Google is preparing to enter the institutional crypto custody market with a dedicated security platform designed to help banks and financial companies protect digital assets. The upcoming service, Google Multi-Party Compute (MPC), is expected to be presented at the company’s first digital assets symposium in New York City on Wednesday.

The product is currently in private preview, with several major financial institutions and design partners testing the technology. Google told CoinDesk that Alphabet has also started using the system to secure its digital assets on Ethereum and Solana.

The company has not named the institutions participating in the trials or disclosed which assets Alphabet is protecting. Google expects to make the service commercially available in early 2027, although it has not announced pricing.

MPC is an established method of securing digital assets. It splits control of a private key into separate cryptographic shares distributed across different systems, allowing participants to authorize transactions without assembling the complete key in one location. Google previously explored this technology in 2023, publishing guidance on building MPC-based digital asset systems with its Confidential Space infrastructure.

Google said it has not previously offered a dedicated MPC custody product for cryptocurrencies. Its existing Google Cloud Key Management Service (KMS) and Cloud HSM products help organizations manage cryptographic keys. The new platform is designed to bring distributed signing, transaction policy enforcement and key recovery together in a purpose-built digital asset service.

The launch comes as banks and financial institutions examine blockchain applications for tokenized assets, payments and cryptocurrency custody. These activities require reliable authorization controls because blockchain transactions generally cannot be reversed once confirmed.

“Digital asset adoption and tokenization are at an inflection point. As regulated financial institutions begin adopting blockchains and tokenization, they need scalable, proven infrastructure to secure their clients’ assets,” Rich Widmann, Google Cloud’s director of digital assets strategy, told CoinDesk.

Private-key security remains a major challenge for the industry. If attackers obtain control of a wallet’s private key, they may be able to transfer its assets without the owner’s permission.

Chainalysis reported that compromised private keys accounted for 43.8% of cryptocurrency stolen in 2024. Meanwhile, DeFiLlama data showed that blockchain hacks and exploits had generated $16.69 billion in cumulative losses by June this year, with approximately 40% of those losses linked to private-key compromises.

Recent incidents demonstrate the potential damage. In March, stablecoin protocol Resolv suffered an attack involving a compromised private key connected to a privileged account and weaknesses in its minting system. The attacker extracted about $25 million. In June, hackers compromised the private keys of a Humanity Protocol foundation member and drained more than $32 million from at least 17 wallets. The incident also caused the project’s token to fall by more than 80%.

Google’s MPC system aims to limit these risks by distributing signing authority across multiple participants or computing environments. Instead of depending on a single private key, the platform requires separate cryptographic shares to cooperate before a transaction can be authorized.

According to Google, the complete private key is never stored in one place, reducing the potential damage if a single machine is compromised. The company also says customers retain control of their key material and that Google cannot access it in unencrypted form, even when the shares are stored on its infrastructure.

AI and quantum computing add to cybersecurity concerns

Google is positioning the platform against an evolving threat environment that includes AI-assisted attacks and the possibility that future quantum computers could undermine existing cryptographic protections.

Artificial intelligence is already being used in some cryptocurrency scams, while researchers are investigating whether advances in AI could eventually expose weaknesses in the cryptographic systems securing digital assets.

Chainalysis found that cryptocurrency scams associated with AI-tool vendors generated an average of $3.2 million per operation in 2025, compared with $719,000 for scams without such connections. That is approximately 4.5 times as much, although the findings do not prove that AI directly caused the difference.

Ethereum researcher Justin Drake has warned that advances in AI could potentially uncover mathematical shortcuts capable of breaking the digital signatures protecting Bitcoin and Ethereum wallets. In a worst-case scenario, he suggested such a breakthrough could occur within months rather than years, potentially ahead of the arrival of sufficiently powerful quantum computers.

However, no AI system has demonstrated that it can break the cryptographic signatures securing Bitcoin or Ethereum wallets. Finding flaws in poorly protected software is different from breaking the underlying cryptographic algorithms. Google’s current MPC offering focuses on risks such as compromised credentials and unauthorized transactions, rather than hypothetical breakthroughs against those algorithms.

The system can also evaluate transactions against institutional policies before signing begins. Banks could establish transfer limits, restrict destination wallets and require approval from multiple departments. These checks can help prevent unauthorized transfers, although they may not stop users from being tricked into approving malicious transactions.

Quantum computing poses a separate, longer-term risk. Google researchers have previously estimated that a sufficiently powerful quantum computer could theoretically derive a Bitcoin private key from an exposed public key in around nine minutes under assumptions involving advanced preparation. No existing quantum computer can perform such an attack, but approximately 6.9 million BTC have reportedly been identified as potentially exposed to future quantum threats because their public keys are visible.

Google says the platform’s architecture is designed to support future upgrades to post-quantum cryptography, which aims to protect digital signatures against sufficiently powerful quantum computers. At general availability, the service is expected to support the conventional ECDSA and Ed25519 signing algorithms.

The company has not provided a schedule for introducing post-quantum signing. It says upgrades could be added as blockchain networks adopt compatible cryptography, without requiring institutions to rebuild their systems or interrupt operations.

How Google Multi-Party Compute works

A bank could distribute its signing credentials across multiple environments, keeping one cryptographic share in Google Cloud, another on its own hardware and a third with a different cloud provider.

When the bank initiates a transfer, the transaction enters Google’s Confidential Space environment. A policy engine checks whether the request complies with the institution’s rules before signing can proceed.

These policies could include maximum transaction amounts, approved destination wallets and requirements for authorization from several departments. Confidential Space uses hardware-isolated computing environments designed to protect sensitive information against unauthorized access.

Google says customers can configure different signing thresholds, including arrangements that require two of three participants or five of seven participants to cooperate in producing a valid signature.

This approach is intended to give banks the advantages of cloud infrastructure without handing a single provider complete control over the credentials needed to move assets. Institutions can distribute key shares among their own hardware, Google Cloud and competing cloud services.

The company also says the platform supports fast transaction signing and key recovery. However, it has not published independently verified performance comparisons with existing custody solutions.

Google challenges established crypto security providers

The planned launch puts Google in more direct competition with specialist digital asset security companies such as Fireblocks, Fordefi and BitGo. These firms provide technology that helps institutions secure digital assets and authorize blockchain transactions.

Google believes its established financial-sector relationships and cloud security expertise could help it compete in this market. It is also presenting itself as a neutral infrastructure provider for banks that want to operate their own custody services without relying entirely on specialist providers that may compete for the same customers.

Nevertheless, using Google’s platform will not eliminate third-party risks. Even with key shares distributed across several environments, institutions may still depend on Google for parts of the software, transaction policies and operational infrastructure.

Security will also depend on how each customer configures the system, safeguards its signing participants and controls who can modify transaction approval rules.

Ultimately, the platform’s adoption will depend on whether financial institutions consider its security model suitable for their needs and how much of their critical financial infrastructure they are prepared to entrust to Google.