Bitcoin Forum

🔓 Lock.com (https://www.lock.com/)'s thesis is that you get more safety by isolating inside the wallet than by isolating from the computer. A hardware wallet isolates the key from the computer. Lock.com tries to isolate the key from the rest of the wallet itself. You open one product and use it like any other wallet.

For active self-custody, software isolation can replace the hardware wallet. Hardware wallets solved a real problem. Keeping your keys off a general-purpose computer full of malware, browser exploits, and clipboard hijackers was the right call, and for deep cold storage it still is. Nobody's disputing that. But "keep the key off the computer" is a narrower guarantee than people treat it as, and for anyone actually *using* their coins it's showing its limits:

• You're still trusting the supply chain, the firmware, the update process, and the companion app. The secure element is small; the trust surface wrapped around it is not.
• The tiny screen that's supposed to be your source of truth can't meaningfully show you a complex swap, bridge, or contract approval. You end up confirming a blob and hoping.
• For real multi-chain use, the surrounding software still owns everything that matters - chain state, providers and routing, transaction context, swaps, bridges, and the entire UX. The device signs; the software decides what it signs.

To you, it's one wallet app. Under the hood, the sensitive roles are pulled apart so a compromise in one piece never reaches the seed. This isn't another skin over the same monolith. The part that can sign is small, walled off, and never shares space with the part talking to the internet or drawing the UI.

• Treasury — the only component that touches seed-derived material and signs.
• Node — chain state, providers, routing, RPCs, swaps, bridges, all the network-facing work.
• Wallet — the interface you actually click around in.
• Vault daemon — protects the device key on its own, on platforms that let us do it.

On post-quantum, Lock uses hybrid classical + post-quantum cryptography inside its own architecture and communication layers. It does not make any existing chain quantum-safe - on-chain signatures still come down to whatever cryptography that chain uses, and that's not ours to change.

Our claim, plainly: for most people doing active self-custody, this replaces the hardware wallet. For deep cold storage, a dedicated device may still be the right tool.  I want to know exactly where you think that line falls. Here's what we're particularly interested in about this thread.

• Wallet builders and auditors: tear into the architecture and the trust boundaries.
• Hardware-wallet users: tell me where a dedicated device still beats this.
• Self-custody users: the frustrations nothing on the market has fixed.
• Anyone who wants to follow along before it's public.

I like this picture.

Empty beer boxes suggest that your coming project is bound to succeed.  ;D

On the serious note, your mentioned "post-quantum schemes inside the wallet's own architecture and its comms layers". Does it mean that your are intend to protect from quantum treat the app itself ^{like its local data,sync, backup, any client-server communication, what else?.} rather than funds it controls?

Hi satscraper, seeds created from the Lock Treasury are quantum safe, the security is designed for the quantum world. If a blockchain is not quantum safe, this is out of the programs control.

https://talkimg.com/images/2026/07/08/UcnUbb.png

how is that "True Air-Gapped Security" when the wallet app can communicate with the offline signer via bluetooth or local wifi?

can you explain in more details how the seeds created are quantum safe?

All of the above can be answered only after your whitepaper sees the light. Until then, your words cannot be taken seriously and our speculations would be meaningless.

But at least now I can say that, in my view, there's no way to achieve absolute isolation of key material in the host machine, as those keys need to communicate with the host which builds the unsigned transactions.

So I'm waiting for your whitepaper for serious discussion.

When you said "small", you meant a few lines of code that's easy to audit?

Because based from the website,
I can't see any advantage from existing cold-storage feature that's already available in some self-custodial wallets.
e.g.: An air-gap machine with offline wallet and an online watch-only pair.
Open-source so it can be verified even though it's not isolated from the wallet daemon and/or GUI.

Of course, an easy-to-verify source code for the "Treasury" is good if that's what you meant.

Hi Zwei, the air gap is between your Treasury (signer) and the internet, not between the Wallet and the Treasury. Bluetooth/WiFi/USB/Ethernet is the local link the app uses to hand the Treasury something to sign.

The Wallet itself never generates a transaction. The Wallet sends instructions to the Treasury where all the verification and generation of the transaction takes place. Signing happens entirely on the Treasury with no access to the internet.

That link is locked down: end-to-end encrypted with a post-quantum handshake, protected by an 8-digit pairing check against impersonation, and the Treasury is blocked at the OS level from ever making an outbound connection.

As for your question on the seeds being created there are two parts to it. First, the seed: Grover's algorithm halves brute-force strength (256-bit to ~128-bit), so Lock's 36-word Universal Quantum Seed uses 272 bits of entropy  ~136-bit even against a quantum search, with a hardened KDF (PBKDF2 600k + Argon2id) on top.

Second, the seed derives genuine NIST keys (ML-KEM-768 + ML-DSA-65), always paired with classical so both must break, protecting your chat, files, the Wallet to Treasury channel and node auth against "harvest-now-decrypt-later."

The majority of on-chain signatures are still classical (secp256k1/Ed25519). Lock's built to switch the day they do. Until then, your seed already carries the headroom.

---

Hi satscraper, a laptop without internet access can't leak your private keys. Currently we're planning the Treasury OS, a full operating system that only runs the Treasury. Your laptop or Raspberry Pi becomes your signing device.

One that has verifiable open code.
One that wasn't tampered or swapped in transit.
One that doesn't have your home address or phone number on file.
One that doesn't leave you open to phishing attempts.
One that isn't assembled and compiled by random people you don't know.
One that doesn't require trust.

---

Hi nc50lc, our Wallet, Treasury and Node combined is over +2,000,000 lines of code. You can choose to trust a hardware wallet manufacturer, you can choose to trust they will deliver your device that hasn't been tampered with at the facility where it was made or in transit. You can choose to trust they will keep your personal billing information secure.. or you can choose Lock, who you don't have to trust, where you can verify the code and compile it yourself without even divulging your email address. The security benefits are enormous, we're in a league of our own.

Not the answer to my question, thanks for the reply anyways.
I guess I have to wait for the official release, whitepaper, documentation for the proper answer.

For clarification, I meant "Cold Storage" setup which doesn't involve a hardware wallet.
E.g.: An offline Electrum wallet that's the signer and an online watching-only wallet for the online-related features.

About the part where I asked about that "small" thing, I'm asking if it's the code of the Treasury (as you said "the part that can sign").
Not asking for the whole codebase's size.

Developing a new OS from scratch for the zoo of available hardware is very risky business. I would never vouch for the security of any chicken OS. Even Linux, which has existed and polished for decades, reveals nowadays that it has hidden flaws that may open the doors. Why not develop a dedicated app to keep key materials in the persistent volume of Tails with the frozen radio channels?

Hi nc50lc, It's like you're saying with Electrum, if Electrum was used on an offline computer and you had access to 120 Blockchains instead of 1, along with a highly encrypted chat system where the senders and receivers are hidden, instant swapping with optional fees, online file storage with direct connection to the filecoin network, importing any wallet from all the major wallets including old wallet.dat files from 2009, hidden wallets to create branches from your original seed which are not stored in memory for safe keeping and much more.

Let me try to explain the Treasury, it should only be running on an offline computer of yours, you can use it on your regular computer connected to the internet but that is highly unrecommended, it can be connected to from Bluetooth, Wifi, USB or a direct LAN connection. We offer a seperate Wallet program that can be downloaded on Windows, Mac or Linux. When you send a transaction, its built inside the Treasury and sent back to your Wallet to be broadcast.

Our first version will be released in a few weeks, you will be able to see for yourself :)

---

Hi satscraper, The Treasury OS is not an actual operating system the way you're thinking. It makes it so you're computer only runs the Treasury and nothing else, the app itself becomes the OS.

Oh, I didn't take that into account.
I mainly use Bitcoin and Bitcoin wallets, but being a multi-coin wallet is indeed an advantage since I rarely see one with cold-storage feature.

Thanks, but I'm aware of this.
It's just the note about it being "small" that I'm interested with.

But since it'll be released in just a few weeks, I'll just wait for it to check.

But it needs drivers to interact with hardware.

 Will you write them yourself to ensure the integrity of Treasury OS? And what about the connection to Tor?

