Google Cloud Introduces MPC Security Infrastructure for Institutions
On October 28, 2026, Google Cloud showcased Google Multi-Party Compute, a new Multi-Party Computation (MPC) service, at its digital assets symposium in New York. The service is designed for banks and other financial institutions seeking to securely manage and authorize transactions involving cryptocurrencies and tokenized assets.
The product is currently in private preview, with several design partners and major financial institutions testing the technology. Google Cloud told media outlets that it plans to make the service commercially available in early 2027, although a specific release date and pricing have not been announced.
Alphabet, Google's parent company, has also started using the technology to protect some of its digital assets on the Ethereum and Solana networks. However, Google has not disclosed the specific assets, amounts involved, or the identities of participating financial institutions.
The launch reflects the growing involvement of major cloud computing companies in institutional digital asset infrastructure. As banks explore crypto custody, tokenized securities, and blockchain-based payments, secure private-key management and transaction authorization have become essential requirements for institutional adoption.
How MPC Reduces Single-Point-of-Failure Risks in Key Management
In traditional cryptocurrency security models, a private key is the credential that authorizes blockchain transactions. If an attacker obtains a complete private key capable of independently controlling a wallet, the associated assets may be transferred without authorization. Concentrating key material in one location can therefore create a significant single point of failure.
MPC uses cryptographic techniques to distribute control of transaction signing across multiple participants or computing environments. When a transaction is initiated, the participants cooperate to generate a valid signature according to a predefined threshold. The complete private key does not need to be reconstructed or stored on a single device.
Under the architecture described by Google, a financial institution could distribute key shares across its own hardware, Google Cloud, and another cloud provider. A transaction can be signed only when the required number of participants satisfies the configured authorization conditions. This approach reduces the risk that compromising one device or service provider will give an attacker complete control over the signing key.
Google Multi-Party Compute also incorporates transaction policy controls. Before signing, transactions can be checked against rules involving transfer amounts, destination wallet addresses, and internal approval requirements. For example, a bank could establish spending limits, destination allowlists, or multi-department authorization procedures.
However, MPC does not eliminate all security risks. If enough signing participants are compromised, or if institutional approval policies are poorly configured, unauthorized transactions may still be possible. It also cannot necessarily prevent legitimate employees from being manipulated into approving malicious transfers. MPC therefore needs to operate alongside access management, operational auditing, and employee security training.
Google's Entry Adds Competition to Institutional Custody Technology
Google Cloud's move places it closer to competing with established institutional digital asset security providers such as Fireblocks, Fordefi, and BitGo. These companies offer infrastructure for institutional wallet management, transaction approvals, and blockchain asset security.
Google's potential advantages include its cloud infrastructure, enterprise relationships, and experience in security technology. For banks that do not want to outsource their entire digital asset custody operations to specialist crypto providers, Google's service could offer another infrastructure option. Institutions can use external technology while retaining control over their key shares and transaction approval processes.
However, the involvement of a cloud provider does not remove the institution's responsibility for managing security risks. Financial firms still need to assess software security, system availability, key recovery procedures, access configurations, and business continuity arrangements. Even when a complete private key is not stored in one location, transaction-signing systems and their governance processes can introduce other vulnerabilities.
Google is targeting early 2027 for commercial availability. Key developments to watch include the blockchain networks supported at launch, the financial institutions that adopt the service, its pricing structure, and the availability of independent security assessments.
More broadly, institutional digital asset custody is evolving beyond basic wallet and key storage. It increasingly involves distributed signing, transaction policies, and organizational access governance. Google's entry could intensify competition in this market, but the service's long-term value will depend on real-world deployments and demonstrated security performance.