Google’s MPC Breakthrough Puts Crypto Custody Security Under the Spotlight After Fireblocks Flaw

Google is reportedly preparing to broaden its presence in cryptocurrency security with a new Multi-Party Computation (MPC) service designed for institutional digital asset custody. The development comes as a newly disclosed vulnerability in Fireblocks’ MPC library draws attention to weaknesses that can emerge within crypto key-management systems.

The Google MPC service is said to be undergoing private testing, with major financial institutions reportedly evaluating the technology. It is also being used to protect digital assets on Ethereum and Solana, with a commercial launch expected in early 2027.

The timing has renewed focus on the security of institutional crypto infrastructure. On October 26, CERT/CC disclosed a vulnerability in Fireblocks’ MPC library that could undermine safeguards intended to protect cryptographic key shares.

How Google MPC Could Transform Crypto Custody

Multi-Party Computation allows several participants to jointly authorize a transaction without bringing an entire private key together in one location. Each participant retains a separate key share, and the parties work together to generate the required transaction signature.

This approach reduces dependence on a single device or individual, potentially limiting the damage caused by a compromised system or malicious insider. However, MPC does not automatically eliminate vulnerabilities in the software responsible for managing and processing those shares.

Google Cloud has already supported institutional MPC deployments through Confidential Space, a service that combines confidential computing with hardware-backed attestation. These protections help verify sensitive computing environments and restrict access to protected information, including during blockchain transaction signing.

The reported Google MPC offering would represent a further step toward dedicated security services for institutional crypto holders. By combining cloud infrastructure with cryptographic safeguards, the service could appeal to organizations responsible for managing substantial digital asset portfolios.

Institutions will nevertheless need to examine the service’s technical implementation, transaction authorization policies, and recovery mechanisms before adopting it. MPC is a cryptographic method, not an assurance that every part of a custody system is immune to security failures.

Fireblocks MPC Vulnerability Raises Key-Management Concerns

On October 26, CERT/CC published vulnerability advisory VU#701544, detailing a flaw in Fireblocks’ mpc-lib library. The issue involves the library’s implementation of BIP32 hardened key derivation when the required private parent key is unavailable.

According to the advisory, the software may insert a zero-filled buffer rather than stop the operation and return an error. If an attacker also obtains a compromised descendant signer share and its corresponding chain code, the attacker could potentially recover ancestor shares within that participant’s key hierarchy.

The vulnerability does not directly reveal a complete private key that can be used to spend funds. Instead, it weakens an additional security measure intended to restrict how much related key material could be exposed if a signer share were compromised.

CERT/CC reported that no vendor patch was available when the advisory was released. Its recommendations included keeping chain codes confidential and avoiding reliance on hardened derivation as a means of isolating signer shares until the implementation is corrected.

The incident demonstrates why institutional custody solutions, including Google MPC, must be assessed beyond their underlying cryptographic design. Distributing key material across multiple participants provides an important layer of protection, but the security of the overall system also depends on derivation logic, access permissions, and transaction approval procedures.

About The Author

ctleditor

See author's posts