Still, I think the Tails approach would be more reliable, taking into account that you're going to target virtually all existing hardware. It's one thing when you build your own hardware ^{like Apple and  Foundation do} and make the dedicated OS for it, but it's another when  OS has to run on the whole zoo of devices.

As they say: Extraordinary claims require extraordinary evidence. If you claim your software is safer than a hardware wallet, you'll have a tough time convincing us here.

So you're replacing a hardware wallet by an entire laptop? I can already sign offline using a laptop, with software I trust. Why would I want your software instead? No, I do not need 120 different blockchains.

I don't know a single person who has the skills and time to properly review 2 million lines of code.

From what I've seen, people who are into many different altcoins usually keep "their" coins on an exchange. They don't care about self-custody.

That's what makes hardware wallets so easy to recommend for beginners: it's much easier to keep secure than a manual cold storage setup.

Probably for the mainstream,
Although Bitcoin isn't much different for them, most of them also store their bitcoins in Exchange, if not, in popular Multi-coin wallets like MEW.
In my viewpoint, I'm seeing more posts throughout the internet about the latter.
But since there's no actual survey or study regarding this, we can't be assured on the actual numbers.

@madebylock

Hi there!

Hope you are doing well. I just registered for early access. When I click it, it says, "Registering..."

And there is also a button for sign-up which I think is not working for now, right? Because when I click it, it says, "Saved. Connection is unstable, so we’ll keep trying automatically."

Meaning the service is not fully functional, or am I mistaken?

Aside from this, I would like to translate the ANN into the Urdu Language if it helps the service to grow faster in adoption. Thanks!

You might behaving a connection issue. I have a different response, and I got "Thanks. You’re on the list."

About the sign-up button, I can't find it on the home page. How did you find it?

I think the home page is not done yet; the signup button is gone.

Yeah, it seems like there is something wrong with my connection.

Aside from this, When you will scroll down a bit, then you will see sign-up button on the top right corner on your screen.

Edit: it works, i am now also on the list...

I can confirm this, I also pre-registered and it went smoothly.

@madebylock
I hope that it supports testnet 4 or 3 chains because I don't prefer testing a preview software in mainnet, if possible.
BTW, great timing on announcing the preview version, capitalizing on Coldcard's debacle is a smart move.

A new project can always be interesting for revitalizing the sector. We'll see what really comes next.

However, I'd like to ask a few simple questions, not so technical, but more from a user's perspective:
- What makes this different from Electrum? (I'm not referring to the quantum part.)
- How does this make my day simpler than with an Electrum and safer than with a Ledger/Trezor/etc?

I am not so sure about this. I don't want to turn my back on hardware wallets altogether because of what Coldcard, NVK, and the rest of the guys did. Their implementation was flawed but that doesn't make 12/24-word seeds unsafe now, especially with a complex, long, and non-bruteforcable (according to today's standards) passphrase or multisig involving several other parties. Entropy from non-biased dice is still good.

The flawed code of Coldcard was public for five years. Why didn't anyone notice it? People can argue that nobody wanted to waste their time reviewing it or working with NVK because of his past behavior but I don't think that's good enough of an excuse. Any expert that claimed to have "reviewed" Coldcard's code and gave them the thumbs up messed up.

If people weren't able to find the vulnerabilities with that product for five years, what are the chances they will review Lock properly and its 2 million lines of code? At the moment, that's a no from me.

If I make the decision to abandon all hardware wallets, it's going to be for a completely and properly airgapped setup involving Electrum on an offline computer. To me, that's levelling up in terms of security.

It happened with me also. It got stuck on the Registering part for quite a few seconds, and then I saw the same message. Later on it showed that I am on the list. My connection is stable, so I assume it might be a small tech glitch; as of now, it has not yet launched. So such issues can come up. The main thing is their product, which I am more interested in, as they are claiming big things.

It seems that setup which meets your requirement exists already, and this is Tails, which has Electrum preinstalled and is capable of booting on any machine offline via USB port. This setup has been proven over the years. New setup, like Lock OS ^{with its millions of entries in its codebase} is likely to have more flaws than anything else users have faced so far.

Im not a speciallist on this matter and im not gonna give advice to anyone here since most of the guys around knows much more than me.

Aside of it i found this thread thanks to the signature campaign you are gonna start which it makes me happy to see things like this one doing one of them and not always the same gambling companies around.

I like the concept of start to paying attention to the quantum computer from now and already closing the discussion about it since we alread have the tools to prevent any problem in the future, so i hope your product does good and more people start to be cover from post quantum issues.

And please dont make silly mistakes like the coldcard one.....

Thanks for the confirmation, Mate.


Hmm, seems like. The best thing is that after testing the service, we are reporting such glitches here with the team, which can be improved from time to time. Maybe when it says to us that "Saved. Connection is unstable, so we’ll keep trying automatically." or "Registering", there can be chances it is saving our request in the backend/database. That is why it takes a little time to get access for pre-registration or to be on the list.

Aside from this, Such projects are really needed.

Keep in mind that Bitcoin and its blockchain aren't quantum-safe. The network would have to undergo a hard fork to migrate away from legacy signatures. Who knows how long that's going to take and when it will be needed. Lock uses a combination of traditional, non-quantum-safe cryptography and a quantum-safe system. I don't have the technical know-how to comment on how that would work on a blockchain that itself isn't protected against the worst-case scenario and what would happen to Lock in case a quantum attack happened.

Thank you Pmalek for your answer, yes i know it, but i also know we already have the knowledge to overcome it which is super important we only need the next step which is what you said and is not an easy one. We have to come to a new consensus and made it bulletproof.

But this could take a lot of time and that could be a problem.

Yeah, you are correct, as this is a very concerning and important matter these days.
Because we, as its adopters, fear what would happen if a quantum computer damages/attack its network in any way.
At the same time, if we think about it from another perspective, we know that every technology has its pros and cons.

So what if this technology is used to make it safe from bad actors to protect it rather than damaging it in any way?
The meaning of this is that it will depend on the situation and what kind of people/person is using this technology.
This will decide whether quantum computing is a technology against this asset or supports it.

Other than this, what I think is that, as adoption of Bitcoin is increasing day by day, and now it has reached the international level where we have seen it also has been added to some countries' strategic reserves, e.g., the US. So I don't think countries like these or big powers will ever let this happen. Because if this happens, it will also damage them, which can impact their economy, right? CMIIW!

Seeing 🔓Lock as another storage alternative that suddenly appeared after the Coldcard Hardware wallet hack case,
this seems like the right way to start introducing a lock wallet with a Quantum safe system that is claimed to be able to protect the wallet better,
Whether this is true and can protect the private key and signin process on the device, I still don't fully understand.

And 🔓Lock says that "Hardware is dead" and will the era of hardware wallets be replaced?
Since any device can be used for storage with a 🔓lock, this is a claim that really needs to be proven.
The application that is still not available makes me curious what exactly this 🔓Lock wallet is, whether it is according to its claim or not.

I'm still surprised how ledger remains on your list despite the repeated data leaks recorded in the past, I cannot recommend such a wallet that divulges users KYC data. Although I have no complaints about Trezor, but on a personal note I don't use hardware wallets, my cold storage device is enough for me. I'm particularly interested in Lock software which promises cold storage on multi-chain wallet, I've not seen anything like that before. I would be willing to move my altcoins to a cold storage device as well.

The animation indicating "Hardware is dead" on the landing page of the site is interesting, I really want to try out the 🔓 Lock wallet as well.
I've already signed up in the waiting list.

I am not dismissing Lock because it has a lot of code. It's brand-new in addition to having millions of lines of code. I am not someone who is in hurry to test something new if there are other quality solutions that have been around for many years. Since you mentioned Electrum, I think that software was created back in 2011 or 2012. It's been around for more than a decade and does what it was created to do.

I am also not a big fan of the type of marketing we are not seeing from Lock. "Hardware is dead!" No it's not. They are just trying to take advantage of the situation to increase their userbase. I criticized a post some time ago by Unstoppable Wallet, where they were trying to make it seem like it's better to use their software wallet than hardware wallets. I didn't like that and I don't like Lock's approach here either.

Claims that have not been proven will not give any results, and there is no definite trial, If the product is available and can be tested,
then everything can be answered, whether the claim is true or just part of marketing.

