Blockstream Moves MPC Signing Into Thales HSMs for Bank Custody

Blockstream has moved multi-party computation (MPC) signing for Bitcoin custody inside Thales Luna hardware security modules, pitching banks an architecture that keeps key material protected "throughout the transaction lifecycle, including during signing," according to the company's release. The design pairs MPC execution inside the HSM's secure environment with FROST, the threshold signature scheme specified in IETF RFC 9591, so a quorum of parties produces a single ordinary Schnorr signature without ever reconstructing the key.

The technical claim targets a known weakness in MPC custody. Standard deployments split a private key into shares held by separate parties, but commodity servers combine those shares in software during each signing session. An attacker who reaches that host obtains the inputs to a signing ceremony. Blockstream says its implementation executes the protocol inside the HSM itself rather than passing cryptographic operations out to the host.

What did Jeff Boortz say?

Jeff Boortz, Blockstream's chief product officer, framed the product as tightening the process while keeping familiar workflows. "By moving MPC execution inside the HSM, this architecture addresses critical security risks while preserving practical and popular signing capabilities valued by organizations who manage digital assets," Boortz said in the release. He added that Blockstream had "invested heavily in advanced cryptographic technologies, including FROST, to address the security requirements of institutional bitcoin custody."

Michael Minkevich, Blockstream's president and chief operating officer, tied the launch to bank procurement rather than trading desks. "Financial institutions require secure, reliable infrastructure as they integrate bitcoin into their existing operations," he said, noting the Thales work "builds on a two-year relationship to combine advanced hardware security with Blockstream's bitcoin engineering expertise."

Is the hardware actually certified?

The certification language carries weight and caveats. Thales describes its Luna general-purpose modules as designed to meet FIPS 140-3 Level 3 and Common Criteria requirements, per the vendor's product documentation. "Designed to meet" is not "certified": the Blockstream release names no module, firmware version, or certificate number, and does not say whether the specific configuration has been validated as a system rather than a component. Buyers requiring the certificate will ask for it in diligence, not in a press release.

Three further items are absent from the announcement:

• No independent auditor, penetration test, or code review is named.
• No institution appears as a user, pilot, or design partner — unusual for a bank-procurement pitch.
• Commercial terms and recovery mechanics, including share escrow and restoration after hardware failure or firmware upgrades, are not addressed.

The release also leaves the threshold configuration open. FROST supports different signing thresholds — a two-of-three arrangement behind one HSM boundary has different failure and collusion properties than a three-of-five arrangement spread across jurisdictions — and Blockstream's description of "distributed protection" fits either.

How concentrated is the Thales position?

The launch is the second major institutional custody platform this year to build its security story on Thales hardware. In February, Fireblocks integrated Thales Luna HSMs into its platform, positioning certified hardware as a bridge letting banks keep existing security models while holding digital assets. That is 276 days between the two announcements, and two of the market's largest signing platforms now describe their security boundary in terms of the same vendor's modules.

Concentration at this layer is ordinary — a short list of vendors supplies hardware behind card networks and certificate authorities, and Thales sells the same modules into PKI, code signing, TLS, mobile networks and digital identity. It remains a dependency a custody risk committee should be able to state in one sentence.

The launch also lands in a crowded quarter. On Nov. 9, Coinbase received final approval for a national trust bank charter from the OCC. On Nov. 13, DTCC said it would extend tokenized DTC securities onto Solana in 2027. Blockstream is not competing for a trust-bank mandate; it sells the signing layer beneath an institution's self-operated custody, aimed at firms that have already decided to hold keys themselves.

The first real signal will be a published FIPS 140-3 validation or Common Criteria certificate for the specific configuration, followed by a named reference customer and recovery documentation — deliverables that typically arrive quarters after the announcement and decide whether this becomes a product line.