Google previews crypto custody security system ahead of 2027 launch

Google has unveiled plans for a crypto security service that distributes private-key control across separate computing environments, targeting commercial availability in early 2027 as financial institutions seek stronger protection for digital assets.

Google Multi-Party Compute is undergoing private testing with several major financial institutions ahead of its presentation at the company’s inaugural digital assets symposium in New York, as per CoinDesk report. Alphabet, Google’s parent company, has begun using the technology to secure its own digital assets on Ethereum and Solana.

Meanwhile, the company has not named the financial institutions testing the service or disclosed which assets Alphabet holds through the system. Pricing remains unavailable, while the planned commercial launch depends on completing the preview program.

Google introduces MPC security for institutional crypto custody

Google Multi-Party Compute uses cryptographic techniques that divide control of a private key among several independent participants. Authorized parties cooperate to sign blockchain transactions without assembling the entire private key in one location, reducing dependence on any single device or administrator.

Under Google’s proposed architecture, institutions can distribute signing shares among their own equipment, Google Cloud and competing cloud providers. A bank could require approvals from two of three participants or five of seven before authorizing a transfer.

The service includes transaction policies designed to check requests before signing begins. Institutions can restrict destination addresses, impose transfer limits or require additional approvals, with those checks operating inside Google’s Confidential Space environment.

Previously, Google published technical guidance in April 2023 explaining how organizations could build distributed-signing systems using Confidential Space. The proposed product combines similar capabilities with signing policies and recovery tools in a dedicated service.

Existing Google Cloud Key Management Service and Cloud HSM products already protect cryptographic keys. The new offering focuses specifically on the authorization and recovery requirements of digital assets, where a completed blockchain transaction generally cannot be reversed.

Private-key breaches expose weaknesses in crypto infrastructure

Google’s planned service arrives as compromised credentials remain a persistent source of cryptocurrency losses. Chainalysis estimated that private-key compromises accounted for 43.8% of cryptocurrency stolen during 2024.

A June incident involving Humanity Protocol illustrated how multiple signing credentials can become vulnerable through a single compromised device. As crypto.news reported after the investigation, an attacker obtained seven private keys stored on a developer’s computer and used them to access administrative controls.

The stolen credentials allowed unauthorized transactions and contract changes across Ethereum and BNB Smart Chain. Humanity Protocol said the attack involved valid signatures generated using compromised keys, not an underlying flaw in its blockchain contracts.

Google’s approach seeks to limit such concentration of signing authority. Its security still depends on how customers separate their key shares, protect administrators and manage approval policies.

An October examination of institutional crypto custody controls explained that distributing credentials does not eliminate operational risk if several signing participants share the same administrative privileges or recovery systems.

Google enters market served by specialized custody providers

The proposed service places Google’s cloud infrastructure closer to established digital asset security providers, including Fireblocks, Fordefi and BitGo. Institutions already use specialized platforms to administer wallets, control transaction approvals and maintain records of asset movements.

Google is targeting banks that want to retain direct control of their custody operations while using external technology. Its service would provide signing infrastructure without requiring a financial institution to transfer ownership of its private keys to Google.

In September, UniCredit was exploring digital asset custody and brokerage infrastructure as European banks developed services for cryptocurrencies and tokenized securities. Fireblocks has separately supplied wallet and tokenization technology to the Qivalis banking consortium.

Google has not disclosed performance benchmarks comparing its proposed system with existing commercial products. The identities of its testing partners remain confidential, leaving the scale of initial institutional participation unknown.

AI threats raise questions over future wallet security

Google is positioning its service partly against cyberattacks involving increasingly capable AI tools. Chainalysis reported that scams associated with AI-tool providers generated average proceeds of $3.2 million per operation in 2025, compared with $719,000 for scams without such links.

The comparison measures proceeds associated with different groups of scams. It does not establish that AI caused the higher losses or that MPC could have prevented those schemes.

Ethereum researcher Justin Drake has warned about possible AI advances that might eventually weaken cryptographic assumptions protecting blockchain wallets. No publicly demonstrated AI system can currently derive ordinary Bitcoin or Ethereum private keys by breaking their underlying signature algorithms.

Google said the proposed service will support ECDSA and Ed25519 signing at general availability. Its architecture is intended to accommodate future post-quantum cryptography upgrades, although the company has not announced a timetable for adding those signing methods.

The company has not disclosed a precise commercial release date beyond early 2027 or identified the first institutions expected to adopt the service after private testing.