Blockstream Ships Institutional Custody Built on Thales HSMs

Blockstream launched an institutional digital-asset custody solution developed with Thales on Friday, keeping the entire transaction-signing process inside hardware security modules rather than relying on software-based multi-party computation.

The system pairs Thales' HSMs with Blockstream's Secure Multi-Party Computation (MPC) technology. Its distinguishing architectural choice: the full signing protocol runs inside the HSMs' protected environment. Conventional MPC deployments, by contrast, may execute parts of the signing process outside dedicated hardware, which widens the attack surface an adversary can probe.

For custody operators, banks and asset managers evaluating infrastructure, the design decision matters. It determines where private keys and signing logic live during the most sensitive phase of any transaction, and whether any component of that phase touches general-purpose computing equipment.

Why Adam Back wants simpler cold storage

Blockstream CEO Adam Back, speaking around the launch, argued that conventional MPC protocols carry structural problems for fully offline cold storage. They can be too complex and demand too much communication among devices, which works against the goal of keeping keys air-gapped.

"Complexity is the enemy of security. And going back to basics is the answer, you know, just cold-store it," Back said.

His position places him against part of the industry consensus. Over the past several years, MPC-based wallet infrastructure has become a default choice for many institutional custodians and fintech platforms, precisely because it distributes key material across parties and removes the single-device failure point of older hardware-wallet setups. Back's argument is that the distribution itself introduces complexity, and that complexity creates the vulnerabilities it was meant to eliminate.

What does this change for custody operators?

The practical question for practitioners is what the Blockstream-Thales approach changes operationally. Two consequences stand out:

• Signing stays inside certified hardware. Because the full protocol executes within Thales HSMs, operators gain a smaller, auditable trust boundary instead of coordinating signing logic across multiple software environments.
• Offline storage becomes less dependent on device-to-device communication. Back contends that MPC's communication requirements complicate fully offline architectures; the HSM-resident design reduces that dependency.

Back also raised a forward-looking operational concern. Internet-connected equipment, he said, can remain exposed to unauthorized access even when protected by firewalls. Persistent firewall protection, in his framing, is not a substitute for removing signing infrastructure from the network entirely.

He added a warning about artificial intelligence. AI tools, he said, could help attackers find subtle flaws in complex MPC implementations. The implication for security teams: attack surface that is hard for humans to audit today may become materially easier for machine-assisted adversaries to exploit tomorrow, which strengthens the case for simpler, hardware-bounded designs.

Competitive context and next steps

The launch intensifies a quiet architectural debate inside institutional custody. One camp builds on distributed software signing; the other, now including Blockstream and Thales, pushes toward hardened hardware boundaries with minimal protocol sprawl. For firms issuing custodial services under regulatory scrutiny, the choice increasingly shapes audit scope, insurance terms and the certification story they can present to examiners.

Blockstream, best known for its Bitcoin infrastructure work including the Liquid sidechain and mining operations, is extending its institutional footprint with this custody product, while Thales adds another crypto-asset use case to its established HSM business in banking and defense.

Institutions now weighing a migration or a first deployment will be watching whether the HSM-resident MPC design gains adoption among regulated custodians, and whether competing vendors respond by moving more of their own signing logic into certified hardware.