Google is preparing to expand its crypto security operations with a new Multi-Party Computation (MPC) service targeting institutional digital asset custody. The move comes as a fresh vulnerability in Fireblocks’ MPC library highlights the risks buried inside crypto key-management systems.
Google MPC is reportedly in private preview, with major financial institutions testing the service. The technology is also being used to secure digital assets on Ethereum and Solana, with commercial availability expected in early 2027.
The timing puts institutional crypto security under renewed scrutiny. On October 26, CERT/CC disclosed a vulnerability in Fireblocks’ MPC library that could weaken protections separating cryptographic key shares.
CERT/CC’s Oct 26 advisory describes a hardened-derivation flaw in Fireblocks’ mpc-lib, CVE-2026-90975. A compromised descendant signer share plus its chain code can expose that party’s ancestor shares. This does not independently recover a full spendable key; MPC threshold…
— Venkata Satish Guttula
(@snakeyesV1) October 27, 2026
Discover: The Crypto Presales This Q4 2026
How Google MPC Could Change Crypto Custody
MPC allows multiple parties to participate in transaction signing without assembling a complete private key in one place. Instead, each participant holds a separate key share, and the parties collaborate to authorize transactions.
This design reduces the risk associated with a single compromised device or insider. However, MPC does not eliminate vulnerabilities in the software handling those shares.
Google Cloud has previously supported institutional MPC deployments through Confidential Space, which uses confidential computing and hardware-backed attestation. These safeguards help verify sensitive workloads and restrict access to protected data, including during blockchain transaction signing.
The reported Google MPC service would take the company further into dedicated institutional crypto security. Its appeal could lie in combining cloud infrastructure with cryptographic controls designed for organizations managing substantial digital asset holdings.
Now, institutions will still need to assess implementation details, transaction approval policies, and recovery procedures. MPC itself is a cryptographic technique, not a guarantee that every component of a custody system is secure.
Fireblocks MPC Vulnerability and Key Security Risks
CERT/CC published vulnerability VU#701544 on October 26, identifying a flaw in Fireblocks’ mpc-lib library. The issue affects its implementation of BIP32 hardened key derivation when a required private parent key is missing.
According to the advisory, the library can substitute a zero-filled buffer instead of rejecting the operation. If an attacker also obtains a compromised descendant signer share and its associated chain code, the attacker may recover ancestor shares within that party’s key hierarchy.
The flaw does not expose a complete, spendable private key. Instead, it weakens an additional protection designed to limit how far a compromised share can expose related key material.
CERT/CC said no vendor fix was available when its advisory was published. It recommended keeping chain codes confidential and avoiding reliance on hardened derivation to isolate signer shares until the implementation is corrected.
The incident illustrates why Google MPC security will need to be evaluated at the implementation level. Distributing private keys is one layer of protection, but derivation logic, access controls, and transaction approval mechanisms also matter.
Discover: The Best Token Presales
The post Google MPC Could Reshape Crypto Custody: Fireblocks Security Flaw Draws Attention appeared first on Cryptonews.
