Hassan Maishera
TL;DR
-
Google is introducing a dedicated multi-party computation service to help financial institutions secure digital assets.
-
Google Multi-Party Compute is in private preview, with commercial availability planned for early 2027.
-
Alphabet is already using the technology to protect digital assets on Ethereum and Solana.
-
The service distributes signing authority across separate systems and checks transactions against institutional approval rules.
Google Targets Institutional Digital Asset Security
Google plans to showcase a new security service for cryptocurrency and tokenized assets at its inaugural digital assets symposium in New York on Wednesday.
The product, Google Multi-Party Compute, is being tested by design partners and major financial institutions in a private preview. Google revealed that Alphabet, its parent company, has also begun using the technology to secure digital assets on Ethereum and Solana.
Google did not identify the participating institutions or disclose which assets Alphabet holds. Commercial availability is planned for early 2027, with pricing yet to be announced.
The launch would expand Google’s role in institutional crypto infrastructure as banks explore blockchain-based payments, tokenization, and custody services.
Multi-party computation, or MPC, distributes cryptographic signing authority across multiple participants rather than relying on a complete private key stored in one location.
For example, a bank could hold one key share on its own hardware, another in Google Cloud, and a third with a competing cloud provider. A transaction could require two of those three participants to jointly produce a signature.
Google says its service supports different approval thresholds, including two-of-three and five-of-seven arrangements.
According to the company, the complete private key is never stored in one place. Customers retain control of their key material, and Google cannot access it in unencrypted form, even when shares reside on its infrastructure.
That design aims to reduce the risk that compromising a single machine would give an attacker the credentials needed to move assets.
Transaction Policies Add Another Layer of Control
Before signing begins, transactions pass through a policy engine running inside Google’s Confidential Space infrastructure.
The engine checks proposed transfers against rules established by the institution. Those rules could limit transaction amounts, restrict destination wallets or require approval from multiple departments.
Confidential Space uses hardware-isolated computing environments designed to protect sensitive information during processing.
Google previously published guidance in 2023 explaining how customers could build MPC-based digital asset systems using that infrastructure. The new product packages MPC signing, transaction policies, and key recovery into a dedicated service.
It builds on Google’s existing cryptographic infrastructure, including Cloud Key Management Service and Cloud HSM.
According to Rich Widmann, Google Cloud’s director of digital assets strategy, digital asset adoption and tokenization are at an inflection point.
He added that regulated institutions need scalable infrastructure to secure client assets as blockchain adoption expands.
The service addresses a persistent source of cryptocurrency losses: attackers obtaining the credentials needed to authorize transfers.
Chainalysis attributed 43.8% of cryptocurrency stolen in 2024 to compromised private keys. Separately, DeFiLlama data cited in the report put cumulative losses from blockchain hacks and exploits at $16.69 billion through June, with roughly 40% linked to private-key compromises.
Recent incidents include a March attack on stablecoin protocol Resolv involving a compromised privileged key and weaknesses in its minting system. The attacker extracted approximately $25 million.
In June, attackers compromised keys belonging to a Humanity Protocol foundation member and drained more than $32 million from at least 17 wallets.
Distributing signing authority and enforcing approval policies may reduce some risks. However, those protections still depend on secure configuration, protected signing participants, and controls over who can change transaction rules.
They also cannot eliminate the possibility that authorized users are deceived into approving malicious transfers.
AI and Quantum Risks Require Different Responses
Google is also positioning the architecture for evolving threats involving AI and quantum computing.
AI tools can help scammers scale their operations, but no AI system has demonstrated an ability to break the cryptographic signatures protecting Bitcoin or Ethereum wallets.
Google’s current MPC controls address risks such as compromised credentials and unauthorized transactions, rather than a breakthrough against the underlying mathematics.
Quantum computing presents a separate potential threat. No existing quantum computer can perform the attacks described in research scenarios against Bitcoin’s cryptography.
Google says its architecture is designed to accommodate future post-quantum upgrades as blockchain networks adopt the necessary algorithms. At general availability, however, the service is expected to support conventional ECDSA and Ed25519 signing.
The company has not provided a timetable for post-quantum signing capabilities. The planned launch brings Google into closer competition with specialist digital asset security providers, including Fireblocks, Fordefi and BitGo.
Google is emphasizing its security expertise, banking relationships and position as an infrastructure supplier that enables institutions to operate their own custody businesses.
Still, distributing credentials across environments does not remove every dependency on a technology provider. Institutions may continue relying on Google for software, policy enforcement and operational infrastructure.
Google says the service supports fast signing and key recovery, but it has not provided independently verified performance comparisons. Broader availability will give institutions more opportunity to assess its security, operational requirements and cost against existing products.
