Mentioned in This Article
1. What is Google Multi-Party Compute?
Google on Wednesday, October 28, is set to showcase Google Multi-Party Compute, a service for safeguarding and moving crypto and tokenized assets, at its first digital assets symposium in New York City. The product is in private preview, financial institutions are testing it, and Alphabet, Google's parent company, uses it to secure its own holdings on Ethereum (ETH) and Solana (SOL). Commercial availability is planned for early 2027.
Google Multi-Party Compute is a managed signing and key-protection service aimed at banks and other regulated firms. It divides the cryptographic key that authorizes a transaction into fragments, keeps those fragments in separate environments, and applies an institution's own rules before any signature is produced. The company says the design can eventually support post-quantum cryptography as well.
The timing reflects a broader shift in how large financial firms approach blockchains. Tokenized deposits, stablecoin settlement and tokenized funds are moving from pilots toward production at banks, and each of those uses requires a dependable way to authorize transfers on public networks. Custody technology is therefore becoming a competitive question for the cloud providers that already host banking workloads.
Several details remain undisclosed. Google has not named the institutions taking part in the preview, has not said which assets Alphabet protects with the system, and has not announced pricing. The service is not generally available, so every claim about its speed and resilience currently comes from Google rather than from independent testing.
2. How does it differ from Google's existing key tools?
Multi-party computation is not a new idea in digital assets, and Google has touched it before. The technique splits a private key into pieces held on different systems so that no single machine is a point of failure. In 2023 Google published guidance on building such systems with Confidential Space, its infrastructure for processing sensitive data in protected environments.
What is new is the packaging. Google describes the offering as its first dedicated custody product for crypto built around this approach. The company already sells Cloud Key Management Service and Cloud HSM, both of which protect cryptographic keys, but neither was designed specifically for moving blockchain assets. The new service combines threshold signing, transaction policies and key recovery in a single purpose-built product.
Rich Widmann, director of digital assets strategy at Google Cloud, framed the launch as a response to a turning point in adoption and tokenization. In his view, regulated institutions need infrastructure that is both scalable and proven before they commit large volumes of customer assets to blockchains.
3. Why does private-key security matter so much to banks?
Whoever controls a wallet's private key can move the assets inside it without asking the owner. Blockchain transfers are also generally irreversible once confirmed, so there is rarely a way to claw back funds after an unauthorized signature. For banks and asset managers that are only now building tokenization, payments and custody businesses on public networks, that combination makes key management the central operational risk.
The loss data supports the concern. Chainalysis reported that compromised private keys accounted for 43.8% of the crypto stolen in 2024. DeFiLlama figures show that hacks and exploits had cost roughly $16.69 billion cumulatively as of June 2026, with about 40% of that traced to private-key compromises.
Recent cases show how this plays out. In March, the stablecoin protocol Resolv lost about $25 million after an attacker used a compromised key tied to a privileged account and then exploited weaknesses in the minting process. In June, attackers obtained the keys of a Humanity Protocol foundation member and drained more than $32 million from at least 17 wallets, and the project's token subsequently fell by more than 80%.
4. How does multi-party computation protect a key?
Multi-party computation spreads control of a key across several parties or machines. Approving a transaction requires distinct cryptographic contributions from each participating share, so no one device ever assembles or stores the complete key. An attacker who breaches a single server therefore gains only a fragment that cannot sign on its own.
Google says customers retain control of their key material and that the company cannot read it in unencrypted form, even when some shares sit on Google's own infrastructure. That claim matters for banks that want the convenience of a cloud provider without handing over unilateral authority to it.
An institution could, for example, keep one signing share in Google Cloud, a second on its own hardware and a third with a different cloud provider. A transfer request would enter Google's Confidential Space, where a policy engine checks it against the bank's rules before signing begins. Those checks run in hardware-isolated environments designed to block unauthorized access.
