Hardware wallet

The device generates the BIP-39 seed on-device and derives hierarchical keys with BIP-32 and BIP-44. Its core piece is the Secure Element, a certified chip rated under Common Criteria (EAL5+ or EAL6+) designed to resist physical attacks, which manages the PIN and the retry counter. Signing happens in isolation over USB, Bluetooth or QR code: the host sends the unsigned transaction and the user verifies and approves it on the device's own screen, defending against malware on the connected machine. An optional passphrase enables hidden wallets.

It is the practical form of cold storage for individuals and institutions, protecting large balances against malware, remote theft and key phishing. One key limitation is worth being clear about: the device signs what the user confirms, so it does not protect against blindly signing a malicious approval. Hence the importance of clear signing, reading on screen exactly what is being authorized.