Google MPC Could Change Digital Asset Security as Fireblocks Vulnerability Fuels Custody Concerns

Google is reportedly developing an institutional-grade Multi-Party Computation (MPC) service for cryptocurrency custody as a newly disclosed Fireblocks vulnerability draws attention to weaknesses in digital asset security infrastructure.

The service is said to be undergoing private testing with major financial institutions. Google’s MPC technology is also reportedly being used to protect digital assets on Ethereum and Solana, with a wider commercial release anticipated in early 2027.

The development comes as security researchers highlight the importance of how cryptographic protections are implemented. On October 26, CERT/CC disclosed a vulnerability in Fireblocks’ MPC library that could undermine safeguards designed to isolate cryptographic key shares.

Google Expands Its Institutional Digital Asset Security Efforts

MPC allows multiple parties to sign blockchain transactions collectively without reconstructing a complete private key in a single location. Each participant controls a separate share, and the participants coordinate to authorize a transaction.

This arrangement can reduce the risks of a single device being compromised or one individual gaining unilateral control over assets. However, distributing key shares does not eliminate vulnerabilities in the software that manages them.

Google Cloud has already supported institutional MPC deployments through Confidential Space. The service uses confidential computing and hardware-backed attestation to help verify secure computing environments and protect sensitive data, including information used during blockchain transaction signing.

The reported dedicated MPC service could deepen Google’s involvement in institutional crypto security by combining its cloud infrastructure with specialized cryptographic controls for organizations holding substantial digital assets.

However, institutions will still need to evaluate the service’s underlying implementation, transaction approval rules, and key-recovery procedures. Using MPC alone does not establish that a custody platform is resistant to every potential attack.

Fireblocks Flaw Highlights Weaknesses in Key Derivation

CERT/CC’s October 26 advisory, VU#701544, described a vulnerability in Fireblocks’ mpc-lib library involving BIP32 hardened key derivation when the required private parent key is unavailable.

The reported behavior allows the library to substitute a zero-filled buffer rather than reject the operation. If an attacker also obtains a compromised descendant signer share and its associated chain code, they could potentially derive ancestor shares within the affected participant’s key hierarchy.

The vulnerability does not directly reveal a complete private key that can independently authorize transactions. Instead, it weakens an extra layer of protection intended to limit the exposure of related cryptographic material.

At the time CERT/CC published the advisory, a vendor fix was not available. The organization recommended protecting chain codes and avoiding reliance on hardened derivation to isolate signer shares until the implementation is corrected.

The issue underscores a broader challenge for institutional crypto custody providers: security depends on more than the cryptographic method itself. Proper key-derivation logic, restricted access, carefully designed transaction approvals, and effective recovery procedures all contribute to protecting digital assets.