Ledger & trezor isn't just on my list, but look at how these two hardware wallets are chosen for their use, and if you don't have a hardware wallet yet then you won't know what the ecosystem is.
And don't be too FOMO, especially if you say you are interested and want to move the altcoins you have to a new wallet that has not been tested, especially since the application is not yet available. .

New software certainly takes a lot of experimentation and people who are too FOMO to test and move all their altcoins in the new Wallet that have not been tested,
this is like a dark mission without knowing the direction and willing to sacrifice the assets he has.
It took a lot of research and experimentation before it was decided that the wallet was good enough, even electrum took years.

Claims that are too exaggerated and indeed the marketing method takes advantage of the Hacking moment that occurred on Coldcard, moreover there has not been any test.
If it's good and the amazing Quantum safe technology works well, I'll use it too, but if it's an overly ambitious claim, then it's just like any other wallet that will just disappear without any updates

I also applied for early access.
They are launching with a very bold slogan. A large amount of crypto was stolen in a Coldcard hack. As far as I recall, there were issues with Ledger in the past. I want to give Lock.com a try.

It may be a coincidence. But the point is, Lock offers a solution for a better security of our assets. Having the quantum safe system is crucial nowadays, we shouldn't be a part of the victim.  ;)

Nice, I hope you can get the great advantage of using the Lock wallet. I'll also submit my email to be on list.

Coldcard must be excluded from the options.

Yep, Trezor and Ledger can be still the favorite one but Lock offers another interesting one.

Thats what dragged my attention to also give it a trail too by putting my email on the list, can't wait for them to fully launch and prove that they have something better to offer. Their universal quantum seed is impressive, it's in icons instead  of words and i love that it can be writen in a particular language and recovered in another. I just hope they're as prepared as stated for the long expected quantum threat. Wallets currently are not directly immune to Glover's Algorithm but anyone that can survive it would gain lots of trust.

I completely agree with you. Until the code is created and all kinds of features and security of that code are reviewed by experts we cannot say whether their claims are actually right or wrong. Even then I hope they are able to successfully build and implement these features.

Actually it is very important that a large amount of Altcoin or Bitcoin should not be moved into a new platform but yes it can be tested with a small amount of funds. I am also on the waitlist of course to see whether their features are really as extraordinary as they claim.

---

By the way, has anyone notice Lock's domain name? Lock .com is not an average domain since it is a single word and popular word domain its price could be 7 to 8 digits in dollars. I hope it is fair to expect some good features from people who can spend so much on their domain.

First of all, I’d like to welcome the Lock team to the forum; you’ve certainly chosen the right place to promote your project. Your product deserves attention because it is something truly special. Even with my interest in blockchain and Bitcoin technology, I wasn't aware of a solution as interesting as the Lock concept and architecture. It offers a unique security mechanism—much like cold wallets—yet operates directly on the computer, all while overcoming the inherent drawbacks of cold wallets (such as the inconvenience of making more than one transaction a day). That is precisely why my Ledger is sitting unused on a shelf; I’m simply not the type of investor who buys Bitcoin just to hold onto it for years.

I do not understand how the Universal Quantum Seed would be recovered if the service fails; it must be integrated into standard recovery methods.

https://talkimg.com/images/2026/08/12/U4mLEw.png
I discovered that your Reddit account has been banned. It might be best to start r/ from an old account.

Trust me, I'm not entertaining FOMO. I'm only interested in seeing what they have to offer, would test it out with few dollar worth of altcoins for a while and observe reviews for a good time before even considering taking a bigger sum to it. I am particularly interested in the cold storage feature for alt-coins and that doesn't mean I'm jumping mindlessly at it upon launching, due process must be observed with proper self-testing to Verify, else it would mean I've learned nothing with the little time I've spent here in the forum.

Of course. I even tried to find out how much it was sold for, but "domain" and "lock" is an impossible combination to Google.
Archive.org confirms the domain changed owner recently.

I'm not a big fan of marketing an unfinished product, that makes it look like they're trying to create a hype. Combined with not responding to concerns (https://bitcointalk.org/index.php?topic=5587463.msg66944273#msg66944273) for a month and the pictures in the OP that remind me of the ICO days, I won't be using this wallet any time soon.

Hardware is dead is, of course, a pretty loud and bold slogan from Lock, but probably such products need a fierce strategy to attract attention to themselves, because after all, as I wrote in my previous post, they use a rather curious approach and, of course, Hardware wallets like Trezor and Ledger, already They have shown themselves to the crypto community and their reliability over time, but Lock is still a very relatively new project in this, and therefore they need time to show the reliability of their approach, which in theory sounds impressive.

You are correct at this point, but I think you missed what I meant to say. I was trying to ask or say that quantum computing hasn't reached its full intelligence power, so how is it possible to claim that any code is quantum-proof? And if we want to test any code, then we obviously need to have the potential of quantum technology, using which we can test the claim, whether it is true or not. CMIIW! Work on quantum technology has already been started by big companies. So let's see.


Yeah, this is a big mess. Reddit sometimes suspends accounts without any reason. Maybe using an old account will help here at this moment.

---

BTW, when are we going to get the final version of this software so that it can be tested?

I also hope this, but last time when Ledger's user data was breached, we all hoped this is it. But now Trezor's user data has also been breached. More than 11,900 people lost their personal details. They ordered the device online, and now their information is in the hands of wrench attackers.

So, I think more attacks are on the way. If the developers won't start doing their job seriously with the help of AI, then the hackers already have a surplus amount of funds to use AI models but developers are working on donations and requests.

We need more projects like this one, though, but hackers are going to go after every project that can have vulnerabilities. We need to find them before they could.

Dude, believe me, AI is more like a curse these days because it is getting out of hand and using it in every space, making it more intelligent. It's AI, and let's say you are developing a system using it; then don't you think it has the power to reverse it, that can break the system's privacy that you have built using any AI model? We have seen such cases happening recently, and if you want to see how much it is becoming dangerous, I want you to read this topic...>>https://bitcointalk.org/index.php?topic=5589801.msg66991325#msg66991325

I have analysed some other things as well that I don't want to talk about right now. But believe me, this technology is becoming a thing that really has the potential to stand against us. I don't know on which verge of the online space we are safe right now. So what if we say we create AI against AI technology, haha? Like design such technology that has the potential to fight against any AI model that can become a threat to break any crypto user's privacy or security? And for that, I think we need a wallet with a built-in feature of AI which should have the potential to play its role as a safeguard to protect system security. What do you think? CMIIW!

I guess that confirms that I am also able to sign the early access. I'm interested to know more about, I'm reading the details in the website and it looks that it has got a lot of features. Says that it's coming by Q3 and we're already in it but I think most likely will be launched anytime soon and waiting for the official one.

That's not the right approach. They should focus their marketing on their strengths, explaining what they bring to the table and how that can benefit end users. As Di Caprio said in the Wolf of Wall Street, "sell me this pen." Tell me why I need you and your pen instead of focusing on other pens and saying that they are dead and don't work. They do work, so why should I buy yours?

It's a proper analogy and a healthy way to sell without dropping other products.
The Lock wallet should not say "Hardware is dead" this is too generalizing some Hardware wallets that are still working and still have good security.

In the advertisement that is stated it should be Wallet lock, giving a reason why we as potential users should use Wallet Lock,
not drop other products so that Wallet Lock looks like a new product that must replace Hardware wallet, This is too much in my opinion.
There must be a reason so that the user will ask, Why do I have to leave the Hardware wallet and start using the Wallet Lock.

According to the website, the final version or Early Access is expected to be available by Q3 2026, meaning there is a possibility of getting it within this month. However even if it is not this month, we will get it next September. Now it remains to be seen when exactly they release it. Also many of us have already registered for Early Access, so hopefully it will not be too late. Now just waiting for the official update.

I completely agree that superficially explaining its concept and structure from the Lock project is not enough for the broad masses of crypto investors to start using their service, because in fact this service claims to be the most expensive thing any crypto has-its Bitcoin. And that is why they must explain in the deepest detail all the subtleties and the whole essence of their project, perhaps even opening their code in some way, because then technically savvy specialists on our forum will be able to express true trust in this service. And this will increase the influx of users interested in the Lock project.

