Name: Thales x Fireblocks: Enterprise Security for Digital Asset Operations
Uploaded: 2026-03-03T04:01:05.650Z
Duration: 52 min 4 s
Description: Thales x Fireblocks: Enterprise Security for Digital Asset Operations

Transcript for "Thales x Fireblocks: Enterprise Security for Digital Asset Operations": Okay. Good morning, good afternoon, good evening, folks. We will get started in just a few seconds. We just wanna let some folks have a chance to to come on in, and then we'll go ahead and, and get started. So just bear with us for a, for a few seconds here. So I see a whole bunch of people coming in, which is fantastic. All right. I think we can go ahead. So look, good morning, good afternoon, good evening, everybody. My name is Chris Jamieson, Senior Director of Global Programs here at Fireblocks. Thank you so much for taking the time to for your, you know, your morning, afternoon, or evening, with us here today. I'm gonna kick, everything over to to Ben and to Ray in just a second to go through, you I think some pretty amazing content around how Talos and Fireblocks work together. But before that happens, I did wanna just do a little bit of housekeeping. So number one, there is a chat and q and a function, that you can access on the side. Feel free to drop any questions that you might have, throughout the presentation. In there, we will try to get back. We'll try to address as many of them as we can. And for any that we don't, we'll definitely make sure that we follow-up with you afterwards. The second thing is that this will be recorded. So, for any, friends, colleagues, etcetera, that might not be able to make it, or anyone else that might wanna watch it on demand, this will be available, and you will get a recording, basically, right after this is, wrapped up. And then I think the third thing is that there is, like, a short survey at the end. Please, like, let us know if you have found the content helpful. And there's also the ability for you to ask for more information around, Fireblocks and TALICE together. And we'd obviously love to to kinda further the further and continue the conversation. So, with that, Ben, Ray, I'm gonna turn it over to you all. And look really looking forward to the content. So thank you very much. Excellent. Thank you very much, Chris. And welcome, everyone. Really great to see everyone joining today. I appreciate your time. We're gonna run through a few different things today around the Fireblocks Intellis partnership and really sort of cast a little bit of a spotlight into what does good secure digital asset management look like. Firstly, what I'd love to do is introduce ourselves. My name is Ben Wilkner. I'm the director of sales engineering for Fireblocks and APAC. I've spent the last ten years in financial technology supporting, you know, financial institutions and new entrants to the market and to building new technologies. So prior to Fireblocks, which I've been with for four years, I worked for a company, Symphony Communication, building really sort of communication infrastructure for some of the largest banks in the world. Really happy to be with Fireblocks and see the emergence of new technologies being now adopted by banks, especially in the area of digital assets. Right. Over to you. Hi. This is here, and I'm from as senior security solution architect. And for me, myself, I'm focused on the data security side from and mainly on the and especially from the brochure and also web fee business across my region. And I will also support some cases in APAC. So if you got any questions, feel free to ask after our session. And in my session, I will share a bit about how Tiles HSM can help in this business and how we work with Fireboss. Thank you. Thank you very much, Ray. So today in the agenda, we're going to give you a little bit of an insight into the Firebox and Telus partnership and what it really sort of means for our customers and what is coming out of it. We'll dig a little bit deeper into what is the Firebox digital asset platform, how it works, and how the partnership with TELUS HSMs comes into light. Then we'll move over to Ray for giving a little bit more of an insight of TELUS' approach on securing the foundation of trust with digital assets. We'll then go through with a platform demo, and then we'll have some time at the end of the section for some q and a. So I'd really encourage if you do have any questions, please use the q and a function. Get your questions in early, and then Chris will help to moderate that at the end of the session. Firstly, what I wanted to cover is what is the Fireblocks Intellis partnership and and what it is that it brings to our customers. So Fireblocks, we've been in the digital assets market for around about eight years now and servicing over two and a half thousand institutions. What we've seen is other independent institutions are coming into this space. They're looking for a different level of regulatory control over their assets. And often with banks and these large financial institutions, the usage of HSM has been common across this segment of the market for any control of private keys. So what the partnership between Fireblocks and TELUS provides is a level of key ownership and regulatory grade control that is unmatched. And it's recognized by custodians and auditors globally and leveraging the best in class infrastructure that we've known today, and this is the reason that we picked TELUS. TELUS is deployed amongst, I would say, more than 80% of the world's largest financial institutions. So really, it is the de facto standard from our perspective. We see TELUS delivering the best in class HSM security alongside Fireblocks, providing the best in class governance and approvals flows and wallet management for digital assets. So this combination exceeds the