Google is reportedly preparing to launch a Multi-Party Computation (MPC) security service designed to protect institutional cryptocurrency holdings. The initiative comes as a newly disclosed vulnerability in Fireblocks’ MPC library exposes potential weaknesses in the software used to safeguard digital asset keys.

The Google service is reportedly in private preview, with major financial institutions testing its capabilities. The technology is also being used to secure assets on Ethereum and Solana, and a commercial launch is expected in early 2027.

The timing has placed institutional custody security under renewed scrutiny. On October 26, CERT/CC published details of a vulnerability in Fireblocks’ MPC library that could compromise safeguards intended to keep cryptographic key shares isolated.

How Google MPC Could Change Institutional Crypto Security

Multi-Party Computation allows several participants to jointly authorize blockchain transactions without bringing a complete private key together in one location. Each participant retains a separate key share, and the participants cooperate to generate the necessary signature.

This structure reduces dependence on a single device or individual, helping limit the risks associated with compromised hardware or insider threats. However, MPC cannot prevent every software-level weakness in the systems responsible for managing those shares.

Google Cloud has previously supported institutional MPC implementations through Confidential Space, which combines confidential computing with hardware-backed attestation. These features help verify trusted computing environments and restrict access to sensitive information, including data involved in blockchain transaction signing.

The reported Google MPC offering would expand the company’s role in specialized security infrastructure for institutional digital asset management. Its combination of cloud computing capabilities and cryptographic protections could appeal to organizations responsible for safeguarding large cryptocurrency portfolios.

Nevertheless, institutions will need to examine the service’s technical design, transaction approval processes, and recovery procedures before relying on it. MPC provides a method for distributing signing authority, but it does not guarantee that an entire custody system is secure.

Fireblocks Vulnerability Raises Questions About MPC Safeguards

On October 26, CERT/CC released vulnerability advisory VU#701544, identifying a flaw in Fireblocks’ mpc-lib library. The issue involves its implementation of BIP32 hardened key derivation when the required private parent key is unavailable.

According to the advisory, the library may insert a zero-filled buffer instead of stopping the operation with an error. If an attacker also obtains a compromised descendant signer share and its associated chain code, the attacker could potentially recover ancestor shares within that participant’s key hierarchy.

The flaw does not directly expose a complete private key that can independently authorize cryptocurrency transfers. Instead, it weakens an additional security measure intended to restrict how much related key material becomes vulnerable when a signer share is compromised.

CERT/CC said a vendor fix was not available when the advisory was published. Its recommendations included keeping chain codes confidential and avoiding reliance on hardened derivation to isolate signer shares until the implementation is corrected.

The disclosure highlights why institutional crypto custody systems must be assessed at the implementation level, rather than judged solely by their use of MPC. Distributing key shares is an important security measure, but effective protection also depends on reliable derivation logic, access controls, and transaction authorization mechanisms.