Lock team also explains the reason why people should try their product, right?  ;)
You can be right, focusing on explaining more on the strength/advantage of own product will be a safer strategy than bothering other products. However, Lock team doesn't specify saying certain names of hardware wallets. So, I think it is still fair enough marketing way. It will be different if Lock team specifically mentions the names of other products.

I think it's worse that they are not mentioning any names because they are trying to make it sound like all hardware wallets are dead, non useful, and unsafe. If they had said that Coldcard is dead, I honestly wouldn't have had any objections against such a narrative. I don't think Coinkite will recover from this debacle. They might still be around for some time, but the trust in the company and its products is basically gone and it won't come back.

Is it just me, or does the OP seem to have disappeared?

I think we've all asked several questions about the project, and I haven't seen any feedback.

Perhaps there are some things they still can't say or answer. But at least giving some sign of life would be positive for the project.


@madebylock are you there?

Why do you think Lock will be expensive? Based on what the developers have said so far, simply storing BTC and signing transactions through Lock won't involve any fees charged by Lock. You only pay the usual Bitcoin network fee. And if you already have a suitable old laptop, you won't need to buy any additional hardware either.

The official website currently says explicitly: "Open-code. Free forever." There is no subscription, no license fee, and no charge for using the software.

I think price is actually one of Lock's advantages over hardware wallets. The potential downside, however, may be its approach to releases. If they release a single version once and leave it unchanged forever, its reliability could be no worse than that of hardware wallets such as Tangem, for example. But if they follow the usual model of continuously updated software - which is most likely - vulnerabilities could be introduced through updates.

I am sure that the Lock team should update the code of their project on an absolutely constant basis, while leaving it open, if what you wrote is true, that it really is open. At the same time, they definitely need to understand that if the code is open, then all hackers see it and can search for vulnerabilities, including with the help of AI, because the incident with ColdCard teaches us that even if no vulnerabilities have been found in a project for 5 years, this does not mean that it is made perfectly. And the project team must constantly conduct code reviews in order to look for errors even where they would not have expected them at all. At the same time, of course, they should use the latest AI models. We have all heard the interesting news that the main giants of the bitcoin ETF industry have requested the earliest access to the most powerful models from the creators of the best AI in order to keep cryptocurrency assets safe. As for the aspects of earning Lock, I will honestly say that I have not studied this issue yet.

You are right. They should not focus on other pens, but should make it crystal clear why their pen is better. But so far, I think the only problem here is the line "Hardware Wallet is dead" because it exaggerates everything, even their marketing, because it can look like not such a good line to use. But one thing we have to agree on is that they have given their proper reasoning for why they said hardware is dead because we have to trust third parties and global supply chains.

Recent breaches of the data of Trezor wallet buyers are an example of what they said being right. It might seem like a bad thing because of the Coldcard timing, and in reality, it is. They just have to make it look like something else. Maybe they can change it. Like, they could say "Beyond Hardware Wallets!" instead.

I am eagerly waiting for the release. August is ending soon, so I suspect the launch might happen by the end of August or early September. The OP hasn't been active here, possibly because they are busy working on the product. I'm also on their list, as this wallet aims to replace hardware wallets. I am eagerly waiting for it to be released so I can give it a try.

We'll see it since Q3's end is just little over a month and half. No one knows the exact launching when but it's giving that the interest and excitement for those who have been listed. I'm still baffled though for some details but let all of those things to get the clarity for my sake when it has come.

Hmm, That's correct. I also noticed this thing.
I again checked the last time madebylock came online around 8 days ago.
Hopefully, everything is alright, and maybe they are working on something.

And questions asked by members here should be answered ASAP to build trust in the community and for the longevity of the project.

this thread has made my day! and good to know the future is software isolation from the host not these silly airgap things.

I'm sure you shouldn't worry. The team members themselves are not always active on the forum, because they have enough time, and I think they left the manager as their representative, who forwards the letter directly to the Lock team when really important issues arise. And we should not forget that the manager leading this signature campaign does not undertake untested or short-term collaborations.


Yes, the idea of this project is quite interesting, and it looks like something unusual and worthy of the attention of investors and traders in bitcoin. I hope the Lock team is doing great with the further improvement of the wallet.

AI is a curse for those who lost their jobs due to it and the platforms which are exploited using AI. It is a curse for the victim but a blessing for the hackers and to those who made very good use of it and saved themselves a huge fortune.

Also, it is not how it works. If a platform is made using AI, then it is not correct to say it can be reversed using AI because AI has created it in the first place. You have to understand that there are backdoors which help hackers to access the platform without authorization.

Such hacks are not occurring due to AI. Although, if you look at the report about projects on GitHub made using platforms like Cursor, etc., they have high chances of vulnerabilities, not because they are made with AI, but because of prompt oversights from humans. So human error is the main issue here.

I think the Signature campaign is to establish themselves in the community before releasing the software, so that they are no more strangers when it is launched, it is a good step.

I still don't like that they've become very inactive recently, I might make an excuse for them that they're planning to answer every question when the project is already launched and being tested, so that people can confirm their claims as they reply and not just taking it with a pinch of salt. But It would've still helped to build confidence if they were still engaging to satisfy prospective clients curiosity.

Signup for the waitlist, you'll be among the first to be notified when the project is ready

It normal to be curious when representative of a platform is not active in the forum, it brings suspicions among some members but i don't think you're making excuses for them but giving your opinion and i have similar thought too cause since the project is not fully ready, maybe the team is working on something big that's keeping them inactive. I can't wait to be notified that the project is ready, i suspect that they're collecting feedbacks from different platforms about the project to help them offer better service when they fully launch, I'm just so curious about their quantum immunity claim but I'm patiently waiting for a full launch.

If there is no executable code, there is nothing to discuss. The team is giving a revolutionary idea, and without testing it, there is no discussion. Launching signature campaign will raise expectations, which is good.

Mate, I have been on the waiting list for too long. If you follow the previous discussion, you will come to know about this...


Yeah, this is too correct, and for this we need to wait for the team to announce the project's final version, maybe so that we can test it.
And the team must be working on it. So let's see when they come back here with the final version.

It's possible that members of any project on the forum are so busy that they only visit when called upon by the campaign manager, who is the intermediary, to address issues raised by forum members. For example, the Stake campaign has been going on for a very long time, despite the fact that their intermediary hasn't been online in a while. In general, now is a very dangerous time for any crypto project because they need to constantly double-check their code. And it's even better to do this using the most powerful AI models, which, I believe, are excellent at detecting errors. In general, we live in a time when crypto projects will increasingly be checked for errors. The AI ​​war is affecting the crypto world on a massive scale. Therefore, it's best for the Lock team not to rush releases.

The purpose of the signature team is a lot bigger than the interaction or bringing people to the ANN, but still, they come and either they saw the signature or not, they at least try to visit the ANN before even interacting with the project directly, and it is a wise idea.

So ANN is like a double edged situation here, because imagine if you as a newbie come to visit an ANN which is full of questions, people raising concerns, and no one from the official side is answering those questions. Then what will be your first thought? You will say at least these signature wearing people are active and giving their opinions. Maybe they will give their answers and comments, but does that count as accountability and updates from the team? No.

Therefore, the team has to come and manage some time, but I would not force this all on them yet because the deadline for the final release of the product is about to come, so they must be busy fixing things for us.

I was literally saying the same thing in my recent post here, but some failed to understand the actual meaning of my saying, anyway. Yeah, you are correct; the purpose of creating ANN is not just that we, as this campaign participant, come here and post here or keep discussions with others in a regular way; it is still okay to show dedication towards the project through regular discussion.

But the real meaning is that we should keep visiting the project site and keep looking for faults; if there are any, we need to report them here, so that in case there is any vulnerability left behind that can be removed or improved. And until anyone don't get any response from the team itself, how can users keep reporting?

---

The current Reddit page of Lock is banned, if I am not wrong; I think it needs to be replaced on the website with a new one or another one....

From what I've seen, they're not very active on this forum, but they're quite active on X. They update there almost regularly, so it wouldn't be right to say they've completely stopped communicating with the community but another thing I've noticed is that not only Reddit, but their Facebook link is also not working now. So at least the current social links on the website need to be updated. Otherwise new users can easily think that the project is no longer active.