custody models expectations from regulators and audience, and that we believe that it has the strongest security profile that is available today. A really great thing about what we're doing and the way that we've built our product is that it's allowing you to integrate with your existing custody infrastructure. So number of banks, global institutions are running TELUS hardware today. It actually allows for five to be an additional component that can be bought into that infrastructure without having to rearchitect or migrate away from the existing systems. So keeping the original basis of trust within your organization and adding new capabilities on top. The next is around scalability. Building wallet infrastructure is not easy, and Fireblocks being a very mature product in this market allows for institutions to then implement custody capabilities and implement digital asset management capabilities and then scale that, like, allowing for very high throughput and a greater variety of digital asset capabilities for their business. Lastly is around the ecosystem. So Firefox today supports over two and a half thousand financial markets participants, and our network is allowing you to use the Firebox platform to connect to all of the different payment rails, liquidity venues, and counterparties, ensuring that your business is not only capable to operate within its own walls, but able to interoperate with a broader market as well, all being secured by the TELUS hardware. So introducing what is what is Fireblocks and what is the digital assets platform that we provide. So on the left hand side here, I wanna talk about the scale of Firebox today. So Firebox currently supports over 10,000,000,000,000 transactions secured across the platform. And this is so 10,000,000,000,000 US dollars worth of assets over the platform and over 550,000,000 wallets in our ecosystem. This has allowed for our customers to custody today over $100,000,000,000 worth of assets in AUC across two and a half thousand institutional customers. And these customers that are leveraging our platform are quite wide. They exist from firms like Visa, providing payments infrastructure, ANZ Bank, who is a traditional bank in Australia, BNY Mellon, the world's largest custodian bank, through various other brands here. And this this is really sort of where Fireblocks covers three independent market verticals. One being payments, so enabling the movement of funds in between payment service providers on and off ramps. We have crypto exchanges. So the retail side of crypto, has existed for quite a number of years now, the most prominent provider in that space. And then what we're seeing emerging, especially since the passing of the Genius Act last year, is the inclusion of many large banks. So Fireblocks today supports over 90 banks, and that number is continuously growing as we're seeing that increased interest. And what are those services that we're actually providing these companies is really sort of around four main constructs. Firstly, wallets as a service, excuse me, that is allowing our customers to host wallets and have their own custody. So they are able to manage those assets themselves using their own private keys and effectively able to move and service those assets. Another area is treasury management, enabling businesses that would not usually deal with digital assets to hold, manage, and move them. Excuse me. And two other areas which is really sort of growing in the market is tokenization. So allowing for businesses to build their own tokens in different markets. So example is a bank may want to issue their own stablecoin that would leverage the Firebox tokenization engine and standardize contract management, enable to to build those tokens, deploy them out to their network. Lastly is the payments engine. So this is a sophisticated workflow capability that binds the wallet as a service capabilities and Fireblocks liquidity partners to allow for institutions to move assets across the market in a sophisticated and automated fashion. Meaning that a customer could, for example, take on ramping of Vietnamese DONG, move that into a stablecoin, move that across boundaries to maybe The Philippines, offering that into Philippine pesos, or using digital assets as a rail. So this is revolutionary, providing a much faster settlement cycle for institutions as well. So how do we do it? So Fireblocks has produced a number of different services that we host mostly as SaaS. So this is across Amazon Web Services and using Microsoft Azure's confidential computing to effectively create a wallets platform managing digital assets with a few fundamental components. One appears a transaction authorization policy. This is allowing for a very high level of governance ensuring that every single transaction is approved by a specific quorum before the assets can actually move. This is really important as part of a governance and a make a checker flow that every institution should have in place today. We have hardware secured whitelisting, ensuring that any asset movements that are going to external addresses are first approved by a quorum before a transaction can even be initiated. We've got a Fireblocks platform APIs, which is allowing for institutions to build on Fireblocks as a platform. So Fireblocks has a capability of having a console operation, which we'll demo today. But effectively, every single component of Fireblocks is API ready. So Fireblocks often is forming the backbone of the digital asset infrastructure that you may be using today. We have third party compliance integrations. So you're sort of NodeBNA, Elliptic. These these governance third party governance components, which are really, really important to ensure that you remain compliant with FATF and OFAC guidelines. Third party staking and