Blockstream Enterprise: Bitcoin Custody Infrastructure

The Stakes

Custody Sets the Ceiling on Every Digital Asset Strategy

Three failure modes account for nearly every operational custody loss in financial institutions handling Bitcoin. Each carries a different recovery profile. None are theoretical.

Custody Risk Surface

3 Failure Modes · Severity Indexed

Failure 01 · Key Compromise

Keys outside hardware become theft surface.

Every operational touch point on a key not in isolated hardware is an opportunity for compromise: insider risk, malware, social engineering, weak signing flows.

Severe

Recovery impossible after broadcast

Failure 02 · Operational Error

One person should not move funds alone.

Manual workflows let a single user draft, approve, and sign without enforced separation. A misclick, a wrong recipient, or an internal actor can move funds without a second pair of eyes.

High

Audit fails to catch what it never enforced

Failure 03 · Compliance Gap

Policy outside the platform is policy nobody enforces.

Approval rules tracked in spreadsheets, ticketing tools, or email threads cannot block a non-compliant transaction. Compliance becomes audit-after-the-fact rather than enforcement-before-broadcast.

Elevated

Findings surface months after the gap

Today's Trade-Offs

Legacy Custody Forces Trade-Offs Between Speed, Control, and Compliance

Operational patterns that earned approval in traditional finance break somewhere on a modern digital asset desk.

Fragile Key Management

Keys handled outside hardware isolation create single points of failure. One operational error can move funds the firm cannot recover.

Fragmented Tooling

Custody, treasury, and payments in separate systems mean manual reconciliation, mismatched audit trails, and gaps where errors slip through.

Stalled Approvals

Unclear role ownership lets approvals queue, sit, and re-route. Capital sits idle while sign-offs chase down the right desk.

Multi-Week Compliance Loops

Every change drags through review committees. Speed and compliance pull in opposite directions instead of moving together.

The Platform

One Custody Platform, Built for How Institutions Operate

Secure storage, multi-party governance, and fast settlement in a single custody platform, with separation of duties and a cryptographic audit trail enforced end to end.

Custody & Treasury

Segregated Accounts protected by isolated hardware. Spend Policies route every transaction through Drafter, Approver, and Authorizer roles. Cryptographic audit trail covers every action.

Governance & Compliance

Spend Policies enforce approval rules before a transaction broadcasts. Multi-party review, role-based access, and Workspace Updates put compliance inside the platform instead of in spreadsheets.

Settlement on Bitcoin's Financial Layer

Settle custodied assets in about two minutes on the Liquid Network. Confidential Transactions hide amounts from blockchain observers while preserving selective disclosure for regulators and auditors.

Security Architecture

Multi-Party Authorization, Hardware-Isolated Keys

No transaction signs from a single device, a single team, or a single signer. The architecture starts with the assumption that any one component will eventually fail, and is designed to survive that failure.

Multi-key architecture with isolated hardware modules. No single device or signer can move funds alone.
Distributed signers across devices and teams. No user controls the full signing authority.
Spend Policies encode who can do what, when, in machine-enforceable rules.
Drafter, Approver, and Authorizer roles separate transaction initiation, review, and signing.
Optional hardware-backed signing keeps the final signature in the firm's hands.

Drafter

Creates transaction

Step 1

Approver

Reviews policy

Step 2

Authorizer

Signs on hardware

Step 3

Multi-Sig

0 / 3

Compliance Ready

Policies That Match How Firms Already Approve

Every transaction evaluates against firm-defined Spend Policies before it leaves the wallet. Each policy resolves to one of three outcomes: automatically allow, automatically deny, or require multi-party review.

Transaction

2.4 BTC → External Recipient

Allow

Within limit, on whitelist

Review

Multi-party approval required

Deny

Recipient not approved

Policy Engine Detail

Three outcomes per policy: allow, deny, or require review.
Multi-party review supports group composition like "1 of security AND 1 of compliance."
Priority order evaluation: first matching policy decides the outcome.
Configurable limits: none, single transaction, or time-period-based.

Operations

Built for the Firms That Run Capital Markets

The same custody platform serves four distinct operational models, each with role configurations matched to how a firm already works.

Secure Treasury Operations

Custody Built for High-Velocity Flows

Trading desks operate on volumes and approvals that legacy custody was never designed to handle. Spend Policies and Drafter / Approver / Authorizer separation match how trading actually moves.

