Google is reportedly developing a new Multi-Party Computation (MPC) service aimed at strengthening cryptocurrency custody for institutional clients. The planned offering comes as a newly reported flaw in Fireblocks’ MPC library raises concerns about the security of systems designed to protect digital asset keys.
The Google MPC service is reportedly in private preview, with major financial institutions testing the technology. It is also being used to safeguard digital assets on Ethereum and Solana, while a broader commercial rollout is expected in early 2027.
The developments have brought institutional crypto security back into focus. On October 26, CERT/CC published an advisory detailing a vulnerability in Fireblocks’ MPC library that could weaken protections around cryptographic key shares.
Google MPC Could Bring a New Approach to Crypto Custody
Multi-Party Computation enables multiple participants to jointly sign transactions without reconstructing a complete private key in one place. Instead, each participant maintains a separate key share, and the parties cooperate to authorize a transaction.
This arrangement reduces reliance on a single device or individual, helping limit the potential impact of a compromised system or insider threat. However, distributing key shares does not eliminate software vulnerabilities in the systems that process and manage them.
Google Cloud has previously supported institutional MPC deployments through Confidential Space. The service combines confidential computing with hardware-backed attestation to help verify trusted computing environments and restrict access to sensitive information, including during blockchain transaction signing.
The reported Google MPC product would extend the company’s involvement in institutional digital asset protection. Its potential appeal lies in bringing cloud infrastructure together with cryptographic controls for organizations responsible for safeguarding large cryptocurrency holdings.
Before adopting the service, institutions will still need to evaluate its implementation, transaction authorization rules, and account recovery procedures. MPC can reduce certain security risks, but it does not guarantee that an entire custody platform is free from vulnerabilities.
Fireblocks Security Flaw Exposes Risks in MPC Implementations
On October 26, CERT/CC released vulnerability advisory VU#701544, identifying an issue in Fireblocks’ mpc-lib library. The flaw concerns its implementation of BIP32 hardened key derivation when the required private parent key is unavailable.
The advisory explains that the library may use a zero-filled buffer instead of rejecting the operation. If an attacker also gains access to a compromised descendant signer share and its associated chain code, the attacker could potentially derive ancestor shares within that participant’s key hierarchy.
The vulnerability does not directly reveal a complete private key that can independently authorize spending. Instead, it compromises an additional layer of protection intended to restrict how much related key material could be exposed after a signer share is compromised.
CERT/CC stated that no vendor fix was available when the advisory was published. Its guidance included protecting chain codes from disclosure and avoiding dependence on hardened derivation to isolate signer shares until the implementation is corrected.
The incident highlights why institutional custody platforms must be evaluated at the implementation level, regardless of the cryptographic techniques they employ. MPC distributes signing authority across participants, but overall security also depends on key-derivation logic, access controls, and transaction approval mechanisms.