providers, this is allowing for liquidity avenues, exchange integrations allowing for on and off ramps, transaction automation as part of the payments flow. But a really important part that Fireblocks does best is the blockchain nodes and indexing serialization services. Fireblocks connects you to over a 130 public and limitless private blockchains, all part of the Fireblocks platform, ensuring that your business can leverage these services and grow at scale while we do focus on the important bits, which is key security. On the right hand side here, we have Fireblocks hot and cold NPC services, which we're very well known for. But increasingly so, it is the Firebox key link, which incorporates hot and cold TELUS HSMs into the flow. And this is gonna be the focus of what we're talking about today, really how this new capability incorporating TELUS HSMs, FIP certified compliant key management into the Fireblocks infrastructure. So what is Fireblocks Keylink Flow? So this is a specific product that Fireblocks has built to enable end to end HSM powered digital asset infrastructure, ensuring that you can store and manage your private keys for all of your digital asset wallets within a TELUS HSN. Importantly, this allows banks and financial institutions to integrate into their existing key management systems, Changing away from traditionally approved systems and moving on to a new brand is very, very hard. I think this is one of the strongest things that it's it's keeping institutions who are using h m HSMs and especially TELUS HSMs in their comfort zone and allowing them to extend that existing platform. It also provides a rich governance and approval flow, layered with FIPS compliant hardware security, which we'll go through. It also addresses the slow and often noncompliant nature of existing cold storage environments. Cold storage signing, there's a lot of home built solutions. This creates a standardization with verified security controls and zero trust around that. And this is built for scalability. So trying to build an in house system or or binding a few different systems together is very hard. What we've done is we've built this for the businesses who are gonna be dealing with billions of dollars of payments and and assets rather than just independent sort of transactions themselves. So how does this look? There is two different temperatures of the KeyLink flow system. One is being online or hot, so hot wallets, and the other one is cold and offline. So in this particular case here, the infrastructure works that we have the Fireblock SaaS services, which are located in the cloud. And then there is a capability called Keylink agent in the Fireblocks Keylink online server that exists within a customer's production environment. How this actually works is a transaction is created within Fireblocks. It goes through the approvals flow on the SaaS side, binding against all the different policies, trouble rule compliance, etcetera. Once it passes all these approvals and is ready to go, a unsigned transaction is then shipped across to the Fireblocks KeyLink agent. This will actually do a long poll and consume that unsigned transaction into the KeyLink flow online server. This is where an administrator can do a last maker checker before pushing that unsigned transaction through the TELUS learner client to the HSM for signing. That signed transaction will then be verified and flow back to Fireblocks. We'll have a last mile check against the public key. And then once confirmed, it'd be broadcast on chain. Very simple architecture and very, very easy to set up. For cold signing, this is slightly different where there is actually a both a hot and a cold side of this Keylink flow. It operates in the same manner that KeyLink agent will pull down any unsigned approved transactions, but then it's going to transmit from the online portion to the offline portion via data diode systems or, if preferred, USB keys. This provides an air gap between these two different systems, ensuring that the TELUS HSM can remain offline at all times and all signing operations are happening in an offline air gap manner. Once a transaction is signed, it follows a reverse path via data diodes or USB back to the Keylink Flow online server where it'll be verified and then sent back to Fireblocks for sign for distribution on chain. So with that, I'm gonna hand over to Ray for a little bit of an introduction about the TELUS HSM systems. Ray, over to you, Thank. you, Ben. Okay. Hello, everyone. Good morning, good afternoon, good evening, no matter where you are. This is Ray Law, and I'm a senior security architecture from Thales. And thank you for joining today alongside with our partner, Firefox. While Firefox just shared that they are digital access platform and how HSM is critical for the infrastructure custodian to protect the keys, In the next fifteen minutes, we are quite straightforward to share why Tilex HSM is the best option that's in the market that's to help to provide the keys management solution for brochure and also graphy infrastructure. Okay. So let us start with why we all there. So, of course, in the EPAN, the regulators have made HSM mandatory for digital access custodian. So not recommended, but it's mandatory. So in Hong Kong, there's guideline is quite strict for that. There are the SFC required the 98% of the client virtual access must be in cold storage that are protected by the HSM. So this is not a guideline, but this is a license requirement for those VATP operators that if they want to hold the license, they need to fulfill such requirement. And also as well as the hot wallet, like master private key and also the c as well as its backup, it also required that to use the HSM as the profile for the key management. But not just the VATP operators in Hong Kong. We