Krux DIY Hardware Wallet (Unofficial)

[dkbit98]

Krux wallet is turning any M5StickV device into an airgapped hardware wallet.
I knew before that M5Sticks are great for making DIY wallets like this but just now I noticed model M5StickV that is great because it has built in camera and battery, and there is no WiFi or Bluetooth connection.
It is fully Open Source, written in MicroPython and it is using QR codes for communication with other devices.
This is still fully functional wallet but it is still in alpha testing so please report any bugs you notice to developer or his Krux github page.
Krux wallet is not generating seed words so this should be done manually offline and you can import them yourself or with QR code.

Shopping list:

 - M5StickV ~ $30 - $50 (included with screen, camera, buttons and battery)
 - MicroSD card

Code:

 - Krux Wallet github (by Jeff jreesun )
 - Firmware, Requirements, Building, Installing

Website with step by step installation guide:
https://selfcustody.github.io/krux/

For support installing, using Krux wallet or any other questions you can visit https://matrix.to/#/#krux:matrix.org

Krux Android App for testing:
https://github.com/odudex/krux_binaries/tree/main/Android

Use at your own risk and only store coins you are willing to lose!

[The Sceptical Chymist]

Lol:



And though this might just be a standard disclaimer, why would I go with a product with some code with this warning:

WARNING: While functional, this is currently alpha-quality software and could have bugs or other issues that might cause you to lose your coins. Use at your own risk!

...when for about the same price I could buy a Trezor or Ledger?

On a positive note, it is very small and doesn't look like a standard HW wallet.  On the other hand, from the pictures it looks rather cheaply-made.  I'm not at all familiar with M5Stack, so I could be wrong.  Am I wrong?

[dkbit98]

And though this might just be a standard disclaimer, why would I go with a product with some code with this warning

Product or M5StickV device is working perfectly and it's unrelated with code that is still in early testing and just recently released.

On a positive note, it is very small and doesn't look like a standard HW wallet.  On the other hand, from the pictures it looks rather cheaply-made.  I'm not at all familiar with M5Stack, so I could be wrong.  Am I wrong?

Don't look just picture but look at link and specs, for me ledger wallet looks very cheap especially when you open it and see all the junk that is inside, but M5StickV is similar if not exactly the same device like Blockstream Jade wallet is using for their hardware wallet.
It can be used for multiple purposes as mini computer and not only as hardware wallet, and it has camera for QR codes, something that trezor or ledger don't have.

[NeuroticFish]

...when for about the same price I could buy a Trezor or Ledger?

Since Ledger/Trezor is not available in certain countries or there could be trust issues there, with this kind of setup you should be basically risk free.
Although indeed that warning is somewhat concerning... (I'm not sure what are the actual risks though if one did save the seed properly; are there any?!)

[The Sceptical Chymist]

Product or M5StickV device is working perfectly and it's unrelated with code that is still in early testing and just recently released.

Yes, but without that code that's still in early testing, the device won't be a HW wallet at all.  It's precisely that code that makes this thing suitable for a thread in this section, right?

Don't look just picture but look at link and specs, for me ledger wallet looks very cheap especially when you open it and see all the junk that is inside

I did see the specs and all the cool things the M5StickV K210 can do, but when I said it looks cheaply-made, I mean the plastic shell looks cheap.  It could be a great camera and mini Raspberry Pi-type of device, but I just don't like the look of it--and that's my opinion.  Then again, there doesn't seem to be a way to zoom in on the pictures so I can't tell with any great detail how the finish of the shell actually looks but it does look like cheap plastic.  

And as always I respect your opinion about Ledger products, even if I disagree with you.  We all have different tastes.  Have you ordered one of these, by the way?  I'd love to see some high resolution pics and hear a review about its utility as a HW wallet.  

Since Ledger/Trezor is not available in certain countries or there could be trust issues there, with this kind of setup you should be basically risk free.

Are those two brands specifically prohibited in certain countries or are HW wallets in general prohibited?  If it's the latter, then owning this device--even though it's not officially a HW wallet--would be kind of risky, wouldn't it?  Also, I know this is straying from the topic, but what countries have banned HW wallets?

[Pmalek]

Judging by the address at the bottom of the page, these products are shipped out of China. When you order it in the EU you will likely be required to pay VAT as well.
It's a bit of a letdown that a product meant to store cryptocurrencies doesn't accept crypto as one of its payment methods, but they aren't the only ones. Apparently they only take PayPal and credit cards. 

[dkbit98]

Have you ordered one of these, by the way?  I'd love to see some high resolution pics and hear a review about its utility as a HW wallet.

