Hong Kong’s HKVAX Strengthens Digital Asset Security, Regulatory Compliance With Thales Luna HSMs

HKVAX, one of Hong Kong’s pioneering Virtual Asset Trading Platforms (VATPs) licenced by the Securities and Futures Commission (SFC), has selected Thales Luna Hardware Security Modules (HSMs) to strengthen the security and compliance of its digital asset custody infrastructure.

Operating under the SFC’s rigorous regulatory framework, HKVAX required a cryptographic foundation capable of addressing evolving cyber risks to private keys, smart contracts, and custodial systems. The company selected Thales Luna HSMs based on their FIPS 140-3 Level 3 validation, industry reputation, and ability to support regulatory-grade deployments across its multi-tier wallet architecture.

“Thales Luna HSMs stood out because it is among the first vendors to achieve FIPS 140-3 Level 3 validation, with a strong track record in securing critical systems for financial institutions and governments,” said Jack Zhou, CIO at HKVAX. “Using Thales Luna HSM gives both us and our clients confidence in the security of our platform.”

HKVAX integrated Luna HSMs across its custody environment to support key generation, storage, and transaction signing, alongside its multi-tier wallet architecture, including hot and cold wallet separation and role-based access controls.

Key outcomes from the deployment include:

• Hardware-backed key protection: Centralised private key generation, storage, and transaction signing within FIPS 140-3 Level 3 validated hardware, isolating cryptographic keys from software environments and privileged access.
• Regulatory compliance and auditability: Successfully passed independent security audits, with automated key management processes and hardware-backed audit evidence meeting SFC regulatory expectations.
• Operational resilience: Strengthened custody architecture through cold and hot wallet separation, role-based access controls, disaster-recovery protocols, and reduced manual intervention across key management workflows.
• Customer and partner confidence: Increased trust in the security of HKVAX’s platform, supporting the company’s growth as a regulated digital asset provider in Hong Kong.

“As a licenced VATP in Hong Kong, safeguarding client assets is our top priority. Using Thales Luna HSM gives both us and our clients strong confidence in the security of our platform,” said Zhou. “Without Thales, we wouldn’t be able to achieve institutional-grade security and compliance for digital assets at scale.”

Looking ahead, HKVAX is preparing for emerging cybersecurity challenges including AI-driven threats and post-quantum cryptography (PQC) readiness. Through its partnership with Thales, the company is positioned to maintain leadership in secure and compliant digital asset infrastructure as innovative technologies and regulatory expectations emerge across the Asia Pacific region.

The full case study is available at: https://cpl.thalesgroup.com/resources/data-security/hkvax-digital-asset-security-luna-hsm-case-study.