Google is previewing Google Multi-Party Compute (MPC), a crypto custody and signing service that lets banks and other financial institutions hold and move cryptocurrencies and tokenized assets without any single machine ever storing a whole private key. The product was due to be shown on Wednesday 28 October 2026 at Google Cloud’s first digital assets symposium in New York, CoinDesk reported that morning at 11:00 UTC, followed minutes later by Crypto Briefing. It is in private preview. CoinDesk says commercial availability is planned for early 2027 and that pricing has not been disclosed.
That makes Google MPC a crypto custody product for institutions, not for people who hold bitcoin in an app. Google did not name a single customer. CoinDesk writes that “several design partners and major financial institutions” are testing the system, and that Alphabet itself has started using it to secure its own digital assets on Ethereum and Solana, without saying which assets.
One caveat on sourcing. As of 12:00 UTC on 28 October, we found no press release, blog post or product page from Google Cloud describing the service; its blog index showed nothing new. Everything below about the product comes from the two articles, published four minutes apart. We will add Google’s own page when it appears.
Google MPC splits each crypto key into shares held on separate systems
Multi-party computation is a family of cryptographic methods that let several computers produce a result together while none of them sees the others’ secret inputs. Applied to custody, it means a private key, the secret that authorises every transfer from a wallet, is never assembled in one place. Each participant holds a share. To sign a transaction, enough of them run a joint protocol and the signature comes out valid on the blockchain, as if a single key had signed it.
According to CoinDesk, Google’s version spreads key fragments across separate systems so there is no single point of failure, and Google says the complete key is never stored in one place. Crypto Briefing puts the same idea in practical terms: an attacker who breaks into one machine, or phishes one employee, gets a fragment that cannot move funds on its own.
Institutions choose the threshold. CoinDesk gives two-of-three and five-of-seven as examples, and describes a set-up in which a bank keeps one share in Google Cloud, one on its own hardware and one with another cloud provider. In that case Google alone could not sign anything, and neither could the bank’s own data centre.
A policy check runs before anything is signed
The second layer is a rules engine. Before a signature is produced, each transaction is checked against the institution’s own policies: limits on the amount, a list of allowed destination wallets, or a requirement that several departments approve. CoinDesk says this engine runs inside Google’s Confidential Space, a trusted execution environment, and that Google says it cannot access customers’ key material in unencrypted form.
At general availability the service is designed to sign with ECDSA, the signature scheme Bitcoin and Ethereum use, and Ed25519, used by Solana and several other chains. CoinDesk adds that Google says the architecture can later support post-quantum cryptography, with no timetable given. Key recovery and fast signing are promised too, though CoinDesk notes that Google offered no independently verified performance comparison with existing custody products.
Why custody tooling matters: stolen keys drive the largest share of crypto theft
Both articles say the protections are aimed at compromised credentials and unauthorized transactions. The figures CoinDesk uses to frame the launch come from Chainalysis and DefiLlama; we checked them against CoinDesk’s article, not against the underlying reports.
| Figure | Value | Source (as cited by CoinDesk) |
|---|---|---|
| Share of crypto stolen in 2024 that came from compromised private keys | 43.8% | Chainalysis |
| Cumulative losses of blockchain projects to hacks and exploits, as of June 2026 | $16.69 billion | DefiLlama |
| Share of those losses tied to private-key compromises | about 40% | DefiLlama |
| Resolv attack in March 2026 (compromised key plus minting weaknesses) | about $25 million | CoinDesk |
| Humanity Protocol, June 2026, from at least 17 wallets after a foundation member’s keys were compromised | more than $32 million (its token then fell more than 80%) | CoinDesk |
In many large thefts the weak point was a key that sat somewhere it could be taken, not a broken blockchain. That is the failure MPC is built for.
The “AI threats” angle is mostly about scams, not broken cryptography
CoinDesk’s headline links the launch to growing AI threats. The body of its article is more careful. It cites a Chainalysis finding that scams linked to vendors of AI tools took an average of $3.2 million per operation in 2025, against $719,000 for scams without such links, roughly 4.5 times as much. CoinDesk adds that the report does not show AI itself caused the higher takings.
It also reports a warning from Ethereum researcher Justin Drake that progress in AI could one day uncover mathematical shortcuts that break the signatures protecting Bitcoin and Ethereum wallets. CoinDesk then states plainly that no AI system has shown it can do this. Google’s product, it notes, deals with stolen credentials and unauthorized transactions, not with a hypothetical breakthrough against the cryptography itself.