No, I ordered other similar ESP32 device but I am to lazy during summertime to load and install firmware with everything else on it and do some testing and reviews.
I was thinking of ordering similar M5Stick device that was much cheaper but it didn't have camera or battery.
This DIY projects are not meant for keeping large amounts of coins, but they are more of better version of wallet than keeping coins on some mobile device.

[NeuroticFish]

Since Ledger/Trezor is not available in certain countries or there could be trust issues there, with this kind of setup you should be basically risk free.

Are those two brands specifically prohibited in certain countries or are HW wallets in general prohibited?  If it's the latter, then owning this device--even though it's not officially a HW wallet--would be kind of risky, wouldn't it?  Also, I know this is straying from the topic, but what countries have banned HW wallets?

I think that it was about not being available (no way to buy it, no resellers, nothing), not straight banned.
There was a thread from a guy (iirc he was from Arabia somewhere) who had this issue and wanted a solution.

The problem is that a HW I would not buy from just anybody. It has to be the producer or a certified reseller.
On the other hand, this hind of hardware may be safe since you flash it yourself with the software you probably check first.

Judging by the address at the bottom of the page, these products are shipped out of China.

Indeed, AliExpress has its share of M5Stack sellers, so it's most probably from China.

>>>
And while it's not a HW per se, it's actually a development kit, like RasPi or Arduino, it seems to have all you need to build something with HW capabilities off it.

[LoyceV]

Since Ledger/Trezor is not available in certain countries or there could be trust issues there, with this kind of setup you should be basically risk free.

If that would be the case, I'd rather use an old netbook, they're cheap and much more versatile. Take out the Wifi module if needed, and install anything you want offline.

On the other hand, this hind of hardware may be safe since you flash it yourself with the software you probably check first.

Again: I'd trust a standard netbook with standard Linux distribution more, especially when kept offline. If USB cables can be used to access your computer, how long will it takes before "offline" devices come with their own hidden internet connection?

[NeuroticFish]

Again: I'd trust a standard netbook with standard Linux distribution more, especially when kept offline. If USB cables can be used to access your computer, how long will it takes before "offline" devices come with their own hidden internet connection?

It's not even needed to have an old notebook. An USB stick with Tails OS and a few reboots actually can do all you need for pretty much all the safety you need and an easy to use cold storage.
But some do prefer the convenience of HW, some do prefer to use it together with their smartphone, ... and this kind of setup may be OK for them.

And those devices can have their own "hidden" internet only if they get connected through wires (which you should clearly not do) or you enter there your WiFi password (which would be even more stupid to do).

[LoyceV]

a few reboots ~ easy to use cold storage

In my experience, those requirements don't work well together. I've spent a lot of time creating and signing a transaction offline, and ran into several problems (wrong version of Electrum and later a fee of less than 1 sat/byte). It took a while to get it all right, and considering how little I do this, I already forgot which Live CD eventually worked.

I do have spare netbooks though, but they're old (1GB) and slow, and I never set them up for offline usage.

But some do prefer the convenience of HW, some do prefer to use it together with their smartphone, ... and this kind of setup may be OK for them.

I'm not very fond of hardware wallets either, but it does the job and is a lot more n00b friendly (until they enter their seed words on a phishing site).

And those devices can have their own "hidden" internet only if they get connected through wires (which you should clearly not do) or you enter there your WiFi password (which would be even more stupid to do).

Until they come with their own data connection. Prepaid data isn't that expensive anymore, and could be worth it in a targeted attack. People have already been sent fake hardware wallets by post.

[NeuroticFish]

In my experience, those requirements don't work well together. I've spent a lot of time creating and signing a transaction offline, and ran into several problems (wrong version of Electrum and later a fee of less than 1 sat/byte). It took a while to get it all right, and considering how little I do this, I already forgot which Live CD eventually worked.

I've done that successfully for a short while before moving to the convenience of a proper HW.
After writing the latest Tails OS onto the USB stick it's all good, no need to look for "what was the CD"? Or at least for me that was it all.

I do have spare netbooks though, but they're old (1GB) and slow, and I never set them up for offline usage.

  and here comes the difference. While I do have plenty of spare USB sticks, I literally have no old laptop for this. My oldest laptop (12 years old) got a RAM update and was used lately by my kids even for online school.

(until they enter their seed words on a phishing site).

LOL!
Those who don't read the very basics do deserve their fate though...

Until they come with their own data connection. Prepaid data isn't that expensive anymore, and could be worth it in a targeted attack. People have already been sent fake hardware wallets by post.

I've read about the fake ledgers on bitcointalk. I don't think though that general purpose development devices like this worth such an attack, since the vast majority will not be used as HW.

It's fun as hobby, but creating your own Jade (Blockstream's hardware wallet) is more practical. Jade also use similar hardware (on price and physical size), but the source code available for free and thoughtfully tested.

