.
Google Cloud has previously supported institutional MPC deployments through Confidential Space. The service combines confidential computing with hardware-backed attestation to verify computing environments and help protect sensitive information, including data involved in blockchain transaction signing.
The reported Google MPC service would extend the company’s efforts into specialized security infrastructure for institutional digital asset holders. Combining cloud services with cryptographic protections could make the offering attractive to organizations managing significant cryptocurrency portfolios.
Even so, institutions will need to assess how the service is implemented, how transaction approvals are handled, and what recovery options are available. MPC is a security technique rather than a guarantee that every component of a custody platform is protected against attacks.
Fireblocks MPC Vulnerability Highlights Key-Management Risks
CERT/CC published advisory VU#701544 on October 26, describing a vulnerability in Fireblocks’ mpc-lib library. The issue affects its handling of BIP32 hardened key derivation when the required private parent key is missing.
According to the advisory, the library may substitute a zero-filled buffer instead of rejecting the operation. If an attacker also obtains a compromised descendant signer share and its corresponding chain code, they could potentially recover ancestor shares within that participant’s key hierarchy.
The flaw does not directly expose a complete private key capable of authorizing transactions independently. Rather, it weakens an additional safeguard intended to limit the exposure of related key material when a signer share is compromised.
At the time the advisory was released, CERT/CC reported that a vendor fix was unavailable. Its recommendations included keeping chain codes confidential and avoiding reliance on hardened derivation to isolate signer shares until the implementation is corrected.
The incident demonstrates why institutional custody systems must be assessed beyond their advertised cryptographic protections. Distributing key shares can reduce certain risks, but the security of the entire system also depends on correct key-derivation logic, tightly controlled access, and robust transaction authorization procedures.