Segregated Accounts

Isolate hot, warm, and cold tiers with policy enforcement at each level.

Bulk Approvals

Process batched transactions through one approval workflow without sacrificing audit trail granularity.

API Integration

REST APIs and FIX connectivity bridge to existing trading and risk systems.

Balance Sheet Custody

Audit-Grade Reporting for Bitcoin Holdings

Capital markets desks holding Bitcoin on the balance sheet need verifiable proof of reserves and real-time visibility for finance, risk, and compliance.

On-Chain Reserves

Cryptographically verifiable proof of holdings, accessible to auditors directly.

Real-Time Visibility

Treasury and finance see every movement as it happens. No end-of-day reconciliation lag.

Audit Export

Built-in audit log export covers every action, signer, and policy decision.

Governed Multi-Party Control

Client Account Isolation with Policy-Enforced Workflows

Asset managers running Bitcoin or tokenized strategies need account isolation by client, governance that holds across LP changes, and recipient controls that match mandate restrictions.

Per-Client Accounts

Segregate funds by client, strategy, or mandate with role scoping at each level.

Recipients & Lists

Approved transfer destinations enforce mandate restrictions in machine-readable form.

Role Inheritance

Workspace-level roles flow down to account scope, simplifying permission management at scale.

Embedded Custody Layer

Custody Infrastructure for Client-Facing Services

Qualified custodians need a custody layer that integrates with existing client-facing systems while preserving regulatory and operational separation.

SDK Integration

Embed custody flows directly into existing client portals and operational tooling.

RBAC Granularity

Seven predefined roles across workspace and account scopes match regulated operating models.

Cryptographic Audit

Every action traceable to a user, role, and policy. Built-in audit export for regulatory review.

Settlement

Settle on a Bitcoin-Pegged Chain Built to Spec

Custodied assets still have to move, and how fast they settle determines counterparty risk. Settlement runs on Elements, the open-source platform behind the Liquid Network, so a firm can run a dedicated chain or settle on Liquid today.

Elements: A Dedicated Settlement Chain

Elements is open-source and fully modular. A firm can run a dedicated chain pegged to Bitcoin, with configurable block times, assets, and federation governance. With block times tuned for speed, a dedicated chain can reach final settlement in as little as ~5 seconds, far faster than a shared network.

Modular

Configure block time, assets, and governance per deployment

Bitcoin-Pegged

Assets move between Bitcoin and the chain via a federated peg

Liquid: The Production Network

For firms that would rather not run a dedicated chain, Liquid is the production Elements network and secures more than $5B in value. Deterministic finality means no multi-block reorganizations, so transactions can be accepted with zero confirmations and reach final settlement in about two minutes.

T+1 Rails

~24 hours

Liquid

~2 minutes

Zero-Conf

Deterministic finality supports zero-confirmation acceptance

Confidential

Confidential Transactions hide amounts; selective disclosure for auditors

Deploy Without Disruption

One Stack. Plugged Into Existing Systems

REST APIs, SDKs, and FIX protocol connectivity bridge enterprise custody into the trading, treasury, and reporting systems a firm already runs.

Existing Firm Systems

TMS

OMS

Risk Engine

FIX Gateway

Reporting

Blockstream Enterprise API Surface

REST API

SDKs

FIX Protocol

Webhooks

Live

Enterprise Stack

Custody

Treasury

Governance

Settlement

Built by Blockstream

Twelve Years of Bitcoin Engineering Leadership

Blockstream has run Bitcoin infrastructure since 2014 and secured the Liquid Network since 2018. The same engineering team behind Liquid, Core Lightning, and Simplicity built the custody platform.

A top-three contributor to the Bitcoin codebase

Built the first Bitcoin layer-2 settlement network for capital markets

Author of one of the first Lightning implementations, Core Lightning

0 yrs

Bitcoin Infrastructure

Operating Bitcoin and Liquid infrastructure since 2014.

$0B+

Value Secured

Total value secured on the Liquid Network.

0%

Liquid Uptime

Continuous Liquid Network uptime since 2021.

Cryptographic Audit

Every Action

Every transaction, signer, and approval verifiable on chain.

Get In Touch

Build Your Financial Infrastructure on Bitcoin

Talk to the enterprise team about custody, treasury, governance, and settlement. Conversations start with a scoping call to map operational requirements to the platform.

Architecture review and security walkthrough
Compliance and audit pattern review
Integration planning for existing trading and TMS systems
Pricing and deployment timeline