also got the Stablecoin regulations for the Stablecoin framework. We also reinforced the with the similar hardware security meditaries. In Singapore, we follow a similar path for the payment service edge. So also required to have protection for the graphic case for custodian model. In South Korea and Taiwan, the regulators is already have qualified HSM requirement into their national standard to in order for the operators and also the payer market payers to use HSM. And in Japan, it's quite a new market to us. So although the regulators doesn't have strict requirement for that, but due to the traditional financial market and also some regulators throughout in the region, the market pushing forward to use the HSM to store the encryption key. The message is quite quite clear for that. So software only security is no longer acceptable by most of the regulators in APAC regions. So if you are building industrial grade digital access infrastructure in your region, Certified HSM is a table stakes. Okay. So not all the HSM grade that equal, especially for blockchain. So here are four nonnegotiable criteria that you may evaluate for you to choose a right HSM for rapid business. So the first thing is about the certificate. The fifth one four c o dash three level free certificate, full license HSM. Notice that I set full certificate, not a migration or upgrade path. HSM was the first well, first industrial HSM to receive full fixed one four zero dash free level fee validation. So we have hold that full license for five year. This matters during the audits. Regulators and auditors want to see a complete current certificate, not a promise or future compliance HSM. So this is quite critical for that. And the second thing is about the architecture design. So Lumen HSM offers key in hardware design. Our HSM guarantee that the private keys, whether the master key or the HD wallet seat, could never be extracted from the hardware boundary ever. Even in multitenant environment, our partition architecture provides hardware enforced cryptographic isolation. So this is the physical assurance that the software alone stack can provide. The first the third thing is broad blockchain support. We'll need to be support every major blockchain algorithms. For example, like SCCP two five six k one for BCON and Ethereum and Ethereum curve two five five one nine for Solana. So we also got a a full set of HD wallet standard including BIP 52 and also. Whether you are running valid data valid data notes, multistillatory custodian, or cross chain ratios, LUNA XSM can provide the cryptographic flexibility for you with today and also, like, in futures. Okay. So the final pillar is the local support and extended partner network. So you are not just buying a hardware boss for you to protect the key. You are entering a long term partnership with Thales and your platform. Thales can provide 24 plus times seven support from local no matter where you state and also from around the call Thales vendor support. So it's it's very important because for for those crypto infrastructure, we cannot accept a very long downtime due to some kind of failure or issues. So is the vendor that can provide run the call support from all over the world. If you got if you got any problems, our support team can have on this. And, also, we got local products in different regions. So we got service from them and also from our partnership network. So we got a very strong partnership network. No matter is for brochure and for other infrastructure including, which means that your HSM can integrate seamlessly into your existing digital access stack. Okay. So this diagram is treated while the HSM is the backbone of the entire digital access ecosystem. So you can see the actors like here, like issuer, treasuries, managing a stable call reserve. You got to surfing the platform and also the wallet. No matter the blockchain, like digital access or some kind of smart contract that you are doing, Lunar HSM is it sit in the center and serving these critical functions for the brushing that we are doing here by three major features that our HSM can provide. The first one that we have mentioned that is both have the key in hardware providing the physical route of trust for the software that's can't replicate. And the second thing is the control of the key access. We can enforcing who can use the key, when to use the key, and under what condition that's the hardware backed policy. So we got program. We got m of n. We got MFA for our HSM to make sure that only the right person can access to key from your application side. And the next thing is sign the transistor security. We can ensure that all the smart contract, all the blockchain transistor is cryptographically authorized that if in the trusted boundary, we can ensure that all the cryptographic operation would only happens inside the HSM chips. So this is quite different because we can see throughout in the past few months or past few years, there are so many virtual SS, Bluetooth in platform. By using the HSM, we can ensure that most secure thing, the private key, the network leave the HSM, and all the gridsomagnetic operation would happen inside the HSM. And not just about the compliance and also the HSM itself. I I understand that in the market, more and more traditional finance company are going into the virtual access and try to participate into it. When it comes to protecting the digital access, our trust is earned at the. We got so many trust from our the financial institution, traditional financial institution before. So the first point is proven compliance. We got a certificate. The fifth, we are the first mover advantage to build the customer confidence in the market. And the second thing is trusted by the global financial leaders. So the top banks, payment