Fireblocks is the incumbent for institutions: MPC across SGX enclaves, a policy engine that gates every signature, qualified custody, and now an agentic payments suite with an open-source x402 agent. It starts at $999 a month. Coldstar is for everyone below that line, and for anyone who wants the root in their own hands.
Fireblocks for the regulated operating layer; Coldstar for the cold reserve and the experiments that don't need a custodian.
| Coldstar | Fireblocks | |
|---|---|---|
| Who holds the root key | You. The cold root lives encrypted on your own USB drive. No vendor holds a key, a share, or an account. | Fireblocks holds MPC-CMP key shares alongside shares on customer devices; every signature passes its policy engine. Offers both direct custody and qualified custody. |
| Where the key lives | On your machine. The air-gapped root signs a bounded policy envelope; a disposable session key signs routine transactions inside it. | Shares across multiple Intel SGX trusted execution environments; a cold-wallet add-on exists on the pricing page (mechanism not detailed). |
| Policy engine | Per-transaction limit, daily cap, program allowlist, recipient allowlist and blocklist, escalate-above threshold — for SOL and per SPL token, with per-mint limits in base units and destinations checked against the recipients' token accounts. Token instructions that cannot be bounded, Approve above all, escalate to a human rather than signing. Evaluated locally, first match wins, before any signature exists. The daily cap can be read back from the chain, so deleting the local ledger cannot reset it, and an allowlisted program's real debit can be measured by simulation rather than trusted. | Transaction Authorization Policy: who can move funds, per-transaction caps, per-period velocity caps, designated approvers above an auto-sign threshold, destination whitelists, ordered rules. |
| Out-of-policy transactions | ESCALATE to a human over air-gapped QR, or REJECT. No signature is produced for a rejected transaction. A grant can also be revoked on-chain before it expires, by the root or by a hot revoker key that cannot spend; the signer refuses everything from then on, and a chain it cannot reach escalates rather than signs. | Held for designated approvers, or blocked. |
| Cold / offline root | Yes — the root key never touches a networked machine. It signs a policy envelope offline; the online signer verifies that signature and refuses to start if the policy was edited, the session key is not the one named, or the grant expired. | No air-gapped root documented; cold-wallet add-on unspecified. |
| Agent integration | Framework-agnostic: the agent proposes an unsigned transaction, the signer decides. ColdstarWallet is an open-source drop-in for Solana Agent Kit's BaseWallet, and coldstar-signer-mcp exposes the same policy-gated wallet to any MCP client. Squads spending limits are decoded rather than trusted, so an agent can be a vault member bounded by the chain and by local policy. | Agentic Payments Suite: x402 facilitator, agentic wallets with delegated authority, KYT and travel rule. Open-source x402 agent (MCP and CLI) where "the agent never holds keys"; the example is Base USDC, not Solana. |
| Solana support | Solana mainnet. Core is chain-agnostic; EVM signing exists. | Yes: policies apply across Bitcoin, Ethereum, Solana, and 150+ networks. |
| Source & self-hosting | Open source (MIT), self-hosted. No API key, no SaaS dependency, nothing to go down. | MPC-CMP algorithm and the x402 agent are open source; the platform is closed. Hosted. |
| Pricing | Free software plus a ~$10 drive. | Essentials $999/month (self-serve, $1M quarterly outbound, 0.20% overage). Pro and Enterprise from $36,000/year. Free developer sandbox. |
| Maturity | Beta — the signing core and policy engine are in scope for the planned independent audit. | Production; the institutional market leader. |
Fireblocks and Coldstar agree on the principle that the agent never holds keys; Fireblocks' own x402 agent says so. They disagree on who should hold them instead: a custodian's enclave fleet, or a drive in your pocket.
Fireblocks distributes key shares across SGX enclaves and its customers' devices, and enforces a policy on every signature. It carries the compliance, audit, and insurance posture regulated institutions require. You are trusting Fireblocks' enclaves, its operations, and the SGX security model, and you are paying for that trust to be contractual.
Coldstar does not ask you to trust an operator. The root is an encrypted file on your drive; it signs a policy envelope offline; the agent works within it under a local rule list with a daily cap and an escalate threshold. It is not qualified custody, and it does not pretend to be.
Fireblocks is the market leader in production. Coldstar is beta, pre-audit.
Yes: an Agentic Payments Suite with agentic wallets and an open-source x402 agent whose design keeps keys away from the agent. The published example is Base USDC; Solana is supported by the platform generally.
It offers both direct custody (MPC shares partly on your devices, signing gated by its policy engine) and qualified custody. Either way Fireblocks operates the enclaves. Coldstar's root never leaves your possession.
The sandbox is free for development, but production starts at $999 a month. Coldstar is free, and for a team without regulatory obligations the custodian adds cost and a dependency without adding a colder root.
Open source, MIT. macOS, Linux, Windows — and on the Solana Seeker dApp Store.
pip install coldstar
Third-party facts were checked against the vendor's own pages on the date above. Pricing and feature sets change; if something here is out of date, tell us and we will fix it.