Google Cloud previewed Google Multi-Party Compute on October 28, 2026, in New York, offering banks a key-splitting custody system aimed at eliminating single points of failure. Designed to combat private-key compromises—which accounted for 43.8% of stolen crypto in 2024—the platform distributes key shares across clouds and hardware while enforcing policy rules inside Confidential Space. Commercial availability is planned for early 2027.
Google Cloud MPC unveiling and symposium
- ▪Google Cloud's MPC Symposium on October 28, 2026, in New York featured speakers from financial institutions including Morgan Stanley, Citi, Wells Fargo, and OKX.
- ▪Google Cloud unveiled Google Multi-Party Compute in private preview
Policy enforcement and cryptographic signing
- ▪Google Cloud updated its Multi-Party Compute service release notes, adding transaction amount evaluation, destination address type identification, and Ed25519 signing support
- ▪Google Cloud's initial Multi-Party Compute service supports conventional ECDSA signing for Bitcoin and Ethereum, with Ed25519 support planned for Solana.
- ▪Google Multi-Party Compute adds MPC-based transaction signing, policy enforcement, and key recovery to Google Cloud Key Management Service and Cloud HSM infrastructure.
- ▪Google Multi-Party Compute uses a policy engine running inside Google Cloud Confidential Space to check transactions against spending caps, destination restrictions, and multi-person authorization rules before signing.
Key share distribution and protection
- ▪Google Cloud states that key shares are held in encrypted form and that Google cannot access customers' key material in unencrypted form on its infrastructure.
- ▪Google Multi-Party Compute splits private cryptographic key fragments across separate environments, allowing financial institutions to distribute key shares across on-premises hardware, Google Cloud, and competing cloud providers.
- ▪Google Multi-Party Compute allows financial institutions to set threshold signing requirements, such as requiring two-of-three or five-of-seven key share holders to authorize a transaction.
Post-quantum cryptography preparedness
- ▪Google Cloud stated its Multi-Party Compute architecture is designed to accommodate future post-quantum cryptography upgrades without requiring financial institutions to rebuild their operational systems.
- ▪Google researchers estimated that a sufficiently powerful future quantum computer could theoretically derive a Bitcoin private key from an exposed public key in approximately 9 minutes.
Cryptocurrency losses from compromised keys
- ▪Chainalysis reported that compromised private keys accounted for 43.8% of all stolen cryptocurrency in 2024, representing approximately $2.2 billion in total losses.
- ▪DeFiLlama data showed that blockchain projects lost a cumulative $16.69 billion to hacks and exploits as of June 2026, with roughly 40% attributed to private-key compromises.
- ▪In June 2026, attackers compromised private keys belonging to a Humanity Protocol foundation member, draining more than $32 million from at least 17 wallets.
Fireblocks library vulnerability
- ▪CERT/CC recommended keeping chain codes confidential and avoiding reliance on hardened key derivation to isolate signer shares until Fireblocks corrects its mpc-lib library implementation.
- ▪CERT/CC published advisory VU#701544 on October 26, 2026, identifying a hardened-derivation vulnerability in Fireblocks' mpc-lib library under CVE-2026-90975.
Story comments
Loading comments…