I don't think so. Mentioning the wrong names will even be worse. However, I agree that mentioning "Coldcard is dead" will be a safer option. Sure, Coldcard case is very badly, most people won't trust anymore with the Coldcard wallets. By the way, marketing approach is quite tricky and sensitive. Any developer must be very careful to pay attention on every single of words. :)

I think their account were disabled by reddit previously, dunno if they've  rectified that. They're also on Instagram with 27 posts and their last post was on the 10th of August. They look more active on X, maybe X is more friendly and has a more active community.
They don't need to create new accounts and update links there, it's a business entity, it should have originality. Maybe they're working on rectifying the media handles. I think the inactive handles should be removed and only brought back when they're back up.

I just confirmed that they've been very active on X for the past 5 days, it gives hope that they're still actively working on the project, maybe they want more followers there that why they're keeping it active and they trust that the launched campaign in this forum would make them popular here before their launch that's why their representative isn't active here.

It's been a while since OP replied to me that it will be released "in a few weeks" (first page, July 11)
But I haven't seen any updates yet.

BTW, OP occasionally login. But this seem to be the reason why OP isn't engaging the latest replies:
Aside from the last line, most replies don't fall under any of those categories.

So it's not actual custom OS (based on Linux or BSD)? In that case,
1. what is planned OS supported by your Treasury app?
2. does the app also change some OS setting to make it more secure?

They are really active in X, and that makes me happy. True, these are mostly posts about the very idea of this project, but this is what promotes the idea in order to attract a larger audience with its ambition. And that's right, because that's exactly what X needs - to get the general idea across first, and then explain the details to those who want to. On the first page of our topic, I clicked on links leading to translated branches in local languages, but after a few clicks, I noticed that these links did not lead to anyone. Maybe we should translate the topic of the Lock topic and make these links relevant for those who would like to read about Lock in their native language?

It has been about two weeks since I applied for access, but I haven't received any email notification confirming my acceptance.
Have you received a reply?

It is likely that no one from the team reviewing new applications has been active here for a long time.
It would be good if they shared updates here from time to time.

Haha, what are you talking about, mate? You fail to understand the exact meaning of my sayings; the community of BTT can be different from the X one, right? So, how would I get to know any updates if anyone is not an active user of X? I appreciate that they are active on X, but they should update the same thing here in the BTT community to keep updated about the project's ongoing developments. So that the community can help them to report any further errors if any... Hopefully you may get my point this time.

As this project is very concerning, it is built to provide security to anyone's funds. So, I think staying active here should also be the first priority, as many members are still seeking replies from OP.

That's a good find, I did not know that they were active on X, but it is possible that they might have automated that, these days developers are working with automation, they don't have to dedicate their time on social media while they can spend the same time somewhere like working on the project to meet the deadline.

You can confirm if it is automated or not by comparing the posting schedule, if it is the same, then maybe it is automated or scheduled but it does not matter, they have to give us time although they are not required but as the discussion followed before and will in future we need answers but as I said before we all have to show some patience, they must be busy in developing the platform. Things like this can be solved later, not a big deal because Reddit usually gets banned like this so they have to buy an older one for this purpose or start from new with greater care.

New users might get the idea that the project is dead but as community we can do some work to not let that happen by answering their queries.

The account was online yesterday, maybe he should understand that people's curiosity about a new project is limitless. There are some technical questions That have been asked that is worth responding, even though it is not within his interest scope, it helps build engagement and prospective clients confidence. I'll leave it to him.


My major interest in this project as I've stated before is having a cold storage enabled wallet for my alt-coins, just like I have Electrum for my bitcoin. If the software can solve it and allow me go totally cold storage in crypto, then I would be glad. Meanwhile, I would be testing thoroughly with small amounts for a while and wait for community feedback before I can trust.

The project that ordered the signature campaign here on bitcointalk cannot be called dead in any way. Because there would be no point in paying for nothing for it. I went to the X Lock team and there is a post today that summarizes the meaning of all their posts for the month.
In general, he also carries the idea of Lock, which asks all Bitcoiners to think about maximizing the preservation of their bitcoins. And given today's realities, I agree with the guys that it is important not only to think about multiplying bitcoins on the negative side, but also to ensure that this balance does not become empty because hackers turned out to be smarter or because AI found a new loophole. It seems to me that the topic of crypto security has been especially loud in the last month.

Yeah, bro, I know the fact that in such a scenario patience is important.
And I also know that such bugs or errors can be improved later on, once the execution of the main idea is done. As such, bugs are very small in front of other complicated tasks. But my intention was just to mention this little bug here so that it can be improved later whenever the team notice this or gets time for it, right?

Welcome to the forum! I see you guys are taking the competition directly to hardware wallets, nice marketing stunt, but I hope you can prove it. it's opportunistic to leverage on the current ColdCard hack to market your product. Maybe you'll start attending to the numerous questions left unanswered in this thread to show proper client support.

You've made lots of claims your landing page and I'm interested in how you guys achieve quantum resistance and how your product encourages users to abandon hardware wallet, I've signed up for your wait-list, let's see what you ship us upon launch, I wish you well.

It was louder because of the ColdCard hack. This was still an eye opener to every wallet provider about the ability of AI-driven systems to spot vulnerabilities easily and place wallets at risk of being exploited. Over the last month, lots of bug fixes have been recorded across popular wallets like Trezoe, Ledger, Sparrow, Bitbox e.t.c and they've taken their internal audits and bug bounty programs more seriously. I believe 🔓 Lock is taking account of all these and are coming up with a special wallet package that would displace the HWs and back up their several claims of bringing a better solution to self-custody of digital assets.

Well, we have been seeing no response from madebylock on the forum for a long time. So I myself recently did some analysis on Lock.com, which is basically a project of Quantography Labs. So I am sharing with you what I found from my analysis,

In a normal hardware wallet, we have to buy a physical hardware device and depend on it. Lock.com removes this dependency. It converts the old or spare smartphone in your house into an air gapped signer. That is, you do not have to buy a new device. And the data transfer is done only through QR Code scanning (https://www.lock.com/#:~:text=Your%20private%20keys%20and%20seeds%20exist%20only%20on%20your%20dedicated%20offline%20Signer.%20The%20Wallet%20app%20securely%20sends%20unsigned%20transactions%20to%20the%20Signer%20via%20QR%2C%20Bluetooth%2C%20or%20local%20WiFi%2C%20receives%20them%20back%20signed%2C%20and%20broadcasts%20them%20via%20the%20Node.%20Zero%20internet%20contact%20for%20your%20core%20seed.). As a result, there is no direct digital communication between the online and offline devices. However, first you have to download the app from the internet to set up the offline device.

The thing is that you will have one device online with which you will mainly transact and another device will be completely offline which will mainly be used for approval (QR code). Just like we see in Google Authenticator.

That's right, I'm also sure that Lock should take into account absolutely all these fixes. I caught myself thinking today that we get news about AI audits almost every day now. And the news from OneKey and how they are testing Ledger, and the like. All this forces Bitcoiners to look for alternatives to hardware wallets. And Lock looks great because they even promise resistance against the quantum threat, protection from which has become a new trend this year. We all see how AI is developing rapidly, and I hope that in the future the Lock team will delight us with new announcements and succinct news.

I don't think they're sending out email notifications for acceptance, if you've already applied with your email to get early access then you're already on their list, incase you want to confirm try applying with same email, you'll get an indication saying "Thanks. You're on the list". There's also an indication under it that says "Comimg Q3 2026" maybe that's when they plan to launch fully so be patient and wait for them to fully launch their project.

You are right and I also never called them dead. As a matter of fact, you used the word dead, if they are paying the participants, they are doing it for a reason, no one has extra money to spend like this in high inflation like this.

Maybe you were not following the increase in the number of hacks in the DeFi sector, but it has started since the start of 2026. Every week or day, there was a new hack, I was reading all those hacks on the other forum, some of them were also reported here and in my local community too.

Those hacks were a lesson for Bitcoiners as well that we should do something about our security, instead of depending on a single kind of wallet we should use more, diversify our Bitcoins and hold them in different positions.

Did anyone notice that Lock claims to have a pretty interesting crypto backup system? Instead of the usual 12 or 24 word seed phrase, they are talking about using 256 universal emoji. These will be mapped to 42 languages, so even if the language changes, the original encoding of the backup will remain the same.

