Google launches MPC crypto custody service as institutions seek safer digital asset storage

Google Cloud is introducing a new cryptocurrency custody service designed to help banks and financial institutions protect digital assets without keeping a complete private key in one place. Called Google Multi-Party Compute (MPC), the service is now in private preview, with commercial availability planned for early 2027.

The system divides control of cryptographic keys among separate participants and environments, such as Google Cloud infrastructure and a financial institution’s own hardware. Transactions can then be authorized through a coordinated signing process without reconstructing the complete private key in one location.

Google’s parent company, Alphabet, is already using the technology to secure digital assets on Ethereum and Solana. Several financial institutions are also testing the service, although Google has not publicly identified the participants.

The launch comes as banks explore tokenized assets and blockchain-based financial services while facing growing concerns about stolen credentials, unauthorized transactions, and future quantum-computing threats.

How Google’s Multi-Party Compute protects crypto assets

A cryptocurrency private key is a secret credential that authorizes transactions from a wallet. Anyone who obtains sufficient control of that key can potentially transfer the associated assets without the owner’s permission.

Traditional custody systems protect private keys using security measures such as hardware security modules, restricted access, and institutional approval procedures. However, a compromised key or system can still create a significant security risk.

Google’s MPC approach distributes key control instead of relying on a single complete key.

Under multi-party computation, a private key is represented through separate cryptographic shares. Different participants hold or manage those shares, and a threshold-signing protocol allows them to jointly authorize a transaction without assembling the full key.

For example, a financial institution could configure a three-party arrangement in which two participants must approve a transaction. The participants might operate across Google Cloud, the institution’s own hardware, and another independent environment.

If an attacker compromises only one participant, that access alone should not be enough to authorize a transaction under the configured threshold.

The arrangement can also reduce reliance on a single infrastructure provider, depending on how an institution distributes its key shares and recovery systems.

Google has previously provided guidance on building MPC-based digital asset systems using its Confidential Space infrastructure. The new offering packages signing, transaction policies, and key recovery into a dedicated service rather than requiring customers to assemble all those components themselves.

Transaction rules add another layer of protection

Splitting keys is only one part of the security model. Institutions also need to control where assets can move, how much can be transferred, and who must approve a transaction.

Google’s MPC service supports transaction policies that can check activity against institutional rules before signing takes place. These rules can include transfer limits, approved destination addresses, and additional authorization requirements.

For example, a bank could require extra approvals before moving a large amount of cryptocurrency or restrict transfers to a predefined list of wallets.

The service uses Google’s Confidential Space environment to support protected transaction-policy execution. Confidential computing is designed to isolate sensitive workloads and help protect data while it is being processed.

However, these controls do not eliminate every operational risk. Security still depends on how institutions configure their policies, manage signers, protect recovery procedures, and respond to compromised credentials.

A legitimate signer who is tricked into approving a fraudulent transaction can also create problems, even when the underlying key-sharing system works as intended.

The service should therefore be viewed as an additional security layer rather than a guarantee that cryptocurrency theft is impossible.

Private-key theft remains a major crypto security problem

Google’s announcement arrives against a backdrop of substantial losses from cryptocurrency theft.

According to figures attributed to blockchain analytics firm Chainalysis, private-key compromises accounted for approximately 43.8% of cryptocurrency stolen in 2024. These incidents can give attackers direct control over assets, rather than requiring them to exploit a smart contract or manipulate a blockchain’s consensus mechanism.

The distinction matters because blockchain networks can continue operating normally even when individual wallets are compromised. The attacker uses valid transaction authorization to move funds, making the incident a custody and key-management problem rather than necessarily a flaw in the underlying network.

Google’s MPC service targets this category of risk by distributing signing authority and introducing additional transaction controls.

The approach is particularly relevant to banks, asset managers, and custodians that may need to safeguard large portfolios or administer tokenized financial products for clients.

For more background, read Altcoin Buzz’s coverage of Europol’s warning that quantum risks target crypto wallet keys rather than blockchains themselves. The distinction also helps explain why stronger custody systems are important even when a blockchain’s core protocol remains secure.

Ethereum and Solana are part of the institutional custody push

Google says Alphabet is using the service to secure digital assets on Ethereum and Solana. These networks support a growing range of cryptocurrency, decentralized finance, and tokenized-asset applications.