Crypto Briefing’s article does not mention AI at all. On what both outlets describe, Google MPC is a product against key theft with a policy layer on top; the AI framing comes from one outlet’s headline, not from a feature Google has described.
Quantum computing is the longer-term risk in the background
Quantum computing comes up in both articles. CoinDesk recalls that Google researchers estimated a sufficiently powerful future quantum computer could derive a bitcoin private key from an exposed public key in about nine minutes, assuming advance preparation, and that about 6.9 million BTC have been reported as potentially exposed because their public keys are already visible. No such machine exists today. We covered the hardware side of that research in our report on Google’s quantum error-correction result and what it means for Bitcoin.
Splitting a key does not protect it from a quantum attack: once a valid ECDSA signature is on chain, the public key is public, however the signature was produced. That is why the promised post-quantum support matters more than the MPC label, and why its missing date is one of the open questions.
What Google MPC does not fix
Crypto Briefing lists the limits: MPC lowers the risk of a single stolen key but leaves risk in badly designed approval policies, in collusion between enough key holders to reach the threshold, and in flaws in the software that coordinates signing. CoinDesk adds deception: if legitimate users are tricked into authorising a malicious transaction, the shares will sign it as designed.
CoinDesk also points out that banks may still depend on Google for software, policies and operations, and that security depends on how each institution configures the system. Who is allowed to change the approval rules matters as much as the cryptography. A two-of-three scheme in which two shares sit with the same team, or a policy engine that one administrator can rewrite, brings back the single point of failure MPC was meant to remove.
Google Cloud joins Fireblocks, Fordefi and BitGo in institutional crypto custody
CoinDesk names Fireblocks, Fordefi and BitGo as the providers Google now competes with. MPC custody is not new: it is the technology on which Fireblocks built its business with banks, exchanges and payment firms, and Gemini Custody said it would move all its institutional accounts to MPC from 8 October 2026, according to Crypto Briefing.
What is new is the supplier. Until now Google sold general key-management products, Cloud Key Management Service and Cloud HSM, which store keys in Google-run software or hardware security modules but are not crypto custody systems. Google told CoinDesk it had never before offered a dedicated MPC custody product for cryptocurrencies. Google presents itself as a neutral infrastructure supplier that lets banks run their own custody businesses, and argues that its banking relationships and security expertise give it an edge over crypto custody specialists.
The idea has been on Google’s shelf for a while. In January 2023 the company published a blog post on running MPC for digital assets on Confidential Space, its trusted-execution product introduced in October 2022. The new service turns that idea into a product Google plans to sell; whether Google or the bank operates the signing nodes is not stated.
Rich Widmann, director of digital assets strategy at Google Cloud, told CoinDesk: “Digital asset adoption and tokenization are at an inflection point.” Some banks are already moving. Deutsche Bank was entered in the EU’s MiCA register for crypto custody on 12 October, and one of its executives was reported on 16 October as saying its crypto custody service would launch within weeks. Crypto Briefing also reports that MPC architecture used by Google Cloud has run with Anchorage Digital since 2025, “according to research findings”, and that Google Cloud Universal Ledger, its ledger for tokenized deposits, is being integrated with banking software provider Jack Henry. Neither article says Anchorage is a customer of the new product.
What this changes for crypto holders, and what it does not
For someone who keeps coins on an exchange or in a personal wallet, nothing changes today. Google MPC is not a consumer wallet, has no app and is not on sale. Its effect, if it reaches the market in 2027, would be indirect: a bank or broker that holds client crypto may choose Google’s service instead of an incumbent one, and clients would then depend on that bank’s configuration of it.
Holders who manage their own keys face the same trade-off as before. Some consumer wallets already use MPC to replace a seed phrase with shares spread between a phone and a server; others rely on hardware devices or multisig. Our guide to crypto wallets and custody choices explains the options and what each one protects against.
In the European Union, custody for clients is a regulated service under MiCA, and any bank or crypto-asset service provider using a cloud signing system remains responsible for safeguarding client assets. Neither article says when, or whether, Google MPC will be offered in Europe.
Open questions before the 2027 launch
- Which banks and design partners are testing it, and whether any will say so publicly.
- What it costs: CoinDesk says pricing has not been disclosed.
- Which blockchains it supports beyond the Ethereum and Solana assets Alphabet holds, and which assets those are.
- Whether an independent security audit of the protocol and the policy engine will be published; neither article mentions one.
- When post-quantum signatures arrive, since Google gave no timetable.
The next fixed point is the commercial launch, planned for early 2027 according to CoinDesk and “around 2027” according to Crypto Briefing. Until Google publishes its own documentation, the service’s exact design rests on what the company told two news outlets on 28 October.