Google to preview crypto custody security system as AI threats grow

Google to showcase a new security system designed to help banks and other financial institutions safeguard and move cryptocurrencies and tokenized assets at its inaugural digital assets symposium in New York City on Wednesday.

The product, officially named Google Multi-Party Compute (MPC), is in private preview and is not yet generally available. Several design partners and major financial institutions are testing the technology, Google told CoinDesk. Alphabet, the parent company, has also begun using it to secure its own digital assets on the Ethereum and Solana blockchains.

Google did not identify the institutions testing the service or specify which digital assets Alphabet is securing. The company plans to make Google Multi-Party Compute commercially available in early 2027, but has not disclosed pricing.

MPC isn't new to digital assets, nor is Google's involvement in the technology. The idea is to split a private key into individual fragments and distribute them across multiple separate systems, so there is no single point of failure. In 2023, Google published guidance explaining how customers could build MPC-based digital-asset systems using its Confidential Space infrastructure.

Google said it has not previously offered a dedicated MPC custody product for cryptocurrencies. Its existing production services include Google Cloud Key Management Service (KMS) and Cloud HSM, which institutions use to manage and protect cryptographic keys. The new offering brings MPC-based signing, transaction policies and key recovery into a purpose-built service for digital assets, rather than requiring customers to assemble those capabilities themselves.

The move comes as banks and other financial companies explore using blockchains to issue tokenized assets, process payments and offer digital asset custody services. Those activities require institutions to securely authorize transactions that, once completed on a blockchain, generally cannot be reversed.

“Digital asset adoption and tokenization are at an inflection point. As regulated financial institutions begin adopting blockchains and tokenization, they need scalable, proven infrastructure to secure their clients’ assets," Rich Widmann, director of digital assets strategy at Google Cloud, told CoinDesk.

An attacker who gains control of the private key protecting a wallet may be able to transfer its assets without the owner's permission, making key management a critical security challenge for institutions entering the market.

The threat has already cost the crypto industry billions of dollars over the years. According to blockchain analytics firm Chainalysis, compromised private keys accounted for 43.8% of cryptocurrency stolen in 2024. Separately, DeFiLlama data showed that as of June of this year, blockchain projects have lost a cumulative $16.69 billion to hacks and exploits, with roughly 40% of those losses attributed to private-key compromises.

How the system works

A bank, for example, could keep one share of a cryptographic signing key in Google Cloud, another on its own hardware and a third with another cloud provider.

When the bank wants to move assets, the transaction enters Google's Confidential Space, where a policy engine checks it against the institution's rules before signing can begin, according to Google.

Those rules could include limits on the amount being transferred, restrictions on destination wallets and requirements for approval from several departments. The checks run inside Google's Confidential Space technology, which uses hardware-isolated computing environments designed to protect sensitive information from unauthorized access.

Google says the system can also accommodate different cryptographic signing thresholds, such as requiring two of three or five of seven participants to jointly produce a transaction signature.

That flexibility is intended to address a concern for banks: they may want the convenience of cloud infrastructure without giving a single technology provider complete control over the credentials needed to move their assets.

Google said institutions can distribute those credentials across their own hardware, Google Cloud and competing cloud services. The company also said its system supports fast transaction signing and key recovery, although it did not provide independently verified performance comparisons with existing custody products.

A new competitor

Google's planned entry to the market brings one of the world's largest cloud providers closer to competing in a market already served by specialist crypto security firms, including Fireblocks, Fordefi and BitGo, which offer technology to help institutions protect and authorize blockchain transactions.

Google argues that its banking relationships and security expertise give it an edge over specialized crypto custody providers. It also sees an opportunity among banks wary of relying on providers that compete for the same customers, positioning itself as a neutral infrastructure supplier that lets institutions run their own custody businesses.

It's worth noting that Google's entry does not eliminate the need for institutions to assess the risks of their technology providers. Even when signing credentials are distributed across different environments, banks may still depend on Google for parts of the software, transaction policies and operational infrastructure.

The system's security also depends on how institutions configure it, protect their signing participants and control who can change transaction-approval rules.

The test will be whether institutions eventually see Google's offering as a safer alternative to specialized crypto custody providers and how much critical financial infrastructure they are willing to entrust to Google.