Ethereum hosts extensive smart-contract infrastructure, including decentralized exchanges, lending protocols, and tokenized financial products. Solana has also attracted activity involving tokenized assets and blockchain-based financial services.

As institutions expand into these markets, they need custody infrastructure that can support transactions without giving any single employee, server, or system unrestricted control over assets.

Google’s public documentation describes support for multiple signing methods, including ECDSA, which is used by Ethereum and Bitcoin. Its documentation has also listed Solana’s Ed25519 signing support as coming soon, so the availability and implementation status of individual networks should be checked against the latest technical documentation.

The broader direction is clear: cloud providers are moving beyond general-purpose key storage toward services designed specifically for digital asset authorization and custody.

That could help financial institutions adopt blockchain-based products without building every component of their security infrastructure from scratch.

Google enters a competitive institutional custody market

Google is entering a market already served by specialist digital asset security providers, including Fireblocks, Fordefi, and BitGo.

Its existing Google Cloud Key Management Service and Cloud Hardware Security Module products help customers manage and protect cryptographic keys. The new MPC service is more specifically focused on cryptocurrency signing, transaction policies, and recovery.

Google’s cloud infrastructure and relationships with financial institutions could make the service attractive to organizations that want to integrate digital assets into existing technology systems.

However, institutions will still need to evaluate the product against alternatives based on security architecture, operational controls, availability, recovery options, compliance requirements, and cost.

Google has not yet disclosed the names of the financial institutions participating in the private preview or published pricing. It has also not released public performance comparisons against competing custody products.

Commercial adoption will depend on how the service performs in real institutional environments, not simply on the technology’s underlying design.

Google’s MPC service could support future quantum-resistant security

Quantum computing is another long-term concern for cryptocurrency custody.

Many digital asset systems rely on cryptographic techniques that could be threatened by sufficiently powerful quantum computers. Researchers are studying whether future machines could solve mathematical problems used in current public-key cryptography, potentially allowing attackers to derive private keys from exposed public keys.

Google has said its MPC architecture could support post-quantum cryptography in the future. However, that does not mean the current private-preview service already provides complete quantum-resistant protection.

MPC and post-quantum cryptography address different parts of the security problem. MPC distributes control of signing keys, reducing the risk associated with compromising a single participant. Post-quantum cryptography aims to replace or strengthen cryptographic algorithms that could become vulnerable to quantum attacks.

The two approaches may eventually work together, but institutions will still need a clear migration strategy as cryptographic standards and implementation options evolve.

Altcoin Buzz has also examined the potential market implications of Bitcoin held in quantum-exposed addresses. That analysis illustrates why key management and future cryptographic upgrades are becoming more important across the digital asset industry.

For now, Google’s immediate focus is protecting against compromised credentials and unauthorized transfers. Its future quantum-related capabilities remain an area to watch rather than a feature institutions should assume is already available.

What happens before the 2027 launch?

Google Multi-Party Compute remains in private preview, with several financial institutions and design partners testing the service. The company plans to make it commercially available in early 2027 but has not announced an exact date or pricing.

Before a wider rollout, institutions will need to assess how the service fits their existing custody operations, approval procedures, and regulatory obligations. They will also need to evaluate how key shares are distributed, how recovery works, and how access is managed across different participants.

The service does not remove the need for security reviews, operational controls, or independent risk management. Instead, it offers another way to reduce the consequences of a single compromised key or system.

Google’s entry signals that digital asset custody is becoming an increasingly important part of institutional blockchain infrastructure. If the service proves reliable and practical at scale, it could make it easier for banks and financial firms to manage cryptocurrency and tokenized assets.

For now, the key milestones are the results of private-preview testing, the publication of further technical details, and the planned commercial rollout in early 2027.

The information discussed by Altcoin Buzz is not financial advice. This is for educational, entertainment, and informational purposes only. Any information or strategies are thoughts and opinions relevant to the accepted levels of risk tolerance of the writer/reviewers, and their risk tolerance may be different than yours. We are not responsible for any losses that you may incur as a result of any investments directly or indirectly related to the information provided. Bitcoin and other cryptocurrencies are high-risk investments, so please do your due diligence.