Blockstream has launched an enterprise digital-asset custody system developed with Thales, moving the distributed transaction-signing process inside dedicated hardware security modules. Announced on November 13, the design combines Blockstream's Secure Multi-Party Computation architecture with Thales hardware intended to isolate sensitive cryptographic operations from general-purpose computing environments. The product is aimed at financial institutions and other organizations that want to operate custody infrastructure while retaining control over keys and approval policies.

Signing stays inside the hardware boundary

Multi-party computation, or MPC, divides signing authority among multiple participants so that no single share can authorize a transaction alone. Blockstream says its implementation executes the signing protocol entirely within the secure environment of the hardware security module, including the point when a transaction is signed. That is the main change presented in the launch: the company is applying distributed authorization while keeping key shares and sensitive calculations behind a dedicated hardware boundary rather than exposing them to an ordinary application server.

Related reporting: Liquid Restores Full Bitcoin Backing After September Exploit

The system also incorporates FROST, short for Flexible Round-Optimized Schnorr Threshold signatures. The protocol allows a threshold of participants to cooperate in producing one signature without reconstructing the underlying private key. RFC 9591 describes FROST as a two-round threshold-signing protocol designed to distribute trust and provide redundancy. The published specification is informational research output, not proof that Blockstream's particular deployment has been independently validated.

Built for institutional operating models

The new custody offering runs through Blockstream Enterprise. The company's product materials describe managed, dedicated and on-premises deployments, alongside role-based access controls, spending policies, approval quorums and segregated accounts. Blockstream says institutions can begin with a managed service and later move to their own hardware while keeping the same policy framework and audit trail. Its November 13 release said the Thales relationship has been under development for two years.

Independent reporting by Cointelegraph confirmed the launch and the central technical claim that the signing protocol runs inside Thales HSMs. The report placed the product within a wider argument from Blockstream co-founder Adam Back for simpler, more isolated security systems as cyberattacks become more sophisticated. Hardware isolation can reduce one category of exposure, but it does not by itself prevent an authorized insider, a compromised approval workflow or a flawed recovery process from moving assets.

Important details remain undisclosed

Blockstream's announcement does not name a customer, publish pricing, identify the specific Thales HSM model or cite an independent audit of the complete configuration. It also does not specify the signing threshold used in a typical deployment. Those omissions do not contradict the architecture claim, but they limit how far institutions can assess operational resilience, certification status and recovery procedures from the public materials alone. Buyers would still need configuration-specific evidence and testing.

What to watch next

The next meaningful signals will be named deployments, implementation-level certification details and evidence showing how the platform handles hardware failure, lost key shares and changes to an approval quorum. Institutional adoption will also depend on whether auditors and regulators accept the control model for the intended jurisdiction and asset mix. For now, the launch expands the custody choices available to firms that prefer to operate their own infrastructure rather than delegate all key control to a third-party custodian.

Sources

AI-generated editorial image; not a photograph of the reported event. Prepared with AI assistance and source verification.