What is even more interesting is that they are combining this with 272 bit quantum safe entropy, so that the backup will be safe even against future quantum computers. The concept is quite futuristic but how strong its security is in reality remains to be seen.
https://i.bitlist.co/gom8nD1FAdMX.png

I think there is no fact that relates your research to their inactivity. Everything is already online for the public to understand, and for now, maybe the team may be busy developing the backend function to reduce the vulnerability. But thanks for sharing your research or opinion with us. You said it is making us independent of physical hardware devices, right? On this point, I would like to ask you some questions.

Does this mean we don't need to be more dependent on any other alternatives? And what do you think about the platform which is offering its service not owning any information as a medium of service provider? Is there any possibility that Lock will have any information regarding its users' data?

Since this is not fully released yet, I can't say for sure. But I will say that whether a user will take it as a complete option or not depends on his own Security Need. For a normal user like me, it might be a good option.

The main principle in the crypto world is "Don't trust, verify". However, since they are claiming this project as open code (https://www.lock.com/#:~:text=All%20rights%20reserved.-,Open%2Dcode.,-Free%20forever.) (don't know if open code and open source are the same) , there is a little trust in the field. Because any good programmer can verify their code later if they want.

You get that confirmation even from the first subscription, you don't need to try again to see it.

There's not really much need to inform you via email of your acceptance, although I view it as a hospitable approach. They'll most likely contact all subscribers via email when the software is out and might include a link to their official site to download the original version of it.

Lock comes with a different approach to wallet system and security. It would be revolutionary if they ship a great product and can convince the community to choose them instead. There was a time hardware wallets was able to convince investors to take their keys away from their regular devices, Lock can still bring a product that would encourage people to choose them. I'll still recommend Lock don't totally isolate themselves from hardware wallets, but have a option where people can use their hardware wallets to sign transactions using their software, it would help draw more people to their product.

Yeah, it's an interesting approach and I think if others have seen it, they'll consider to do the same thing. Although I don't know yet technicality which is better but, something new is welcomed to see if it will be better or not.

As long as it says that you're in the list, you should be fine.

I went back to take another look at Lock’s activity on X and I’d like to say that the earlier assumption that their account posts automatically is incorrect. They comment on crypto‑related events several times a day, leaving their responses under the news of other crypto communities and projects. Or they simply sometimes comment on the thoughts of Bitcoiners and traders. For example, right now it seems that there was a hack of Multiple Avici, and Lock.com is expressing sympathy for such situations in the comments. Indeed, I have the feeling that wallet and service hacks have become the new reality.

Yes, I was only trying to let him know that there's no need to worry if he's applied with his email and he would confirm by doing it with the same email to be given that indication i quoted."The project is still work in progress" so everyone should keep their cool till they officially launch, I know that the expectations are high based on the quality of security Lock is proposing.

If the emojis are similar, it will force users to keep digital backups, as writing the emoji names down on paper will be much more difficult.
it's entropy safe: 256 icons * 3 bits per icon = 768 bits of raw data. But how will this data be stored on a piece of paper?

Thanks for checking and confirming this all, but why are they not active here? I start to think they forgot their passwords or something, because if they are active there, they will feel a lot better and more progressive if they stay active here. Anyway, let's see what reason they have when they eventually come back to this thread, because either they will post an update here or they are not going to release anything at all, just the idea they wanted to sell.

I also feel like they are not going to meet their deadline for the wallet! Because so far I have heard no news, but only the marketing, which usually projects with no future make. I don't want them to end up like this one. Also, I am not saying their inactivity here is bad, but it is also not so good either. Anyway, there is nothing I want to hear from them that I can hear from their Twitter, but I just want an update on the project, that's it. If anyone can confirm that?

They’re still active on Twitter, but mostly about things related to Bitcoin price changes and future trends. And also about a few common crypto topics. But I think they’d be better off devoting more comments and posts to the topic of hardware wallet hacks — after all, this is happening quite often right now, and it’s a great time to offer the entire crypto community an alternative: the Lock.com product. Well, as for the announcements, have you noticed that the Lock.com website lists the announcement date as Q3 2026? Therefore, we can confidently say that we have an expected date for the presentation of their product!

The hacks we are seeing now are the negative sides of AI. Most loopholes in firmwares of hardawre wallets being compromised and software wallets loop-holes are all AI-driven bug detection being exploited. It's good these things are coming now and ColdCard is taking these into account prior to their launch, so they know areas constantly exploited and how to tighten security of their clients assets.

Gave this a thorough thought in the last few days. I think you might be able to get professionals willing to cooperate on this if you launch a bug detection bounty program, that is if you're not already running one that I'm not aware of.

After checking, both terms are not the same but somehow closely related. In open code, you don't have full access to any legal right or freedom. This also means you can just see the whole code; you can not modify or edit it. Whereas in open source, you have more limits, like you can edit or use the whole code to make another program as well.

But I truly don't know if in open code, any part or patch of the program can be restricted for the publich view as well. Maybe someone here knows the answer to this. Is it possible?

Yes, this is obtainable. Some software providers keep certain parts and patches of their software in private repositories for specific reasons

You may want to read this from Exodus
https://www.exodus.com/support/en/articles/8598678-is-exodus-open-source?

Then, I doubt that when anyone/programer uses open-source code to build a new program with a new idea and whatever changes they create or build in the software using open-source code, they may hide that part in the form of a patch and the rest of the code they may leave for the public to view. So, in such case how one can verify the security concern? In this case, one has to access the whole code of the program, in my point of view, so they can declare it a safe program after checking.

Exodus Wallet isn't open-source regardless of what their people claim or not. Unless something has changed, you can't build the binaries yourself using publicly available code. A partially open-source app, where some components are open-source while others aren't can't be classified as open-source software. Ledger used to do that and called themselves open-source. The firmware that runs on each hardware wallet of Ledger is closed-source. They conveniently avoid to mention this. Their native Ledger app and the coin apps that you need to install on your device are open-source, but that's not enough. When you consider the entire package, it's closed-source software.

It turns out that not all modern hacks and thefts from hardware wallets are related to AI these days. You may have heard that yesterday news came out about the largest lawsuit, worth 500 million, filed by victims of a long‑ago Ledger hack. And now the representatives of this hardware wallet will need to defend their reputation, even though there are many victims and huge sums were stolen from each of them. And all of this is due to a database hack in 2020. For the Lock team, this is another opportunity to remind the community about their new technological solution in comparison with “hardware” methods.

Yeah, actually we were differentiating between an open code and an open-source earlier and exodus happens to fall into the category of open code. Most essential components are hidden in private repositories, so we cannot call it open-source, but an open code, but I didn't see it as to be totally categorized as close source. However, another wave of thought have flashed through my mind while I read your write-up.

Is there such situation whereby a wallet provider making every component of their code base (including the binaries) public, but restricting the legal rights of it being reproduced? This is to be more precise in my categorization between open code and closed source.

I saw the newsflash in my notification panel during my off-screen time, I'll visit it later and revert. It is really worth discussing.

https://i.bitlist.co/w9OguZDExNQv.png

While checking my email today, I got an update from Lock.com. They recently had a meeting with security researchers and developers about self custody at the Berlin Blockchain Week. And that might be why they haven't been able to provide regular updates on this thread. When I first got the email I thought I might have gotten early access, but no it was just an update. But even though it's not a huge update, the team is actually interacting with the community at various events, which is nice. Now let's see what kind of updates they come up with for their software.

The Exodus Wallet belongs to the category of closed-source software. If you can't build it from source and you can't use the codebase freely, it's closed-source.

What you are describing is the way Coldcard works. Their code is publicly verifiable but they don't have an open-source license. So even if the code is there for public scrutiny, it doesn't fulfil the criteria to be called open-source. You can't use their codebase, add to it, and create your own product. However, you can do that with Trezor's code if you wanted to. That's because Trezor, unlike Coldcard, is open-source software.

I received an email from the team. I used AI to compare why they are promoting that their wallet will be better than a hardware wallet. I am posting a screenshot of what the team is building differently. I am not so much into wallets and their logic. I request those who are good with it to look into the comparison sheet.