Imho the more the variety to choose from, the better. I expect Jade be less easy to buy than this M5StickV in some countries.

[SFR10]

and it has camera for QR codes, something that trezor or ledger don't have.

You're right but after watching the following "video", I'm not convinced that feature would be usable for those with a slight hand tremor...

<sup>- I never had a device with an OV7740 sensor but I think it'd take a while before someone can successfully scan a Qr code with its camera.
- Sorry for nitpicking [I do know it's just a $50 product], but I expected a little more after seeing they've doubled its price [it used to be only "$26.50"].</sup>

[dkbit98]

It's fun as hobby, but creating your own Jade (Blockstream's hardware wallet) is more practical. Jade also use similar hardware (on price and physical size), but the source code available for free and thoughtfully tested.

Yes, I think they are using exact same device as Jade wallet, but one problem with Jade code is that some people don't like their pin code connected with their server.
Krux would be alternative for that but I would wait few weeks or months for some code audits and reviews.

I'm not very fond of hardware wallets either, but it does the job and is a lot more n00b friendly (until they enter their seed words on a phishing site).

Or until scammers send you modified ''free gift'' fake device, because your address got leaked in one of ledger leaks (true story) 

[jreesun]

Hey all, I'm the author of Krux. I noticed some traffic coming from here on GitHub and was pleasantly surprised to find this post.  Thank you, dkbit98, for the write-up!

I wanted to answer some questions that were brought up in this thread and shed more light on the project in general.

First of all, I'd like to be clear that this project isn't associated with the company (M5Stack) that makes the M5StickV. They make a bunch of embedded devices, of which the M5StickV is one. From what I gather, M5Stack is sort of like the Chinese for-profit version of the Raspberry Pi Foundation.

Krux is "just" custom firmware and software I wrote for the device to turn it into a hardware wallet. I was in the market for a DIY multisig device and came across cool projects like SeedSigner (for the Pi Zero) and Specter-DIY, but ultimately decided that I wanted to try making my own after I came across the M5StickV on Adafruit. It seemed ripe for being turned into a hardware wallet with all it had packed into it, especially for the price point ($30-$50 depending on which distributor you buy it from).

So, I got to work, used the embit (embedded bitcoin) micropython library for bitcoin-related logic, wrote an interface on top of it, and got my hands dirty making QR codes (and everything else) work.

This started as a side project that morphed into something I thought was pretty cool and had the potential to be more widely useful, so here we are. I made the repo public a few days ago and haven't had any audits done (not opposed, but I don't think I could afford it), let alone another software engineer's eyes. That's the reason for the scary-sounding disclaimer for now; I don't want my hobby project to be the reason someone loses their money. But it does work!

I never had a device with an OV7740 sensor but I think it'd take a while before someone can successfully scan a Qr code with its camera.

This is actually rather fast so long as the QR code is flat and not changing too rapidly. For some reference, it can handle reading the animated QR codes that Specter Desktop generates, which I believe change every 500ms. I did have to do some work here to speed things up and improve accuracy such as capturing in grayscale at a lower resolution and converting to a binary black/white image for processing. Fun problem to solve. The display shows the processed image, so you can see the world in black and white [insert maximalist joke here].

The more difficult part was making QR codes fit the tiny display and still be readable by other devices (webcams). It generates its own animated QR codes to solve for this. Alternatively, you can also hook up an Adafruit thermal printer to it and print out the QR codes to pack more data into them (thus generating fewer).

Printing is a useful feature in general: it lets you make physical backups of your seed phrase, print out signed PSBTs (that you could mail if you wanted), etc. There's a section on the README about it if anyone's interested. It adds to the cost, but just another $50.

Then again, there doesn't seem to be a way to zoom in on the pictures so I can't tell with any great detail how the finish of the shell actually looks but it does look like cheap plastic.

Not sure what your criteria are to consider something "cheap plastic," but it feels solid to me. You'd have to be trying to break it in order to break it. It seems to be two pieces (front and back) of injection molded plastic snapped and screwed together.

I am to lazy during summertime to load and install firmware with everything else on it and do some testing and reviews.

For anyone reading this, just want to mention that I added a Dockerfile to handle the process of building the firmware so that anyone with Docker and Python 3 installed should be able to do this now. Ideally, I would have liked for Docker to be the only requirement, but passing through USB serial devices from the host into Docker seems to be hard to do. So for now, Docker builds the firmware, and the Python scripts you invoke directly load the firmware (a binary file that resides in the Docker image) and the software (all contents under 'src').

Hope that helped. I'll check this thread periodically and try to answer what I can!

[dkbit98]

Hey all, I'm the author of Krux. I noticed some traffic coming from here on GitHub and was pleasantly surprised to find this post.  Smiley Thank you, dkbit98, for the write-up!