processor, payment vendors, payment network, telecom provider rely on HSN for the past few decades. As Ben mentioned that in very early about the partnership between Thales and also Fibrops, More than 80% of daily transaction actually is using Thales HSM to secure the transaction. So you can see actually Thales HSM is already the trusted platform, the trusted vendor that's in the market for for a very long time. And the next thing is about the market leadership. So tell us HSM no matter is for the payment HSM or for the general purpose HSM or for the current HSM. We got the largest market share. We got most of the integration if the platform to to to dominate the market. And this data ship is built on the back case of a continuous improvement and significant r and d investment and long term history with the partnership with the regulators and also from the largest enterprise worldwide. And the next thing is future ready security. So our HSM is already have a PQC HR built in. So no matter how the world's changed, now you are using the those traditional curve for blockchain or in the future, we got some new fork, new algorithms that we are used. The HSM that you are using right now is already future proof. We already got a quantum safe algorithms built in in our standard firmware. So which means that if you are saying that, okay. I want to test something very new. I want to test a PQC to integrate with IE blockchain. LUNA HSM is already supported. Okay. So the next thing is about the crypto crypto agility. While I we have mentioned that the HSM is already most of the blockchain algorithms like NECP and error curve and also NIST p two five six for the enterprise solution, but not just, like, the software providing the curve is about. All the algorithms is actually running, building, operating, calculating, doing the signature inside the HSM. But not just we are offering those curve and also those documents that we can use and all that. We have already got the sample code, and we also got some testing factors that are inside our SDK. So if you are saying, okay. So I'm using Firefox platform, and I want to test something by myself. You can download the Luna client. You got the Luna client access. You got the SDK. You can feel free to use your HSM to run the same Google to do the testing to make sure that everything that you want to do is in a secure way to do it. And the next thing is about the key ownership. Because some of our our customer that's using FibroS or other kind of blockchain infrastructure, they say, okay. I'm using a platform. Even though you are using HSM, I still have the concern on the key because the key is the most valuable access for the trade account for all the operators and all the platforms. So by using the HSM, how can we ensure that the key ownership is from the customer side? So first thing we mentioned many time is about the fifth certificate. So the certificate is is one of the very important criteria. For those cryptographic modules that's certified with fifth, we ensure that few things. First thing is about the healthiness of the key generation and also the key management. We ensure that the key generator is fully done by the random number generator. And the second thing is about the key ownership by the device that get the the they get the certificate, we ensure that the owner of the HSM can have full access for for the key, no matter what kind of platforms that you integrated with. And the second thing is keying hardware. We mentioned a couple of times. We ensure that all the keys would never lift the HSM boundary. And by utilizing the Firebros KeyLink platform, you can see I I I think we have a demo by Ben, and we'll illustrate that how the integration with Firebros and Talas. We can ensure that the key always rest descendants in the HSM and the KeyLink platform and also the Firebros platform will perform the of the with the to the access transition. All the transition will go to the HSM to the signing. We turn back to the platform and broadcast to the blockchain. All the things done in the, very secure, automated, and you got the best solution from the world. And the few last thing that I would like to mention is about the HSM that along with our and what we are doing. So we split that into hot water or some people say maybe warm water or online system. So the LUNA HSM will store the master private key and also the HD water seed while you're using the HD water system from your platforms. For example, if you are using some kind of HD water, echo from like the IP 52, you generate child wallet, child key from the HSM, and you are using the HSM to to to to do the transition. Every time when you are generating the the the I have a key for that. So you can utilize the the HSM every time to do that. And for cold wallet, it's much more simpler. CCs offer system. You can choose the HSM is kind of a key storage. Look. Every time when you need to do the transaction between the brochure and also the cohort, you must need to have some offline solution to transfer the transaction message generated from the online brochure system, and then you put it back to the HSM. And HSM will funnel the the the wallet private key and do the signing. Once the signing is finished up, and then the signed up message will transfer back to the online system for some air get that in offline channel and broadcast. So the thing is quite menu, but most of the customers are using this kind of architectures to do the signing transaction no matter is for the whole whatever for the for the for the for your for your customer or Google Wallet, for your platform, for your bank doing the same thing. Okay. So few last thing is about the tips for using the LUNA HSM for the operators. So the first thing that I would like to highlight is about the multi factor