Connect a hardware wallet.

01 Current status

I want to be straight with you before you read any further, because this is exactly the kind of feature it is tempting to overstate.

If hardware signing is a hard requirement for your launch, treat it as a planned capability and design around the current model in the meantime.

02 How keys are held today

The wallet is self-custodial software with keys generated and stored on the device:

• A BIP-39 recovery phrase is created on first launch and is the root of every key the wallet derives. You back it up on paper. See Install the wallet and Restoring from a seed phrase.
• Encrypted at rest. The private keys are sealed using the Android Keystore and a key that is bound to your biometric (or device PIN). The signing key is released only after you authenticate, and the operating system holds it in hardware-backed storage where the app itself cannot read it out.
• Keys never leave the device and never reach me. There is no server-side copy. That is the trade-off of self-custody: strong control in your hands, and recovery that depends entirely on your written phrase.

This is a genuinely solid model for a phone wallet. What it is not is air-gapped — and that distinction is the whole reason hardware wallets exist.

03 Why hardware signing matters

A phone is a networked, general-purpose computer. However well a key is protected inside the Keystore, the signing operation still happens on a device that talks to the internet and runs other software. For most testnet use that is perfectly fine. For someone protecting keys with real-world consequences, it is the threat you most want to remove.

A hardware wallet moves the private key onto a small, single-purpose, air-gapped device:

• The key is generated on the hardware device and never exists on a networked machine.
• To send a transaction, the wallet builds the unsigned transaction and passes it to the device. You confirm the details on the device’s own screen and it signs internally.
• Only the finished signature comes back. The key itself never crosses to the phone or the network — so malware on the phone cannot extract it, and a tampered transaction is visible on the device screen before you approve it.

That is the property hardware support will add: the private key never touches a networked device, and every approval is confirmed on trusted hardware you hold.

04 What support will look like

When hardware signing ships, the shape will be familiar to anyone who has used a hardware wallet before. The plan is:

• Device pairing over USB-C or Bluetooth (depending on the model), so the wallet can hand transactions to the device and receive signatures back.
• The seed lives on the hardware device, not in the app. The wallet becomes a watch-and-build front end: it derives addresses from the device’s public keys, tracks your balance, and constructs transactions — but holds no spending key.
• On-device confirmation of the amount and destination address for every send, signed inside the device.

Conceptually the send flow becomes a hand-off rather than a local signature:

To plan for it now: if you intend to use a hardware wallet later, you can keep your high-value keys on the device from the start and use the software wallet only for testnet exploration. When pairing lands, you connect the device rather than migrating a software seed — keys that were generated on hardware stay on hardware.

05 Not the same as dashboard 2FA

One thing worth separating clearly, because the word “hardware” appears in both and they are easy to conflate.

The operator dashboard supports hardware-key two-factor authentication using FIDO2 / WebAuthn — a physical security key (for example a YubiKey) that proves it is really you when you log in to the management console. That is an account-login control. It protects access to the dashboard.

It is not wallet transaction signing. A FIDO2 key authenticates a login; it does not hold your coin keys and it does not sign on-chain transactions. The two features live in different parts of the stack and solve different problems:

• Dashboard hardware 2FA (FIDO2/WebAuthn) — available now, gates operator account login. Set it up in account security.
• Wallet hardware signing (Ledger/Trezor) — on the roadmap, would sign on-chain transactions with an air-gapped key.