Google Launches MPC Service Amid Fireblocks Vulnerability

Google Cloud has entered the institutional crypto custody market with a private‑preview Multi‑Party Computation (MPC) service that combines threshold signing, transaction‑policy enforcement and enterprise governance. According to Google’s technical overview, the solution splits signing authority across independent participants so that no single device holds a complete private key. The service supports secp256k1 signing for Bitcoin and Ethereum‑style networks, with Ed25519 support for Solana slated for future release. The announcement comes as a recent vulnerability in Fireblocks’ MPC library drew attention to the remaining risks in key‑management systems. CERT/CC disclosed a flaw in Fireblocks’ mpc‑lib on October 26 that allowed a zero‑filled buffer to be used when a required parent key was missing. The issue could let an attacker recover ancestor key shares if they also had a compromised descendant signer share and its chain code, but it did not expose a spendable private key. The advisory noted that no vendor fix was available at the time and urged users to keep chain codes confidential and avoid relying on hardened derivation until the implementation was corrected.

Google’s MPC Design and Coverage

Google’s documentation describes a hardened threshold‑signing approach that isolates key shares in separate hardware environments. The service can enforce policy checks and enterprise governance rules, allowing organizations to specify who can request a transaction and under what conditions it can be authorized. While the preview focuses on Bitcoin and Ethereum networks, the company has indicated that Solana support will follow. The service is expected to become commercially available in early 2027, with major financial institutions already testing the private preview.

Implications for Institutional Custody

The Fireblocks vulnerability illustrates that MPC alone does not eliminate all custody risks. Even with distributed key shares, implementation details such as derivation logic, access controls and transaction‑approval mechanisms remain critical. Institutions adopting Google’s MPC will need to assess recovery procedures, participant uptime, and policy administration. The service addresses theft or unauthorized use of a key, temporary inability to sign, and permanent loss of key material, but it does not remove the need for robust governance and operational controls.

What to Watch Next

Key milestones include the general availability of Google’s MPC service, demonstrated integrations with regulated custodians, and publicly disclosed security evaluations. Observers should monitor how institutions configure policy enforcement and recovery mechanisms, and whether any incidents arise that test the robustness of the threshold‑signing model.