authentication. So for our HSM, we support physical object based MFA by using the PAC key and also in actually device security. So one of the critical action is, like, the backup restore and also the administrative change. It requires MFA enforcement. And for the high risk operator, we enforce the current policy. So we support m of n straight for the credential. For example, if you are going to using a crypto officer to to log in to the partition, we can support m of n, which means that we can set up, like, five total for the user. And every time when we log in, when we make the change, we require three of them. So we ensure that no single person can compromise your system. This is very, very important. And from the right side, we are talking about the backup and the install. We always use the fifth certified backup device, same level security along with the HSM and throughout the entire backup cycle. And, also, we followed four w rules, which means that what to backup all the partition and also the configurations, when to backup is scheduled monthly or eventually funds manually every time you make changes. Obviously, you need to do the backup. And who can do the backup? So only authorized person can do the backup with valid credentials and where to store the backup. So do the backup. We can do it on-site. We can have it off-site. Every time after we do the backup, we make sure that the backup, put it into a safe place. And one the most critical is a multi person program authorizer for all the backup operation, which means that no single person can do the backup. No single person can do the restore. Make sure that the backup HSM can only access that by the authorized person, and no one can get a brand new HSM and using your HSM can restore your IPhack to HSM which is not under your monitor. So multi person approval process is very, important in these cases. And last thing about the HSM architecture is about the multitenancy. So our HSM, we got a unique feature. It's called partitions. So by using the partition, we can treat the HSM. It's a logical separate HSM, virtual HSM inside the HSM. So by using the multi tenant additional feature, we can achieve something like this. We can have different wallet, different key into different partitions, which means that the enterprise and the service provider can leverage the same hardware for multi tenants and multi application without any risk and cross combinations. So by utilizing the same HSM, it's a cost saving design for that. For example, like here, you can see we can use the HSM with four partitions. Two of them is for the Bitcoin, one of them is for Effenium, and another one is for Solana. So each operates independently. For the HSM partition, we got a different kind of HSM user. For each partition, they will have a dedicated user for that. So for example, for the partition one, I got a security officer, crypto officer. If you set it properly, the same user is different from partition two and partition three. For each set of partition, which means that for each set each sets of wallet on run, we can have different sets of credential to use. By using this design, we enable true separation of duty critical for compliance while maintaining the operation efficiency across your entire digital access infrastructure. Okay. So let me close my session with three reason why Tiles is the right vendors for you to choose for your digital access security. The first thing is run the course 24 times seven support. Accessing experience and professional support across multi region and including the rights here in your region, and we have a compliance audit and also secure Internet. You got rapid expert support for your HSN. And the next thing is about the pilot network. So is for the local pilot and also the technology pilot. We got the strongest pilot network in the HSN business, so including. And, also, we got a professional service team, provide installation, expert developer support, any kind of customization. Our partners deliver a tailored solution and integration for you to for your HSM. So by using and make sure that your HSM and also the virtual access platform can go live seamlessly. And then one last thing is about the largest market share. So we have just applied most of the market participants. Is in APAC, in Hong Kong, in other regions, and worldwide. You can explore the reference use case at the highlight explicitly for for the deployment. And, also, we got a very good track record given the credibility from the regulators, from the auditor, and from the investor. When you choose with Fireboss, it's not just buying our technology. It's you are partnering with the market leader from both side, from the and also from the blockchain infrastructure. We are securing a trillion of dollar of the transition every day. Thank you so much. And bank to bank, and I think then we'll have a demo session about the integration between and also. Back to you. Thank you very much, Ray. Appreciate it. So I do understand that there may be some interruptions with my Wi Fi at the moment. So apologies if some of the audio was clipped before, but hopefully, this session goes through smoothly. What I wanna share with you now is how does the Fireblox console look? How does the Fireblox platform operate? And how does it interact through these cold flows through to a TELUS HSM? So what I'm showing you on the screen at the moment is the Firebox console. This shows me the number of assets that I currently have within the system. It shows me the different vault accounts that I have. So these are effectively different private keys that I'm managing with the Firebox system and the different tagging and balances associated with each. So I've got my cold and omnibus account here, which is tagged as a cold account, and I've just got a