Blockstream has launched an enterprise custody solution developed with Thales, a French technology and cybersecurity group, according to a company announcement on November 13. The system combines Thales' hardware security modules (HSMs) with Blockstream's Secure Multi-Party Computation, or Secure-MPC, a technology that spreads signing authority across multiple parties so no single person or device controls the private key.
The key distinction of Blockstream's approach is where the signing process occurs. The system executes the signing protocol entirely within the HSM's secure environment, while conventional MPC solutions may expose parts of the process to general-purpose computers that are easier to attack. The system also uses FROST, a threshold signing protocol that allows multiple authorized parties to jointly produce a signature without ever reconstructing the full private key.
Jeff Boortz, Blockstream's chief product officer, stated that "by moving MPC execution inside the HSM, this architecture addresses critical security risks."
Timing Follows Recent High-Profile Breach
The launch comes two weeks after hackers stole approximately $6.3 billion from Binance in an attack the FBI attributed to North Korea. According to Binance, attackers staged fake job interviews and planted malware in a coding assignment downloaded onto an engineer's work computer. The campaign also included a June incident in which a wallet engineer downloaded a tampered installer while seeking an AI coding tool. By October 20, attackers had used a compromised computer and an internal AI tool to access machines of two additional employees working on Binance's wallet infrastructure, obtaining credentials and a container deployment token.
Hardware-based custody is designed to prevent such attacks by ensuring that if signing keys never leave a sealed device, a compromised laptop becomes far less useful to attackers.
Institutional Adoption and Infrastructure Development
For financial institutions, custody security represents a critical requirement. Michael Minkevich, Blockstream's president and chief operating officer, noted that "financial institutions require secure, reliable infrastructure as they integrate bitcoin into their existing operations."
Thales has also expanded its work with Fireblocks to keep signing operations inside customer-owned HSMs at banks and regulated institutions. The approach reflects a broader industry movement toward reducing the number of places where cryptographic keys can be exposed, particularly as artificial intelligence makes it easier for attackers to identify vulnerabilities in complex software.
Blockstream has prior experience with security challenges. In September, its Liquid Network sidechain was drained of nearly 4,000 BTC through a software bug, with attackers later returning 3,400 BTC after the flaw was patched.
