Google Advances Crypto Custody Security as Digital Threats Evolve

Google is preparing to unveil a new cryptocurrency security service designed for banks and institutional investors as financial firms look for safer ways to manage digital assets. The company plans to showcase Google Multi-Party Compute (MPC) at its first digital assets symposium in New York City on Wednesday.

The platform remains in private preview, with several major financial institutions and selected partners testing the technology. Google told CoinDesk that Alphabet has also started using the system to protect its digital assets on the Ethereum and Solana blockchains.

Google has not disclosed the names of the participating institutions or identified the assets Alphabet is securing. The company expects to launch the service commercially in early 2027, though pricing has not yet been announced.

Multi-party computation is a security technique that divides a private key into separate cryptographic shares stored across different systems. Instead of keeping a complete key in one location, multiple participants work together to authorize transactions. Google previously explored this approach in 2023, publishing guidance on building MPC-based digital asset systems with its Confidential Space infrastructure.

The company said it has not previously offered a dedicated MPC custody service for cryptocurrencies. Its existing products, including Google Cloud Key Management Service (KMS) and Cloud HSM, help businesses manage and protect cryptographic keys. The new offering brings distributed signing, transaction policy enforcement and key recovery into one service tailored to digital assets.

The move comes as banks and financial services companies explore blockchain-based payments, tokenized investments and cryptocurrency custody. These applications require strong transaction controls because confirmed blockchain transfers generally cannot be reversed.

“Digital asset adoption and tokenization are at an inflection point. As regulated financial institutions begin adopting blockchains and tokenization, they need scalable, proven infrastructure to secure their clients’ assets,” Rich Widmann, Google Cloud’s director of digital assets strategy, told CoinDesk.

Private-key security remains a major concern for institutional investors. If an attacker gains control of a wallet’s private key, the assets it holds may be transferred without the owner’s approval.

Chainalysis found that compromised private keys accounted for 43.8% of cryptocurrency stolen in 2024. Separately, DeFiLlama data showed that blockchain hacks and exploits had caused $16.69 billion in cumulative losses by June this year, with around 40% attributed to private-key compromises.

Recent breaches illustrate the risks. In March, stablecoin protocol Resolv lost approximately $25 million in an attack involving a compromised private key associated with a privileged account and weaknesses in its minting system. In June, attackers compromised the private keys of a Humanity Protocol foundation member and drained more than $32 million from at least 17 wallets. The incident also sent the project’s token down more than 80%, demonstrating how security breaches can affect both stolen funds and market confidence.

Google’s new platform is designed to reduce the risks of relying on a single private key. By distributing signing authority across multiple participants or computers, the system requires separate cryptographic shares to work together before a transaction can be authorized.

Google says the complete private key is never stored in one place, limiting the potential damage from a compromised machine. The company also states that customers retain control of their key material and that Google cannot access it in unencrypted form, even when shares are held on its infrastructure.

AI and quantum computing raise security concerns

Google is positioning its MPC service as part of a broader response to increasingly sophisticated cyber threats, including AI-assisted fraud and the potential long-term risks posed by quantum computing.

Artificial intelligence is already being used in some cryptocurrency scams, while researchers continue to examine whether future technological advances could weaken the cryptographic protections used by digital asset networks.

Chainalysis reported that cryptocurrency scams associated with AI-tool vendors generated an average of $3.2 million per operation in 2025, compared with $719,000 for scams without such links. That represents approximately 4.5 times the proceeds, although the findings do not establish that AI directly caused the difference.

Ethereum researcher Justin Drake has warned that advances in AI could eventually reveal mathematical shortcuts capable of breaking the digital signatures protecting Bitcoin and Ethereum wallets. In a worst-case scenario, he suggested such a breakthrough could arrive within months rather than years, potentially before sufficiently powerful quantum computers become available.

No AI system has demonstrated the ability to break the cryptographic signatures securing Bitcoin or Ethereum wallets. Identifying weaknesses in poorly protected software is different from defeating the underlying cryptographic algorithms. Google’s current MPC service is intended to address threats such as compromised credentials and unauthorized transfers, rather than hypothetical breakthroughs against those algorithms.

The platform can check proposed transactions against institutional policies before signing takes place. Banks could set maximum transfer amounts, restrict destination wallets or require approval from multiple departments. These measures may help prevent unauthorized transfers, although they cannot necessarily stop users from being deceived into approving fraudulent transactions.

Quantum computing presents a separate, longer-term challenge. Google researchers have previously estimated that a sufficiently powerful future quantum computer could theoretically derive a Bitcoin private key from an exposed public key in approximately nine minutes, assuming advanced preparation. No existing quantum computer can carry out such an attack. However, around 6.9 million BTC have reportedly been identified as potentially vulnerable to future quantum attacks because their public keys have been exposed.

Google says its architecture is designed to accommodate future post-quantum cryptography upgrades, which aim to protect digital signatures against sufficiently powerful quantum computers. At general availability, the service is expected to support conventional ECDSA and Ed25519 signing algorithms.

The company has not announced a timeline for adding post-quantum signing capabilities. It says upgrades could be introduced as blockchain networks adopt compatible cryptographic standards, without requiring institutions to redesign their systems or suspend operations.

How the MPC platform operates

A bank could distribute its cryptographic signing shares among several environments, keeping one in Google Cloud, another on its own hardware and a third with a separate cloud provider.

When the bank initiates a transaction, the request enters Google’s Confidential Space environment. A policy engine checks it against the institution’s rules before the signing process can begin.

These rules might specify transfer limits, approved destination addresses and authorization requirements involving multiple departments. Confidential Space uses hardware-isolated computing environments intended to protect sensitive information from unauthorized access.

Google says institutions can configure different signing thresholds, including arrangements requiring two of three participants or five of seven participants to jointly produce a valid transaction signature.

The design aims to give banks the benefits of cloud infrastructure without giving any single technology provider complete control over the credentials needed to transfer assets. Institutions can distribute signing shares across their own systems, Google Cloud and other cloud providers.

Google also says the platform supports rapid transaction signing and key recovery. However, the company has not released independently verified performance comparisons against existing custody products.

Google enters a competitive digital asset security market

The planned service brings Google into closer competition with established cryptocurrency security providers such as Fireblocks, Fordefi and BitGo. These companies offer tools that help institutions protect digital assets and authorize blockchain transactions.

Google believes its financial-sector relationships and experience in cloud security could help distinguish its offering. It is also positioning itself as an infrastructure provider for banks that want to run their own custody operations rather than depend entirely on specialist firms that may compete for the same customers.

However, using Google’s technology does not remove the need to assess third-party risks. Even when cryptographic shares are distributed across multiple environments, institutions may remain dependent on Google for elements of the software, policy enforcement and operational infrastructure.

The system’s security will also depend on how institutions configure the service, protect the participants involved in transaction signing and restrict who can change approval policies.

Whether the offering gains traction will ultimately depend on how financial institutions assess its security model and how much critical financial infrastructure they are willing to place within Google’s ecosystem.