few funds here. And then I've got some hot online accounts. So effectively, there's a hot connected HSMs that are able to instantly sign a transaction without any human intervention. What I'm gonna do is I'm gonna teach you a little bit more about this cold flow. So if I click into this cold Omnibus account, I can see the different assets that I'm holding within my cold environment. I can see here I've got a substantial balance of USDC, which I'm gonna look at how I can move this from a cold environment to hot. But firstly, looking back at the Fireblock system is how does it connect to the TELUS HSM? Well, effectively, keys are allocated to particular vaults and fire blocks. So a private key which is generated on a TELUS HSM is also generating a public key. That public key is then assigned to a particular vault of your choice within fire blocks within the key management facility. So we can see here, I've got an ECDSASecP256K1 key, which has been allocated to the account. And it's through this allocation of keys that we can then derive the public addresses for all of these wallets. So if I wanted to create a new wallet associated with Arbitrum, it'll quickly be able to use that public key, calculate that private address, and then I now have a permanent address that I can make deposits to. Now moving assets, we then use that information to serialize transactions and pass through to the TELUS HSN, which I'm gonna demonstrate to you now. This particular case, I'm gonna move out of my cold account and withdraw some USDC. I'm gonna choose to take this to a online withdrawal wallet. And just for brevity, I'm gonna say I'm gonna do $40,000 worth of assets here. I can choose my fee, slow, medium, or fast. I'm gonna pick fast to try and sort of push the speed on the blockchain and give this a comment, say, move to warm withdrawal wallet and click on transfer. So what this is doing in the back end is it's looking on chain to make sure that I have those balances. It's checking that account. It's then serializing a transaction for movement of 40,000 USDC, and it's now saying pending signature. What this has done is it's now moved that asset. And if I show you the image here, it's moved that transaction through to the Keylink flow online server, and this is doing some verification where it's now pushing it through the data diodes, through the Fireblocks Keylink flow offline server for the last Maker Checker flow. Now one thing you'll notice here is that I'm not actually doing any of the transaction approval just for brevity to show you how this actually works. So this is $40,000 now gone through. We can see here on the online portion, we've seen that this is passed through the online portion. There is a transaction for 40,000 USDC, which is now waiting to be signed. And now I can move to the offline portion here so I can see my offline key link flow, and I can see this transaction now in the pending new transactions. I can review the the transaction, the amount from and to. I can also download a JSON of this particular transaction. So there is additional process control that can be done within the cold environment if you want to do so. And also, we're doing some zero trust checking as well to ensure that this particular transaction has come from a trusted source. Once I believe that this is all okay, I can now select this transaction, and I need to hide this and click on sign. So what that's gonna do is that's then going to use the Lunar client to send that through to the HSN, sign with the appropriate key. And you can see that's happened so quickly to get signed by the Luna HSM. And we now have a signed transaction which has been exported back from the offline portion. And that's what we just refresh and then move to completed. Then Then we can now see in the Fireblocks console, we have a transaction which has now been validated by Fireblocks and is now in the confirming stage. So this has been already sent to the Polygon blockchain for on chain verification and confirmation. So while that status is going through, effectively, we've done is we've created a $40,000 movement very, very quickly. And we've used in this particular case, it didn't hit an upper limit of movements from cold, so we didn't have any approval flows. What I can show you here now is that if I wanted to move, say, more funds, and I'm wanting to maybe even move this to an external account or a whitelisted address here, and I'm wanting to put maybe 8,500,000.0, a very large amount. Say, oh, actually, that's let's say, trying to clear out the max account. I don't have 8,500,000.0, unfortunately. But this one is gonna actually hit an approval flow because I've gone over the limit which is permitted for this particular transaction type. So we can see immediately this is blocked at pending authorization. So it's saying pending approval from one of these approvers. So one of the eight people in this list. Now this transaction approval flow can be configured in any way that you particularly want to say that I want to have a maybe four of eight. So within the Fireblocks transaction policy engine, you're able to see here that I've got any anyone initiating an external amount over $50,000 per transaction requires one of eight users. So here, I've got the flexibility to set any forms of policies, whether it's two groups of different policy teams to approve a transaction before it completes. As you can see here, we now have a completed transaction on chain for this, and we can also go onto the Block Explorer directly to see that transaction verified and on chain. With that, I think we've covered off the demo portion. I would now love to move on to any of the q and a that we have. Chris, over to you, sir. Awesome. Thank you so much, Ben. Thank you so much, Ray. So we do actually have some questions, which