The rules themselves are configurable. Institutions can cap transfer amounts, restrict the wallets that may receive funds and require approvals from several departments. They can also set signing thresholds, such as two of three or five of seven participants, so that a transaction proceeds only when enough approvers agree. Google claims fast signing and reliable key recovery but has not released independently verified performance comparisons.
5. Where do AI and quantum threats come in?
Google positions the service as protection against increasingly sophisticated attacks, including those that draw on artificial intelligence and, over a longer horizon, quantum computing. The two threats are very different, and the evidence behind each varies.
On the AI side, some crypto scammers already use the technology to scale their operations. Chainalysis found that scams linked to vendors of AI tools averaged $3.2 million per operation in 2025, compared with $719,000 for those without such links, roughly 4.5 times as much. The report does not establish that AI caused the higher proceeds.
A more speculative warning comes from Ethereum researcher Justin Drake, who has argued that advances in AI could eventually uncover mathematical shortcuts that break the signatures protecting Bitcoin and Ethereum wallets, possibly within months in a worst case and potentially before capable quantum machines exist. No AI system has demonstrated such a break. AI has, however, helped find flaws in weak encryption tools, as in a recent certification authority failure.
Google's service does not address a hypothetical cryptographic breakthrough. It targets compromised credentials and unauthorized transactions by checking requests against institutional rules before signing. It also cannot stop a legitimate user from being tricked into approving a malicious transfer.
6. Is the post-quantum claim realistic?
Quantum computing is not imminent, but it is a distinct long-term concern for institutions entering digital assets. Google researchers have estimated that a sufficiently powerful future quantum computer could derive a Bitcoin private key from an exposed public key in about nine minutes, given advance preparation. About 6.9 million BTC are potentially vulnerable because their public keys are already visible on the blockchain. No machine with that capability exists today.
Google says its architecture can accommodate post-quantum upgrades. At general availability the service will support the standard ECDSA and Ed25519 signature schemes, and the company gave no timetable for post-quantum signing. It says upgrades could be introduced as networks adopt new schemes, without a redesign or downtime.
For institutions, the practical value of that promise lies in avoiding a second migration. A custody platform whose signing layer can be swapped as standards change spares a bank from rebuilding workflows, approval chains and audit trails when the underlying cryptography eventually shifts.
7. Who are Google's competitors in crypto custody?
Google would be entering a market served by specialists such as Fireblocks, Fordefi and BitGo. It argues that its existing relationships with banks and its security expertise give it an advantage. It also pitches itself as a neutral supplier that lets banks operate their own custody businesses rather than depend on rivals for core infrastructure.
Institutions will still need to weigh provider risk. A bank using the service could rely on Google for software, transaction policies and infrastructure at once, concentrating dependency even as key shares are distributed. Security also depends on how each institution configures the system, protects its signing participants and controls who is allowed to change approval rules.
Concentration risk is not unique to Google. Any outsourced custody arrangement asks a client to trust the vendor's engineering and operational discipline. What differs here is scale: a hyperscale cloud provider already sits inside many banks' technology stacks, so adding custody to that relationship can make the dependency deeper while making procurement simpler.
The test, then, is whether banks regard the offering as safer than purpose-built custody providers and how much critical infrastructure they are willing to entrust to one of the largest cloud companies.
8. What happens next?
The symposium in New York marks the public introduction, while the product remains limited to design partners and major institutions in private preview. Google has pointed to early 2027 for commercial availability and has not yet set out pricing or the list of supported networks beyond the standard signature schemes.
Banks weighing the product will likely look at several practical questions during the preview period. One is how quickly a transaction can be approved when several departments must sign off. Another is how key shares are recovered if a participating system fails or an employee leaves. A third is whether policy changes themselves require the same multi-party approval as transfers, since an attacker who can quietly rewrite the rules could defeat the controls without ever touching a key.
Between now and then, the preview participants are the ones to watch. Their feedback on signing speed, recovery procedures and policy controls will shape whether the service becomes a mainstream option for banks building tokenization and custody operations, or remains one choice among several in a crowded field.