Thales has partnered with Hong Kong Virtual Asset Exchange (HKVAX) to strengthen the security and regulatory compliance of its digital asset custody infrastructure, deploying Luna Hardware Security Modules (HSMs) across the exchange’s wallet architecture.

HKVAX, one of the first Virtual Asset Trading Platforms (VATPs) licensed by Hong Kong’s Securities and Futures Commission (SFC), selected the Thales Luna HSMs for their FIPS 140-3 Level 3 validation, positioning the exchange to meet the SFC’s regulatory-grade requirements for private key protection, transaction signing and custodial controls.

Hardware-backed security for a regulated exchange

Operating under the SFC’s regulatory framework, HKVAX needed a cryptographic foundation capable of addressing evolving cyber risks to private keys, smart contracts and custodial systems. The Luna HSMs now underpin key generation, storage and transaction signing across HKVAX’s multi-tier wallet architecture, which separates hot and cold wallets and enforces role-based access controls.

“Thales Luna HSMs stood out because it is among the first vendors to achieve FIPS 140-3 Level 3 validation, with a strong track record in securing critical systems for financial institutions and governments,” said Jack Zhou, Chief Information Officer at HKVAX. “Using Thales Luna HSM gives both us and our clients confidence in the security of our platform.”

Compliance and operational resilience outcomes

• Hardware-backed key protection, isolating cryptographic keys from software environments and privileged access
• Independent security audits passed, with hardware-backed audit evidence meeting SFC regulatory expectations
• Strengthened operational resilience through cold and hot wallet separation, disaster-recovery protocols and reduced manual intervention
• Increased customer and partner confidence in HKVAX’s platform as a regulated digital asset provider

“As a licensed VATP in Hong Kong, safeguarding client assets is our top priority,” Zhou said. “Without Thales, we wouldn’t be able to achieve institutional-grade security and compliance for digital assets at scale.”

Looking ahead to AI threats and post-quantum readiness

HKVAX is now preparing for emerging cybersecurity challenges including AI-driven threats and post-quantum cryptography (PQC) readiness. Through the Thales partnership, the exchange is positioning itself to maintain secure and compliant digital asset infrastructure as regulatory expectations evolve across the Asia Pacific region.

“Without Thales, we wouldn’t be able to achieve institutional-grade security and compliance for digital assets at scale,” said Jack Zhou, CIO, HKVAX.