Hong Kong-based Virtual Asset Trading Platform (VTAP) HKVAX has selected Thales Luna Hardware Security Modules (HSMs) to strengthen the security and compliance of its digital asset custody infrastructure.
Operating under the Securities and Futures Commission’s rigorous regulatory framework, HKVAX required a cryptographic foundation capable of addressing evolving cyber risks to private keys, smart contracts, and custodial systems. The company selected Thales Luna HSMs based on their FIPS 140-3 Level 3 validation and ability to support regulatory-grade deployments across its multi-tier wallet architecture.
“Thales Luna HSMs stood out because it is among the first vendors to achieve FIPS 140-3 Level 3 validation, with a strong track record in securing critical systems for financial institutions and governments,” said Jack Zhou, CIO at HKVAX. “Using Thales Luna HSM gives both us and our clients confidence in the security of our platform.”
HKVAX integrated Luna HSMs across its custody environment to support key generation, storage, and transaction signing, alongside its multi-tier wallet architecture, including hot and cold wallet separation and role-based access controls.
Key outcomes from the deployment included:
- Hardware-backed key protection: Centralised private key generation, storage, and transaction signing within FIPS 140-3 Level 3 validated hardware, isolating cryptographic keys from software environments and privileged access.
- Regulatory compliance and auditability: Successfully passed independent security audits, with automated key management processes and hardware-backed audit evidence meeting SFC regulatory expectations.
- Operational resilience: Strengthened custody architecture through cold and hot wallet separation, role-based access controls, disaster-recovery protocols, and reduced manual intervention across key management workflows.
- Customer and partner confidence: Increased trust in the security of HKVAX’s platform, supporting the company’s growth as a regulated digital asset provider in Hong Kong.
“As a licensed VATP in Hong Kong, safeguarding client assets is our top priority. Using Thales Luna HSM gives both us and our clients strong confidence in the security of our platform,” said Zhou.
Looking ahead, HKVAX is preparing for emerging cybersecurity challenges including AI-driven threats and post-quantum cryptography (PQC) readiness.