---

https://talkimg.com/images/2026/09/04/Ue3Y0Z.jpg (https://talkimg.com/image/Ue3Y0Z)

---

I have included a direct link to the screenshot. Clicking it will take you to the detailed image since the width of the screenshot is quite large.

Hmm, email? But for what purpose?
Did you also join their early access at the initial stage? Because if you received an email regarding this matter, than i have not received any email till now. Because I had also requested/joined early access a long time ago. Can you tell me something more about what the email was about?

None of that matters until and unless Bitcoin's consensus changes to adopt the post-quantum signatures that Lock.com wants to work with. Lock can make their software safer but they can't get rid of ECDSA on their own and have those changes apply to the entire network. Bitcoin right now doesn't know what to do with their ML-DSA signature scheme and won't recognize it. Even if Lock.com is or becomes quantum-safe tomorrow, the Bitcoin network isn't because it relies on legacy signatures that aren't quantum-safe. Lock's developers, staff, whatever... can say whatever they want, but if they want to send bitcoin on the Bitcoin blockchain today, they can only do so by using legacy signature schemes and not post-quantum ones.

Yes, I did, and if you are using Gmail, then check the Promotions tab. I saw that mail there.
Your reply gives me a clear understanding what actually is being promoted and the reality. Thanks for the deep dive into the comparison table.

That’s a good point. the term usually implies that the wallet is quantum-safe unlike standard hardware wallets, meaning the client's funds are secure on their end. I still don't understand how new seed will be stored, given that their current system makes it difficult to write down on paper.

You still need strong foundations and that's the blockchain. If there will ever be a quantum threat, it's the blockchain that needs to be made robust. A quantum attacker isn't going to try to break the security of your Lock.com wallet. They don't need to if the network protecting your stash, my stash, and all other bitcoins isn't secure.

So everyone who gave their email for early access received the same email. Thanks for sharing it here, otherwise many might not have noticed it. They gave important details about their timeline, and these updates are important for the community to know where the project currently stands.

---

Their Berlin presence is really very meaningful, because they need investors, that's what they are telling us, and these events can bring them great exposure because these events in just one week can help them build great relationships within the developer community rather than just marketing to retail investors.

The real talks always happen over coffee, not on stage. In this industry, most of these collaborations are also formed in informal settings.
It's great to know that they have made some partnerships as well, because this transparency will determine the confidence.

I also checked my email and received the same email so it's for all of those who have been listed for the early access. Will wait for further updates about the product itself and I think that we'll have it in a couple of weeks on how it goes after all of these participations they went.

I had signed up for early access quite a while ago, but I received an email on September 4th.
The content of the email was a promotion for Lock.com; I didn't receive any notification confirming my inclusion in the early access program.
I have started following the Twitter account.
Since I received the promotional email, I assume I'll get emails about early access and the like from now on. For the time being, that is the only communication I've received.

[UPDATE] Lock beta status and answers to the main technical questions

Hi all,

There have been a lot of thoughtful questions in this thread, particularly around the signing boundary, comparisons with offline Electrum, the scope of our post-quantum claims, and how the architecture will be validated.

The team has been focused on moving Lock into beta and internal testing, so this is a good point to bring the main answers together and provide a current status update.

CURRENT STATUS

Lock is now in beta and internal testing, with early access coming shortly.

The rollout is planned in stages:

• Wallet and Treasury first
• Node following soon after

This is a release sequence rather than a change to the reference architecture. Lock remains designed around three cooperating roles: Treasury, Wallet, and Node.

The exact operating-system and CPU architecture matrix for the first packaged release is still being finalised. We will publish that once the release builds are locked.

We also do not currently support Bitcoin testnet3 or testnet4.

Several people here asked for Bitcoin testnet support because they understandably do not want to evaluate preview wallet software with mainnet funds. That is a useful point, and we want to be clear about the current limitation.

WHAT TREASURY ACTUALLY IS

Some of the earlier discussion used the phrase "Treasury OS", which has created an understandable impression that Lock is developing a new operating system.

That is not the architecture.

Treasury is the signing application and security boundary. In the intended high-security deployment, it runs on commodity hardware as a dedicated air-gapped or internet-isolated signing device.

It uses the underlying operating system and the protections available on that platform. The implementation includes platform-specific hardening paths for Windows, macOS, and Linux, including process and debugger restrictions, core-dump controls, machine-bound key protection, and, where configured, a separate Vault daemon running under another OS user.

Lock is therefore not attempting to build and maintain its own kernel, hardware drivers, or general-purpose operating system across arbitrary devices.

There is also an important distinction between air-gapped and internet-isolated use.

A fully air-gapped Treasury uses a deliberate physical transfer workflow. An internet-isolated Treasury may communicate over a constrained local or physical transport while remaining unable to make general public-network requests.

In Lock's default strict-egress posture, Treasury does not call public blockchain RPCs or other public internet services. Those network-facing responsibilities sit outside the signing boundary.

Treasury can still accept an approved Wallet connection over Lock's authenticated and encrypted protocol. The transport moves the data; the application protocol establishes the trusted session.

The aim is not to claim that an offline device is invulnerable. Removing public-network access greatly reduces the remotely reachable attack surface, but privileged compromise, malicious firmware, kernel or hypervisor attacks, physical access, side channels, and poor recovery practices remain relevant.

The security objective is containment and a smaller blast radius.

WHAT WE MEAN BY A "SMALL" TREASURY

When we describe Treasury as small, the important property is not a tiny line count.

The more precise word is narrow.

Treasury owns seed handling, key derivation, signing policy, and signing. Those are substantial responsibilities and there is meaningful implementation behind them.

What Treasury does not need to own is equally important.

Public RPC integrations, provider aggregation, market data, transaction tracking, and the other noisy network-facing systems live outside it. The Node is the largest subsystem in Lock because it absorbs most of that public blockchain complexity.

The objective is to keep seed-dependent operations within the smallest practical privilege and trust boundary.

The current whitepaper does not publish a Treasury-only line count, so we are not presenting one.

HOW THIS COMPARES WITH OFFLINE ELECTRUM

A Bitcoin-only setup using an offline Electrum signer and a separate online watch-only wallet is already a strong custody model.

Lock is not based on the premise that this setup is ineffective.

The difference is the surface over which Lock is trying to preserve the same general isolation principle.

The architecture separates:

• Treasury: seed storage, derivation, signing policy, and signatures
• Node: public-chain connectivity, providers, tracking, and other network-facing work
• Wallet: presentation, orchestration, and user intent
• Vault daemon: optional additional isolation of the device key under a separate OS user

In the high-security deployment, Treasury can live on a dedicated device while Wallet and Node remain outside the signing boundary.

That becomes particularly relevant for users who want active self-custody across a broader surface: multiple chains, swaps, bridges, Lightning, messaging, storage, and smart-contract interactions.

The goal is to prevent those additional functions from gradually pulling the seed into the same environment that handles the everyday interface and public network.

For someone who only needs Bitcoin cold storage and already operates an offline Electrum setup correctly, Lock has to earn its place through the released product rather than through an architectural slogan.

DOES LOCK MAKE HARDWARE WALLETS OBSOLETE?

Our thesis is that, for a meaningful share of active self-custody, an isolated software Treasury running on a dedicated device can replace reliance on a proprietary hardware-signing peripheral.

That does not mean every hardware wallet is insecure or no longer useful.

Hardware wallets solved a real problem and remain an effective way to narrow key-extraction risk, particularly when the user wants a simple and well-understood signing device.

Lock is testing a broader custody model in which key isolation is combined with:

• Separate signing, UI, and network roles
• Signing policy and parameter limits
• Public-network isolation for Treasury
• Authenticated communication between components
• Signed update verification
• Optional Vault isolation of the device key

Within that model, "safer" has a specific meaning:

• Compromising the Wallet should not directly expose the seed
• Compromising the Node should not by itself authorise a spend
• Compromising a transport should not reveal signing keys

Those boundaries do not make every component harmless when compromised.

A fully compromised and already-authorised Treasury remains dangerous. If an attacker extracts the seed itself, Lock's signing policy cannot stop it being used outside Lock.

The architecture is designed to force an attacker across several boundaries rather than allow one compromised component to inherit every secret and authority.

OPEN CODE, TESTING, AND INDEPENDENT REVIEW

Another important distinction raised in the thread is the difference between code being available and code being independently audited.