is fantastic. First one, I know we just kind of covered this to a little bit, Ben. But can you please explain how a transaction signing actually happens within Fireblocks? And let's just say Fireblocks and my VM has an API cosigner. Does the cosigner need to have a key? Does it need to be stored in the computer? And then generally, like, you know, are the credentials you know, what kind of credentials would you be storing, etcetera? So maybe we can walk through just, the. the general transaction signing process and then maybe what that looks like with an API cosigner as well. Yeah. Look. Really, really good question, and I I I think this is it's it's very knowledgeable about our infrastructure. So congrats to the person who asked this. So with with Fireblocks, this particular setup for KeyLink flow allows you to deploy cosigners to perform specific functions. So cosigners can be both a signing function with MPC, but also can be part of an approvals flow. So having a cosigner within this flow would allow you to do what we call as callback handling. So an example is you initiate a transaction via an API connection. You then wanna have the callback handler as part of the approval flow to verify subsystems that this transaction has actually come from a trusted source as part of that approval. So you may have a mix of humans and a cosigner who is doing that approval flow. Now onto credential storage. We actually Five Blocks KeyLink flow, these KeyLink agent KeyLink flow are actually built on a very similar technology to the cosigners in the way that we we build out their capabilities, and we also store the credentials as well. So effectively, same mentality is how we're using cosigners. We've deployed it as part of KeyLink flow. However, the important thing here is the signing keys are always maintained within the Telus ecosystem. So agent keys or lunar keys would be stored securely within the KeyLink flow server, but the actual the the actual private keys for wallets would be stored within the TELUS environment. I hope that answers your question. Awesome. Thank you, Ben. We do have another question here, and this is actually Ray, this this goes back to a slide I think that you would had, or maybe it was it was a little bit earlier in the presentation. But, basically, it said, hey. For on a previous slide, with the HD if the HD wallet is not what what basically happens if the HD wallet is not supported for cold, for from, like, a cold wallet standpoint? Okay. I'm I'm really glad that you crossed that and asked a quick question. And to be absolutely clear, yes, HD Wallet are fully supported in both hot wallet and cold wallet system. So the slides that I highlighted HD wallet under hot wallet session because most of the use case for the HD wallet is for the hot wallet due to the highest frequency automated adjust generation happens in daily customer deposit. The technology is like this. So by using the HD wallet, we can generate the same address and also private key at the same time. If you can get you can have the three things, like private key, c, and also the path. So say, if you want to use the same technology for the cold water, we are working for that, and you're absolutely you can do that. Most of the cases for us, for the users, no matter is hot water or cold water using the HD wallet system, one of the things that they want to have is achieve is about the performance and also the security. By using the HD wallet, if you want to store the some kind of secure sensitive information from your database, you don't need to store in the in the database with the key. You just need to store the path. So if you got the path, you got the private key, you got the CEDHSM, you can generate the same private key and also the address every time if you got all the things. So, yes, if you want to achieve to want to use HD wallet in quarter, absolutely, you can do that. But most of them are are using for hot water. Thank you. Awesome. Awesome. Thank you, Ray. And I I think we we are at time. I think maybe we have time for just one more final question. I guess, you know, maybe, Ben, this one goes to you, but who who and let me just find the question here again. Who like, who is Fireblocks, you know, supported with this level of infrastructure, and, you know, who is this kinda really, you know, utilized for for the most part? Yeah. Look. This is a really good question again. So Firebox is supporting pretty much the whole spectrum of the market today for this. So we've had customers in highly regulated markets. Say, for example, Ray mentioned Hong Kong where HSMs are mandatory. So if you're running a digital assets business, you need to incorporate an HSM into your flow. We are doing this for crypto retail exchanges. We're doing it for banks and increasingly payment service providers as well. So this technology is is not new off the shelf. This is actually something Firebox has been working for a couple of years on, quietly squirrelling away and we're deploying with customers. But now we sort of see that bringing this together would tell us in a a cemented partnership provides a much much better value proposition to our customers. So I think customers will appreciate a a standardized service and delivery model from two of the highest respected players in this field. Amazing. Awesome. Well, listen. I think that is all the time that we have for today. Ben, Ray, thank you both so much. This was fantastic. For everyone that, that tuned in and also that registered, thank you so much for, for your time. For any questions that we didn't have a chance to get around to, we will try to follow-up with you personally, outside of this. Ben and and Ray's information is here. Thank you again, everybody, and I hope everyone has a a great rest of the day. Thank you very much.