Google Prepares Crypto Custody Security Launch as AI Threats Rise

Google is preparing to introduce Google Multi-Party Compute (MPC), a security platform designed to help banks and other financial institutions protect and transfer cryptocurrencies and tokenized assets. The company is expected to present the system at its first digital assets symposium in New York City on Wednesday.

The service remains in private preview and is not yet available to the general public. Google told CoinDesk that several major financial institutions and design partners are testing the technology. Alphabet, Google’s parent company, has also started using MPC to safeguard its digital assets on the Ethereum and Solana networks.

Google has not disclosed the identities of the participating institutions or the assets Alphabet is protecting. Commercial availability is planned for early 2027, although pricing details have not been announced.

MPC is an established approach to digital asset security, and Google has explored the technology before. It works by dividing a private key into separate shares distributed across multiple systems, eliminating the need to keep the complete key in one location. In 2023, Google published guidance on building MPC-based digital asset infrastructure using its Confidential Space platform.

The company said it has not previously offered a dedicated MPC custody product for cryptocurrencies. Its existing production tools include Google Cloud Key Management Service (KMS) and Cloud HSM, which help organizations manage and secure cryptographic keys. The new service combines MPC-based transaction signing, policy enforcement and key recovery in a dedicated digital asset solution, reducing the need for customers to build these components independently.

The launch comes as banks and financial services companies investigate blockchain technology for tokenized securities, payment processing and digital asset custody. These operations require robust transaction authorization because blockchain transfers are generally irreversible once confirmed.

“Digital asset adoption and tokenization are at an inflection point. As regulated financial institutions begin adopting blockchains and tokenization, they need scalable, proven infrastructure to secure their clients’ assets,” Rich Widmann, Google Cloud’s director of digital assets strategy, told CoinDesk.

Protecting private keys remains a central challenge for institutions entering the market. If an attacker gains control of the key securing a wallet, they may be able to transfer its funds without authorization.

The financial impact of compromised keys has been substantial. Blockchain analytics firm Chainalysis reported that private-key compromises accounted for 43.8% of cryptocurrency stolen in 2024. DeFiLlama data separately showed that blockchain projects had accumulated $16.69 billion in losses from hacks and exploits by June this year, with approximately 40% linked to private-key breaches.

Recent incidents illustrate the risks. In March, stablecoin protocol Resolv suffered an attack involving a compromised private key tied to a privileged account, alongside weaknesses in its minting system. The attacker extracted approximately $25 million. In June, hackers compromised the private keys of a Humanity Protocol foundation member and drained more than $32 million from at least 17 wallets. The incident also triggered a decline of over 80% in the project’s token, demonstrating how stolen credentials can damage market confidence beyond the value of the stolen assets.

Google’s new platform aims to reduce dependence on a single private key through multi-party computation. Rather than relying on one complete key, the system distributes control among multiple participants or computers, requiring separate pieces of cryptographic information to work together to authorize transactions.

According to Google, the full private key is never assembled or stored in one place. This reduces the potential impact of a compromised machine. The company also says customers retain control of their key material and that Google cannot access it in unencrypted form, even when key shares are stored on its infrastructure.

AI and quantum computing introduce new security concerns

Google is presenting the service as a response to increasingly sophisticated cyber threats, including those associated with artificial intelligence and the potential future capabilities of quantum computing.

AI tools are already being used in some cryptocurrency scams, while researchers are examining whether future advances could challenge the cryptographic systems that protect digital assets.

Chainalysis found that cryptocurrency scams associated with AI-tool vendors generated an average of $3.2 million per operation in 2025, compared with $719,000 for scams without such links. That represents roughly 4.5 times the proceeds, although the findings do not establish that AI itself caused the difference.

Ethereum researcher Justin Drake recently warned that AI advances could eventually uncover mathematical techniques capable of breaking the digital signatures protecting Bitcoin and Ethereum wallets. In a worst-case scenario, he said such a breakthrough could emerge within months rather than years, potentially before quantum computers become powerful enough to pose the same threat.

However, no AI system has demonstrated the ability to break the cryptographic signatures securing Bitcoin or Ethereum wallets. AI may help identify weaknesses in poorly secured software, but that is different from defeating the underlying cryptographic algorithms. Google’s current MPC protections are intended to address risks such as compromised credentials and unauthorized transactions, not a hypothetical breakthrough against existing cryptography.

The platform can check transactions against institutional policies before allowing them to be signed. Rules could block transfers that exceed predefined limits or fail to meet required approval conditions, potentially reducing the likelihood of unauthorized transactions. However, these safeguards cannot necessarily prevent legitimate users from being manipulated into approving malicious transfers.

Quantum computing presents a separate, longer-term concern for financial institutions considering blockchain adoption.

Google researchers have previously estimated that a sufficiently powerful future quantum computer could theoretically derive a Bitcoin private key from an exposed public key in approximately nine minutes, given advanced preparation. No existing quantum computer can perform this attack. Nevertheless, around 6.9 million BTC have reportedly been identified as potentially exposed to future quantum attacks because their public keys are already visible.

Google says its architecture is designed to accommodate future upgrades to post-quantum cryptography, which aims to protect digital signatures against sufficiently powerful quantum computers. At general availability, the service is expected to support conventional ECDSA and Ed25519 signing algorithms.

The company has not announced when post-quantum signing will be introduced. It said upgrades could be implemented as blockchain networks adopt the necessary cryptographic standards, without requiring institutions to redesign their infrastructure or halt operations.

How Google’s MPC system is designed to work

A bank using the platform could distribute its signing credentials across several environments. One key share might be held in Google Cloud, another on the bank’s own hardware, and a third with a separate cloud provider.

When the institution initiates a transfer, the transaction enters Google’s Confidential Space environment. A policy engine checks the request against the bank’s requirements before the signing process proceeds.

Those requirements could cover transfer amounts, approved destination wallets and authorization from multiple departments. The checks take place inside Confidential Space, which uses hardware-isolated computing environments to protect sensitive information from unauthorized access.

Google says institutions can configure different signing thresholds. For example, a transaction could require two of three participants or five of seven participants to cooperate in generating a valid signature.

This flexibility is intended to help banks benefit from cloud infrastructure without handing any single technology provider complete control over the credentials required to move their assets.

Institutions can distribute key shares across their own hardware, Google Cloud and competing cloud services. Google also says the system supports rapid transaction signing and key recovery, though it has not released independently verified performance comparisons against competing custody platforms.

Google enters a market dominated by specialist providers

Google’s planned offering places the cloud giant in more direct competition with established digital asset security companies, including Fireblocks, Fordefi and BitGo. These providers offer tools that help institutions secure blockchain transactions and manage digital asset credentials.

Google believes its existing banking relationships and security expertise could distinguish its platform from specialist crypto security firms. It also sees an opportunity to serve banks that prefer a neutral infrastructure provider rather than a company competing for the same customers.

Under this approach, financial institutions could operate their own custody businesses while relying on Google’s technology for parts of their security infrastructure.

However, using a large cloud provider does not eliminate the need to evaluate third-party risks. Even when key shares are distributed across separate environments, institutions may remain dependent on Google for parts of the software, transaction policy system and operational infrastructure.

Security will also depend on how each institution configures the platform, protects the participants involved in signing transactions and restricts access to changes in approval rules.

Ultimately, adoption will depend on whether financial institutions consider Google’s service suitable for their custody requirements and how much of their critical financial infrastructure they are willing to entrust to the company.

About The Author