Adam Back's 1997 Idea Just Became a Product: Blockstream and Thales Take Bitcoin Keys Offline

Blockstream has built a Bitcoin custody system with Thales, the French defense and aerospace contractor, and the entire design rests on a stubbornly unfashionable idea: the signing key should never be reachable over a wire.

Adam Back, Blockstream's co-founder and CEO, has been arguing this for years. The new system puts transaction signing on dedicated hardware, physically separated from any network, and treats the cloud-dashboard model as a liability rather than a feature. Anyone who's watched a custodian lose customer coins to a compromised laptop knows he's not wrong.

The long road to offline signing

Start in 1997. Back publishes Hashcash, a proof-of-work anti-spam scheme that later becomes one of the intellectual load-bearing walls under Bitcoin. The core insight, that computation should cost something, shows up again in Satoshi's 2008 white paper, which cites Back's work directly.

Then a long gap. Back spends the 2000s in applied cryptography, and in 2014 he co-founds Blockstream with Greg Maxwell, Pieter Wuille and a handful of other Bitcoin Core contributors. The company raises a Series A, then a $210 million Series B in 2021 at a $3.2 billion valuation, with backing from Baillie Gifford and iFinex among others. That capital funded sidechains, mining, satellite broadcasts, and the Jade hardware wallet, which Blockstream announced in 2021 as a cheap, open-source signing device.

Every one of those products points the same direction. Back doesn't want your keys on a server. He wants them on a thing you can hold, unplug, and destroy with a hammer if the situation calls for it.

The Thales partnership is that thesis graduating from consumer gadget to institutional product. Thales isn't a crypto startup. It's a company of roughly 80,000 employees that sells to governments and banks, and it has spent decades building hardware security modules that survive audits, temperature extremes, and people with soldering irons. Pairing Bitcoin-native custody software with defense-grade silicon is a different sales motion than shipping a $79 pocket device.

Here's what matters: the signing ceremony is where the risk lives, and Blockstream is now selling that as a physical appliance rather than a promise.

Who actually pays for this

Think about who holds large Bitcoin positions and can't afford a single point of failure. Public companies carrying Bitcoin on their balance sheets. Miners sitting on treasury reserves. Family offices that bought in 2020 and now have a nine-figure exposure they don't want on an exchange. Fund administrators who need to prove to an auditor that no single employee could move the coins alone.

For that crowd, the pitch is straightforward. Cloud key management means your security posture is only as good as someone else's patch cycle. Multi-party computation spreads risk across machines that are still, at bottom, online. An air-gapped signer with a hardware root of trust removes an entire class of attack: the one where malware quietly swaps a destination address in the signing request.

The numbers tell the story on why this sells. Almost no major Bitcoin loss in the past decade came from breaking elliptic curve cryptography. They came from stolen keys, social engineering, insider jobs, and signing requests that nobody fully read. Offline hardware doesn't fix all of that. It does shrink the surface where most of it happens.

From a risk perspective, the losers here are the custody pitches that lean on convenience. Any provider whose value proposition is a clean web interface and an insurance policy now has to explain why the key material lives somewhere it can be reached. That's an uncomfortable question in a sales meeting with a CFO who just read about a nine-figure breach.

And yes, this reprices pure-software MPC vendors too. Not because MPC is broken, it isn't, but because the marketing differentiator shifts from math to physics. Buyers like physics. You can hold it.

My first hot take: this is the right architecture aimed at the wrong bottleneck. The dominant failure mode in institutional custody isn't a hacked signing key, it's a human being with legitimate credentials doing something stupid or crooked. Hardware doesn't stop that. It just makes the stupid thing harder to hide afterward.

My second: the real winner isn't Blockstream. It's the broader idea that Bitcoin custody should look like payments infrastructure, meaning certified hardware, documented ceremonies, and auditors who know what a quorum is. Defense contractors entering this market gives the whole category a credibility it couldn't manufacture on its own.

So who's the buyer, exactly? A treasurer who has to explain key management to a board, or a fund that needs the story to survive a diligence call? Probably both. And that's why this product exists.

What comes next

Watch three things over the next twelve months.

First, attestation. Hardware means nothing without documentation. If Blockstream and Thales publish certification details, firmware verification paths, and a public key ceremony process, this becomes a real institutional product. If the security claims stay at the level of a marketing page, the thesis stalls.

Second, insurance. Underwriters price custody based on measurable controls. Once a hardware signing appliance has a track record and a certification label, premiums for self-custody operations should compress. That's the moment the economics flip, because insurance is the line item that quietly decides which custody model wins.

Third, regulation. The EU's Digital Operational Resilience Act applies from January 17, 2025, and it puts hard requirements on how financial entities manage third-party technology risk, including key management. Vendors that can point at a certified hardware boundary will have an easier conversation than vendors pointing at a service level agreement.

The blunt version: Bitcoin custody has spent a decade arguing about who to trust. Back's answer is to trust less, and to make the thing you trust a piece of silicon with no network cable. That's a thesis with real conviction behind it, and it's finally packaged for the buyers who actually hold the coins.

Whether the market pays for it's a different question. Convenience has beaten security in every technology market I've covered, right up until the first disaster. Then it flips, fast, and the vendors with certified hardware are the ones still standing when the phone rings.