Mentioned in This Article
1. Blockstream Unveils a Hardware-Bound Custody System
Blockstream on Friday, November 13, launched an institutional Bitcoin (BTC) custody system developed with French technology group Thales. The product pairs Thales hardware security modules with Blockstream's Secure Multi-Party Computation technology, so that institutions can approve transactions while the sensitive key material used to sign them never leaves dedicated, offline-oriented hardware.
The launch reflects a deliberate design philosophy. Rather than adding more software layers to protect digital assets, Blockstream has chosen to anchor the most sensitive part of the process, the creation of a valid transaction signature, inside physical devices built for exactly that job.
Blockstream presented the security architecture behind the system at the Digital Assets Forum in New York on the same day as the announcement, giving institutional attendees a direct look at how the components fit together.
2. What Is Blockstream?
Blockstream is a Bitcoin infrastructure company co-founded in 2014 by cryptographer Adam Back. It has built its business around tools and services designed specifically for Bitcoin rather than for other blockchains, and it has long positioned itself as a supplier of technology for both individual users and institutions.
Among its best-known enterprise products is the Liquid Network, a sidechain connected to Bitcoin that is designed for faster settlement and for the issuance of digital assets. The company has also developed hardware and software wallets for individual holders.
The new custody system extends that institutional focus. Blockstream's enterprise custody and tokenization services opened in beta to a select group of private clients during the third quarter of 2026, and the Thales partnership adds a hardware security layer aimed squarely at large holders.
3. How the Secure-MPC Signing Model Works
Blockstream markets its multi-party computation technology under the name Secure-MPC. In this approach, the authority to sign a transaction is divided into separate shares held by different parties. A valid signature can only be produced when several of those parties work together, and no single share is enough to move funds on its own.
Multi-party computation has become a common tool in institutional custody because it removes the single point of failure created when one private key controls an entire balance. If one share is lost or compromised, an attacker still cannot spend the coins without cooperation from the other share holders.
However, splitting a key into shares does not by itself solve every problem. The devices and software that hold those shares, and the process by which they combine to produce a signature, can themselves become targets. That is where Blockstream's partnership with Thales comes in.
4. Hot Wallets, Cold Storage and the Custody Trade-Off
Bitcoin custody has always involved a balance between convenience and protection. Ownership of Bitcoin comes down to control of private keys: whoever can produce a valid signature can move the coins, and a confirmed transaction on the network cannot be reversed. A stolen key therefore means permanently lost funds, with no bank or clearing house able to claw the money back.
Keys kept on internet-connected systems, often called hot wallets, make it easy to send transactions quickly but expose those keys to remote attack. Keys kept offline, known as cold storage, are far harder to reach but traditionally slower and more cumbersome to use, especially for an institution that needs several people to sign off on each transfer.
Institutional custody products try to capture the security of cold storage while preserving the controls and approval workflows that large organizations require. Blockstream's system is its answer to that problem: approval is shared among several parties through multi-party computation, while the signing itself happens only inside hardware designed to keep keys sealed away from connected machines.
5. Why the Signing Stays Inside Thales Hardware
The defining feature of the system is that the entire transaction-signing protocol runs inside Thales hardware security modules. During signing, neither the private keys nor the individual MPC key shares ever leave the hardware boundary.
Blockstream draws a contrast with conventional MPC implementations, which may carry out parts of the signing process outside dedicated security hardware. Any step that takes place on a general-purpose server or connected computer creates an opportunity, however small, for an attacker who has gained access to that machine.
A hardware security module is a tamper-resistant physical device designed to generate, store and use cryptographic keys without exposing them to the outside world. Banks and payment networks have relied on such devices for decades to protect card keys, signing certificates and other sensitive secrets. By running the full MPC protocol within this protected environment, Blockstream aims to combine the shared-control benefits of multi-party computation with the physical isolation that HSMs are built to provide.
Thales is one of the established suppliers of this kind of hardware, which gives institutions a familiar component to evaluate when assessing the overall system.
