Google to Offer MPC Crypto Custody System to Banks in Early 2027

Google Multi-Party Compute for Banks

Google has built a system designed to block unauthorized transfers of digital assets, and it plans to put it in banks' hands from early 2027. The product, called Google Multi-Party Compute (MPC), marks the deepest step yet by the Alphabet subsidiary into institutional crypto infrastructure. Several major financial institutions are already validating the service in private preview ahead of its formal release. The system targets a specific point of failure. Moving crypto assets requires a private key, the secret that proves authority to spend, and a stolen key lets a thief drain a crypto wallet without the holder's consent. Google's answer adds transfer-rule verification and key-recovery functions to existing MPC technology, packaged so that banks no longer have to assemble each component themselves. Its architecture splits the secret material needed to sign a transaction across several locations: a bank's own facilities, Google's cloud, and a separate company's cloud. In a configuration that requires two of the three parties to cooperate, a breach at any single site is not enough to move funds on its own. Before the system produces the electronic signature that executes a transfer, it checks the amount, the destination and any required department approvals against rules the bank has set, pairing the split-key design with a screening layer. Google Cloud brings prior experience through Confidential Space, which runs workloads inside confidential computing environments with hardware-backed attestation, a setup that verifies sensitive jobs, including blockchain transaction signing, stay isolated from outside access. The technology is also being tested to secure digital assets on Ethereum (ETH) and Solana (SOL), extending the same key-management design to networks where institutions already hold substantial positions. Google has not disclosed pricing or the names of the institutions in the preview.

Fireblocks Flaw, CVE-2026-90975

The timing gives the announcement a sharper edge. On Monday, October 26, CERT/CC, the vulnerability coordination group, published advisory VU#701544 describing a flaw in the mpc-lib library maintained by custody provider Fireblocks, tracked as CVE-2026-90975. An October 27 post by security researcher Venkata Satish Guttula summarized the advisory, describing how a descendant signer share that has been compromised, combined with its chain code, can expose ancestor shares in the same hierarchy. The flaw sits in the library's implementation of BIP32 hardened key derivation, the method that generates child keys inside a hierarchy. When the required private parent key is missing, the library may insert a zero-filled buffer rather than reject the request. Per the advisory, an attacker who also obtains that compromised descendant signer share and its associated chain code may then recover ancestor shares within the party's key hierarchy. CERT/CC is explicit about the boundary: a full private key capable of spending funds is not directly exposed. What is weakened is a secondary protection meant to limit how far one compromised share can expose related key material. The advisory adds that no vendor fix existed when it went out, and it recommends keeping chain codes confidential and steering clear of hardened derivation as an isolation mechanism until the implementation is corrected. The disclosure lands on a technique many institutions treat as foundational. MPC allows several parties to sign a transaction without assembling a complete private key in one place: every participant keeps its own key share, and the group works together to approve each transfer. That design removes the single point of failure represented by one compromised device or a rogue insider, but it cannot repair vulnerabilities in the software handling those shares. Google's service rests on the same cryptographic principle, which is why the two developments are being read together.

@snakeyesV1 · X post

Summarized the advisory.

View on X

The CERT/CC advisory is the load-bearing document here: it records that the Fireblocks library substituted a zero-filled buffer when a parent key was missing, with no vendor fix available at publication. That is the standard Google's system will face. Distributing key shares is one layer; derivation logic, access controls and transaction-approval policies are others, and institutions choosing custody providers in 2027 will compare all of them line by line. Banks and crypto exchanges deciding whether to build MPC in-house or buy it from a cloud vendor now have a serious new option. Retail holders face a simpler equation: stolen keys still open the door, often with proceeds routed through a crypto mixer, which keeps basic crypto safety practices relevant no matter where the keys sit.