• Blockstream and Thales launched a custody system that runs transaction signing inside HSMs.
  • Adam Back said complex MPC protocols can make fully offline cold storage difficult.
  • Back warned AI could help attackers find small flaws in complex MPC implementations.

Blockstream has launched an institutional digital asset custody system with French technology group Thales, bringing together hardware security modules and the Bitcoin infrastructure company’s Secure Multi-Party Computation technology.

The system is intended to keep the cryptographic operations used to authorize transactions inside Thales’ security hardware. Blockstream co-founder and CEO Adam Back said the launch indicates a concern about how difficult complex custody systems can be to secure, especially when they are connected to the internet.

Why Adam Back Says Offline Bitcoin Storage Matters

The system combines Thales’ hardware security modules, or HSMs, with Blockstream’s Secure-MPC technology. Blockstream said its architecture carries out the full signing protocol inside the HSMs’ protected environment.

That differs from conventional MPC implementations, which may perform parts of the signing process outside dedicated security hardware. Back noted that conventional MPC protocols can involve complex procedures and frequent communication between devices. Those requirements, he said, can make some approaches difficult to use for cold storage, where signing devices remain offline.

Follow us on X for real-time crypto updates. 

Could Connected Wallet Systems Face Greater Exposure?

Back pointed to the Binance breach, a $6.3 billion hack, as an example of the risks facing connected custody infrastructure. Binance’s investigation said attackers compromised employee devices and obtained credentials that gave them access to the exchange’s wallet-signing infrastructure.

“Even if it’s via firewalls and so on, there is risk that you can get unauthorized access,” Back said. He described how attackers could gain access to a network or obtain logins they should not have.

Back said keeping signing devices offline can reduce their exposure to those access risks. His comments link the custody system’s emphasis on hardware security to an argument for limiting connections to the systems that authorize transactions.

How AI Could Make Complex Security Harder to Manage

Back also warned that artificial intelligence could help attackers find minor flaws in complicated MPC implementations. “The AIs can help attackers find small implementation errors and things like that, which may not be obvious,” he said.

He said he hoped custody providers would adapt their security practices and move assets into cold storage. Back summed up his position by saying, “Complexity is the enemy of security,” and recommending that institutions “just cold-store it.”

Subscribe to our YouTube channel for the latest crypto news.

Related: Can You Really Lose Access to Your Bitcoin? TRM Labs’ New Service Raises Questions

Disclaimer: The information presented in this article is for informational and educational purposes only. The article does not constitute financial advice or advice of any kind. Coin Edition is not responsible for any losses incurred as a result of the utilization of content, products, or services mentioned. Readers are advised to exercise caution before taking any action related to the company.