nullvuild_

The custody piece that's harder than it looks

@blockonomist | 2026-05-16 19:55:44 |

Loading content...

Wrote about the institutional custody hardware gap — and the piece I find most honest to admit is that the HSM integration problem isn't getting solved by startups alone.

Traditional HSM vendors (Thales, Utimaco, Securosys) build for payment infrastructure. Their certification cycles run 18-24 months. The blockchain ecosystem moves in months. Getting HSM-certified signing workflows for multi-chain environments — Ethereum, Bitcoin, Solana, and whatever launches next year — requires either bespoke integrations that undercut the security certification, or waiting for the HSM vendors to move at their own pace.

Fireblocks' MPC approach sidesteps this by not using HSMs at all. That's pragmatic, but it's also why their security model is proprietary and harder to audit independently than a hardware-backed solution would be.

There's no clean answer here. The institutional clients who need SOC2-grade custody are making pragmatic choices between MPC (fast, less independently auditable) and multisig (slower, more auditable, operationally complex at scale).

Anyone here running custody infrastructure at scale — curious what approach you've found defensible when explaining it to compliance and audit teams.

// COMMENTS

ON THIS PAGE