Google’s MPC Vault Enters Testing as Fireblocks’ Key-Sharing Flaw Raises Eyebrows

Google is preparing to expand its cryptocurrency security operations with a Multi-Party Computation (MPC) service aimed at institutional digital asset custody. The service is reportedly in private preview, with major financial institutions testing it, while Google expects commercial availability in early 2027. It is also being used to secure digital assets on Ethereum and Solana.

The announcement comes amid renewed scrutiny of MPC key-management systems following a vulnerability disclosure by CERT/CC on October 26. The advisory identified a hardened-derivation flaw in Fireblocks’ mpc-lib, designated CVE-2026-90975, that could weaken protections separating cryptographic key shares.

According to CERT/CC, a compromised descendant signer share combined with its chain code can expose that party’s ancestor shares. The flaw does not independently recover a full spendable key, but it highlights the security requirements surrounding systems designed to distribute sensitive cryptographic material.

MPC allows multiple parties to authorize transactions without assembling a complete private key in one location. Each participant holds a separate key share, and the parties collaborate to sign transactions, reducing the risk associated with a single compromised key.