Blockstream, the Bitcoin infrastructure firm led by cryptographer Adam Back, introduced an institutional custody product on Friday that keeps the entire transaction-signing protocol inside dedicated security hardware built by France's Thales, an arrangement the company says narrows the exposure of keys to networked systems.
The offering pairs Thales hardware security modules, or HSMs, with Blockstream's Secure Multi-Party Computation technology. Under the design, institutions authorize transfers while the full signing sequence executes within the HSM's protected environment, instead of distributing pieces of that process across machines that sit outside hardened hardware.
Blockstream drew an explicit contrast with conventional MPC deployments, which in some configurations carry out parts of the signing work in general-purpose computing environments. Confining the protocol to the HSM, the company argues, shrinks the number of components an intruder could reach through a misconfiguration or a stolen credential.
Back, a co-founder and chief executive of Blockstream whose Hashcash proof-of-work design preceded Bitcoin's own, said existing MPC protocols are poorly suited to machines kept entirely off the internet. In remarks to Cointelegraph, he described them as "some very esoteric and complicated protocols that are hard to secure and are very interactive," adding that the interactivity makes them impractical for cold storage.
He linked the custody question to a concrete precedent: the breach at Binance, which the exchange's own investigation traced to compromised employee devices and credentials that opened a path into its wallet-signing infrastructure. The episode, which the source material valued at $6.3 billion, illustrated how connectivity can convert an internal system into a reachable target.
"If you connect equipment to the internet, even if it's via firewalls and so on, there is risk that you can get unauthorized access," Back said. "You can get hackers into the network, get hackers with access to logins they shouldn't have and so on."
He also flagged artificial intelligence as a factor that could sharpen the threat, arguing that attackers may use AI tools to surface small coding flaws inside elaborate MPC implementations that would escape ordinary review. "The AIs can help attackers find small implementation errors and things like that, which may not be obvious," he said.
The argument cuts to a trade-off at the center of institutional custody: added cryptographic sophistication can broaden functionality while making the system harder to verify and harden. Blockstream's answer is to reduce the moving parts that live outside tightly controlled hardware.
Asked whether the wider custody industry would follow, Back said he hoped so, and urged institutions to shift holdings into cold storage to limit their exposure. "Complexity is the enemy of security," he said. "And going back to basics is the answer, you know, just cold-store it."
Note: Details as described by Blockstream in its announcement.
For institutional investors, the launch adds an offline-oriented option to a custody market that has generally leaned on multi-party computation and geographically split key shares. The practical test will be integration: whether the architecture holds its security boundaries once plugged into real trading, settlement and treasury workflows, and whether clients accept the operational constraints that come with keeping signing inside dedicated hardware.
The two companies are effectively wagering that attackers will keep adapting, including with AI-assisted methods, and that simpler, less exposed signing flows will command a premium. Further technical and deployment disclosures from Blockstream and Thales are likely to be scrutinized for how authorization is handled at scale while signing stays confined to protected hardware.