Nobody should be expected to personally review an entire wallet codebase before using it.

The Lock whitepaper is an implementation-authored description of the system, its trust boundaries, and its known limitations. It is not an independent security audit, and it is not a formal isolation proof.

The tests described in the paper establish particular invariants under particular conditions. They complement, rather than replace:

• Independent security review
• Hostile-host testing
• Fault injection
• Live-network interoperability testing
• Operational security assessment

We are currently selecting independent audit partners.

Once internal testing is complete, we will update the public repository. Repository and licensing details will be published alongside that update.

The security argument has to be supported by inspectable implementation, reproducible testing, and external scrutiny.

WHAT "QUANTUM-SAFE" MEANS IN LOCK

Lock does not make Bitcoin, Ethereum, Solana, or any other existing blockchain quantum-safe.

On-chain transaction signatures remain whatever each blockchain's wire format and consensus rules currently require.

The cryptography Lock can control is its own internal and off-chain protocol layer.

Selected Lock-controlled paths use hybrid classical and post-quantum constructions:

• X25519 + ML-KEM-768 for hybrid key establishment
• Ed25519 + ML-DSA-65 for hybrid digital signatures

Under the intended constructions, defeating only the classical component or only the post-quantum component is insufficient.

The whitepaper applies these hybrid primitives to long-lived Lock-controlled surfaces including Wallet-to-Treasury and Wallet-to-Node channels, selected authentication paths, and chat envelopes.

SLH-DSA is also implemented as a separate stateless hash-based signature option. It is deliberately standalone rather than paired with a classical signature.

The term "quantum-safe" therefore applies to selected Lock-controlled off-chain protocols.

It does not mean:

• Every cryptographic operation in Lock is hybrid
• Existing blockchains have become quantum-safe
• Endpoint compromise is no longer relevant
• Recovery risk has disappeared
• Lock is "quantum-proof"

WHAT HAPPENS IF BITCOIN'S CRYPTOGRAPHY IS BROKEN?

That remains a Bitcoin-level migration problem.

Lock cannot independently change Bitcoin's consensus signature scheme.

If a sufficiently capable quantum computer made secp256k1 practically breakable before Bitcoin migrated to a resistant signature system, affected funds would inherit that chain-level risk regardless of which wallet produced the transaction.

Lock can protect the communications and protocol identities whose cryptography it controls.

It cannot override the cryptographic rules of an external blockchain.

That boundary is deliberate and is stated explicitly in the whitepaper.

THE UNIVERSAL QUANTUM SEED

UQS addresses a different part of the long-term security model: generation, transcription, and recovery of the wallet's root seed.

The 36-word UQS format encodes 272 bits of entropy and includes a 16-bit checksum.

Its derivation pipeline is:


The operating-system CSPRNG is the security floor.

Timing measurements, scheduling jitter, and optional user input provide supplemental diversity. They are not treated as seven independently strong entropy guarantees.

UQS uses 256 visual icons mapped consistently across 42 language tables. The same icon sequence can therefore be recognised and re-entered through different localised labels.

Recovery does not depend on a Lock server.

The seed backup is the recovery root. The machine-bound device key protects local state, but it is not the user's ultimate backup. If the local device protection is lost, the intended recovery path is to restore from the seed and rebuild the protected local state.

Lock also supports importing conforming BIP-39 seeds.

UQS is not based on a claim that properly generated BIP-39 seeds are suddenly unsafe or that existing users need to migrate immediately.

It is a more conservative default chosen for newly created Lock wallets.

BIP-39 also has a much more mature ecosystem of independent recovery tools. As UQS documentation and tooling are published, independent recovery and interoperability will need to be part of its review.

WHERE WE ARE NOW

To bring the current position together:

• Lock is in beta and internal testing
• Early access is coming shortly
• Wallet and Treasury are planned to launch first
• Node will follow soon after
• Bitcoin testnet is not currently supported
• The exact first-release OS and CPU matrix is still being finalised
• Independent audit partners are currently being selected
• The public repository will be updated after internal testing
• The whitepaper documents the implementation and its trust assumptions; it is not an independent audit

We will also keep this thread updated directly as the beta, documentation, repository, and review process progress.

Please keep challenging the assumptions and the boundaries. That is why we brought the architecture here before release.

Cheers,

Lock

I also left my email in the field for early access testers on their website, but I haven't received any email yet. Although it seems to me that it would be logical to receive an answer: "your application will be reviewed as soon as a new stage of wallet testing begins. It is possible that you will participate." I was calm, knowing that my application had worked. Well, it's okay, we'll wait until we get letters about approved testing applications in the third quarter of this year. Who knows, maybe we'll be the ones who stand at the threshold of something great. I personally love being a beta tester. This feeling of being a pioneer is always exciting and wonderful.


Wow, guys! We so glad to see your post!  :o

Thanks for this follow-up on your older reply.

So basically, the difference is; Lock is "modular" using only the necessary features that it needs in each specific device, no more no less;
while Electrum has to use the full binary even in the air-gap machine where its other features aren't required.

Honestly,
It's not something that will make me switch my existing setup but its other features are worth checking out.

Thanks for the update team. The whole concept is very easy and hard at the same time. I understand the architecture, but I hope the final product is simple enough that a non-technical person can actually use it

I understand the main components, and the most important one is treasury, so not that everything you said is hard, but just asking, can a teenager be able to understand it all?

For treasury, you are not depending on any kind of hardware wallet, so let's see how it turns out to be. I am excited. Transparency about the audit makes me believe it even more. I can see it becoming either something too big or at least not too small. The concept of the whole thing is understandable. What I tried to say in the start is that I hope it turns out to be user friendly.
Also did any of the investors on that event asked this question? Asking for a friend  ;)

This is a misinterpretation of the email, lock was only sharing insights from their meetups with builders, security researchers and blockchain experts in Berlin, Germany. They had several discussions on the future of blockchains when quantum threats becomes very real, they were just sharing their findings on the best possible approach.

Lock is positioning itself to contain quantum computing threats and not trying to change bitcoin blockchain or trying to do away with ECDSA ahead of bitcoin or all of that. Lock is more about better protecting access to user funds from within the wallet and positioning itself to quickly adapt to quantum threats, that should be the unique niche they project, more like preparing critically for the future from the present. They have made it clear that they're not guaranteeing to protect funds from blockchain limitations.

It is more secure than the current 12-word BIP system; however the 36-word UQS visual icon format implies that the seed backup must be stored digitally. Is there any way to write it down on a piece of paper, or must it be kept in digital form?

Oh, my bad. Checking on it later, I found my mail in the spam folder; it was not in the Promotions section.


Are you still looking for your email? Check your spam box. Maybe, just like me, your missed email is in the spam box section.

---

Other than this is feels better to see the team respond to all those queries that members have been asking for a long time.

We know that the recent Trezor data breach exposed the names and home addresses of 81,000 users (https://www.infosecurity-magazine.com/news/trezor-supply-chain-breach-impacts/), which could pose a serious risk of physical attacks. In this regard, Lock model is great because you can use your old device as a hardware wallet. And since the code will be open, there is no fear of physical address leaks.

Since you mentioned that UQS needs to develop an independent recovery ecosystem. This means we don't have to depend on any third-party tools, we can recover it ourselves.

The legal prospects for such cases are very slim, but perhaps the company will agree to pay compensation to prevent the case from dragging on for years and tarnishing Ledger's reputation. In the US, 95% of such cases typically result in compensation.


And in this project it would be interesting to see a working solution.

I've carefully read the entire discussion. As I understand it, Lock's architecture is designed to support Lightning without exposing the private key to the network-facing component. What I still don't understand from the discussion is how Lightning state will be stored and updated securely. madebylock, could you explain this in more detail?

I'm interested on this as well.
Good question, it's a very small detail in the updated answers but a big question if it's feasible.

Unless it'll be handled by a third-party or custodial setup,
The common way to achieve this in a self-custodial way is to either require the treasury every time the user needs to use their channel(s),
Or to derive an extended private key from the master private key at a specific derivation path that'll be used for lightning network.
But the latter defeats the purpose of an air-gap setup (at least on the LN side) even though the master prvKey is still safely stored there.