Hi jreesun,
I am glad you found the source of traffic, joined Bitcointalk forum, and I hope you will stick around as we need more genuine users like you.

One question for you, have you checked Blockstream Jade hardware wallet and can you confirm it is using exactly the same M5StickV device as Krux wallet?
https://blockstream.com/jade/

[jreesun]

Hey all, I'm the author of Krux. I noticed some traffic coming from here on GitHub and was pleasantly surprised to find this post.  Smiley Thank you, dkbit98, for the write-up!

Hi jreesun,
I am glad you found the source of traffic, joined Bitcointalk forum, and I hope you will stick around as we need more genuine users like you.

One question for you, have you checked Blockstream Jade hardware wallet and can you confirm it is using exactly the same M5StickV device as Krux wallet?
https://blockstream.com/jade/

Wow! I honestly had no idea that existed until now. There's certainly an uncanny resemblance, but upon closer inspection there do appear to be some (minor) differences:
1. Their case is (obviously) custom and isn't the same one that the M5StickV uses. Their case also appears to be longer, and the front button is in a different location.
2. The specs of the two devices are similar but seem to be very slightly different: the Jade has Bluetooth, the M5StickV does not. Also, their battery is 240mAh, whereas the M5StickV is 200mAh. Maybe this is why their case is longer?

Looking at their code, they don't seem to be using MaixPy at all (M5Stack's version of Micropython), but rather are building on top of the Espressif IoT Development Framework.

Their hardware folder contains this:
https://github.com/Blockstream/Jade/blob/master/hardware/Jade_v1_schematics.pdf

It says "M5 Bitcoin Pocket," so I'm guessing it's a custom M5 product that is obviously extremely similar to the M5StickV with minor differences?

[dkbit98]

Wow! I honestly had no idea that existed until now. There's certainly an uncanny resemblance, but upon closer inspection there do appear to be some (minor) differences:
1. Their case is (obviously) custom and isn't the same one that the M5StickV uses. Their case also appears to be longer, and the front button is in a different location.
2. The specs of the two devices are similar but seem to be very slightly different: the Jade has Bluetooth, the M5StickV does not. Also, their battery is 240mAh, whereas the M5StickV is 200mAh. Maybe this is why their case is longer?

It's easy to 3d print custom case and I even found Jade cad STL file on github.
There are even cheaper devices like M5StickC ESP32 for less than $14 but they are basic model and they don't have camera integrated.
One more DIY wallet with similar concept like yours is Bowser wallet made by arcbtc.

It says "M5 Bitcoin Pocket," so I'm guessing it's a custom M5 product that is obviously extremely similar to the M5StickV with minor differences?

There are obviously small differences in devices and batteries, but I guess in theory your code for Krux wallet could work perfectly fine even on Jade hardware wallet, and it is currently a bit cheaper than M5StickV.

[jreesun]

There are obviously small differences in devices and batteries, but I guess in theory your code for Krux wallet could work perfectly fine even on Jade hardware wallet, and it is currently a bit cheaper than M5StickV.

Yes, I see what you mean! That would be a cool thing to test. If it works, that could be a good source of ~$40 devices if there ends up being limited availability of the M5StickV. It would also be a good way to continue supporting Blockstream's efforts

That said, there are quite a few distributors of the M5StickV that I thought I would list here. You don't have to buy it directly from the M5Stack shop. The average price across all of them is also around $40:

https://www.adafruit.com/product/4321
https://www.mouser.com/ProductDetail/Adafruit/4321
https://www.digikey.com/en/products/detail/m5stack-technology-co-ltd/K027/10492135
https://leeselectronic.com/en/product/169940-m5stick-ai-camera-kendryte-k210-risc-v-core-no-wifi.html
https://www.cytron.io/c-development-tools/c-fpga/p-m5stickv-k210-ai-camera-without-wifi
https://shop.pimoroni.com/products/m5stick-v-k210-ai-camera-without-wifi
https://www.okdo.com/p/m5stickv-k210-ai-camera-without-wifi/

[kkdao]

Lol:

https://i.imgur.com/fuKjuiC.png

And though this might just be a standard disclaimer, why would I go with a product with some code with this warning:

WARNING: While functional, this is currently alpha-quality software and could have bugs or other issues that might cause you to lose your coins. Use at your own risk!

...when for about the same price I could buy a Trezor or Ledger?

On a positive note, it is very small and doesn't look like a standard HW wallet.  On the other hand, from the pictures it looks rather cheaply-made.  I'm not at all familiar with M5Stack, so I could be wrong.  Am I wrong?

is that the m5stack website? depending where you are, try digikey, mouser, farnell, aliexpress, etc. they are almost always in stock somewhere.