6. Adam Back's Case for Fewer Moving Parts
Blockstream co-founder Adam Back has been arguing for simpler, offline security models, and the new product puts that view into practice. His core argument is that every additional moving part in a security system is another potential opening for an attacker. Fewer components mean fewer places where something can go wrong.
Keeping the most sensitive operations offline, inside hardware built for that single purpose, removes entire categories of remote attack. An attacker who cannot reach a signing device over a network cannot exploit it from a distance, regardless of how sophisticated their tools may be.
Back's position runs against a broad trend in digital asset security toward increasingly elaborate software stacks. His view is that complexity itself is a risk, and that institutions holding large amounts of Bitcoin are better served by systems whose security properties are easy to understand and verify.
7. AI-Assisted Attacks Raise the Stakes
The timing of the launch is tied to rising concern about cyberattacks that use artificial intelligence against large Bitcoin holders. AI tools can help attackers identify vulnerabilities faster, scan large amounts of code for weaknesses at scale and craft more convincing phishing messages aimed at employees.
Each of these capabilities makes software-heavy security harder to defend. A complex custody setup with many interacting components offers more code for an AI-assisted attacker to examine and more opportunities to find a small implementation mistake that a human reviewer might miss.
Hardware isolation changes that equation. A phishing email, no matter how persuasive, cannot extract a key from a device that never exposes it. By keeping the signing process sealed inside dedicated modules, Blockstream is betting that the physical boundary will hold even as the tools available to attackers become more capable.
For institutions, the appeal is that the strength of the core protection does not depend on every employee recognizing every scam, or on every line of software being free of bugs. The most valuable secret stays in a place that remote attackers cannot reach.
8. What Institutions Need From Bitcoin Custody
For banks, brokers and other regulated firms, custody decisions are driven more by operational risk than by the price of Bitcoin. These institutions must be able to demonstrate to regulators and auditors exactly how client assets are protected, who can authorize a transfer and what safeguards prevent unauthorized movement of funds.
A design in which keys remain inside certified hardware gives institutions a clear, explainable answer to those questions. Instead of describing a sprawling software architecture, a compliance team can point to a defined hardware boundary and a signing process that requires cooperation among multiple parties.
That clarity can matter as much as the underlying technology. Institutions that have hesitated to hold Bitcoin directly because of security concerns may find a custody model built on familiar hardware security practices easier to approve internally.
Blockstream presents the launch as part of an effort to win the confidence of institutional investors who may have held back over security worries. Whether the product attracts significant client adoption will depend on how institutions assess it against established custody providers.
9. Custody and Tokenization Under One Provider
The custody system also fits into Blockstream's broader enterprise strategy. The company's custody and tokenization stack is already available to select private clients in beta, and pairing secure custody with asset issuance tools allows a single provider to cover both the safekeeping of Bitcoin and the creation of tokenized assets.
For institutions exploring tokenization, working with one provider for both functions can simplify integration and reduce the number of counterparties involved. The Liquid Network's asset issuance capabilities give Blockstream an existing platform on which tokenized products can be built.
This combination positions Blockstream as an infrastructure supplier aiming to serve institutions across several needs, rather than as a single-product custody vendor.
10. What Comes Next for Blockstream Custody
With the architecture now presented publicly at the Digital Assets Forum in New York, the next test is adoption. Blockstream's enterprise custody and tokenization services remain in beta with select private clients, and the move toward broader availability will show how much institutional demand exists for a hardware-anchored, multi-party signing model.
The launch also places Back's security philosophy in front of a large institutional audience. If firms embrace the idea that simpler, offline systems offer stronger protection against increasingly capable attackers, the approach could influence how other custody providers design their own products.
Institutions weighing the product will likely focus on how it fits into their existing approval processes, how the multi-party signing shares are distributed among staff or departments, and how the Thales hardware is deployed and maintained. Those practical questions, rather than the underlying cryptography alone, typically determine whether a custody system moves from a pilot to full production use inside a regulated firm.
For now, the Blockstream and Thales system offers institutions a clear proposition: shared control over Bitcoin through multi-party computation, with every step of the signing process kept inside dedicated hardware that remote attackers cannot reach.