🔥 [ANN] Specter Enclave – Secure Enclave + Touch ID Bitcoin Wallet for macOS

[cryptopendevelopment]

If you’re on macOS and still using a single-sig hot wallet… I’ve got bad news for you.

🚀 Introducing: Specter Enclave
A new open-source wallet designed from scratch to turn your MacBook into a hardware-level cosigner — no USB gadgets required.

✅ Default: 2-of-3 Multisig
✅ Your Mac = signer w/ Touch ID
✅ Private key stored in Secure Enclave (never exportable)
✅ Works fully offline via PSBT, NFC, QR
✅ MIT Licensed – auditable, forkable, minimal codebase

🔐 How It Works

• Private key is generated inside Apple’s Secure Enclave and stays there.
• Every transaction requires biometric unlock (Touch ID).
• You create a 2-of-3 wallet (e.g. Mac + Coldcard + backup seed signer).
• Transactions are built offline, signed by your Mac, and passed to the next cosigner via PSBT.
• There’s no telemetry, no cloud fallback, no bullshit. If GitHub disappears tomorrow, the code still works.

⚙️ Tech Stack

• Based on a slim fork of Specter Desktop.
• All crypto logic refactored in Swift using Apple’s CryptoKit APIs.
• ~1700 LOC doing the heavy lifting. Easy to audit, easy to fork.

🖥 macOS ONLY (for now)
This was built specifically for macOS.
No Windows, no Linux. Not out of laziness — by design.

Why?
Because MacBooks ship with Secure Enclave, biometric auth, and sandbox protections.
If we want actual wallet security UX for real humans, we should leverage what’s already in the device.

This doesn’t compete with Coldcard or SeedSigner. It replaces insecure single-sig hot wallets running on Mac.

🧠 Who This Is For

• Privacy-focused users who don’t want cloud wallets
• Multisig fans who want UX without USB cables
• Mac-only devs who hate Electron bloat
• People onboarding relatives/friends and want safer defaults

💬 Feedback, audits, forks welcome
The goal here isn’t lock-in. It’s to push better UX + security defaults on platforms people already use.
If you want to help port to Linux/Windows, suggest integrations, or review the Secure Enclave logic — please open issues or PRs.

Github: https://github.com/CryptOpenDevelopment/specter-desktop

[NotATether]

This is a very good wallet you've made, but unfortunately I do not have a Macbook! I only have various Windows and Linux laptops I kind of wish biometrics were some kind of standard on Windows (they won't be supported well under Linux in any case) but then again the ancient, fragile design on the Windows codebase would defeat the purpose of doing that IMO.

If this is a two-of three multisig, where one of the keys is Apple's biometrics, the other two are going to be on hardware wallets per your OP. So now you can basically sign all transactions with one hardware wallet + your fingerprint, right? So it would actually be quite safe unless someone dusts off your fingerprint and gains access to one hardware wallet and somehow finds the PIN.

[ABCbits]

I don't use macOS, So i'll just ask 1 question. I noticed your GitHub repository is forked from https://github.com/cryptoadvance/specter-desktop which last updated 4 months ago. So what are changes between two of them (Specter Desktop and Enclave)?

[cryptopendevelopment]

I don't use macOS, So i'll just ask 1 question. I noticed your GitHub repository is forked from https://github.com/cryptoadvance/specter-desktop which last updated 4 months ago. So what are changes between two of them (Specter Desktop and Enclave)?

There was an issue with our add-on repo visibility, I've just re-uploaded it, it's available here - https://github.com/CryptOpenDevelopment/specter-enclave

This is a very good wallet you've made, but unfortunately I do not have a Macbook! I only have various Windows and Linux laptops I kind of wish biometrics were some kind of standard on Windows (they won't be supported well under Linux in any case) but then again the ancient, fragile design on the Windows codebase would defeat the purpose of doing that IMO.

If this is a two-of three multisig, where one of the keys is Apple's biometrics, the other two are going to be on hardware wallets per your OP. So now you can basically sign all transactions with one hardware wallet + your fingerprint, right? So it would actually be quite safe unless someone dusts off your fingerprint and gains access to one hardware wallet and somehow finds the PIN.

Your Mac’s Secure Enclave key + Touch ID acts as one cosigner in a 2-of-3 setup. That means for most transactions, you just combine your fingerprint with a hardware wallet (like Coldcard, BitBox, Tapsigner, etc.), and you’re good.

The real strength is:

• If someone steals your Mac, they still need your fingerprint and another cosigner.
• If someone gets your hardware wallet, they still need your Mac + Touch ID to move funds.
• And if you lose both, you still have the 3rd backup key for recovery.

No one device ever has enough access alone — and unlike single-sig hot wallets on desktop, there’s zero extractable private key sitting in memory.

Re: Windows/Linux — totally agree. The lack of universal biometric + secure element APIs makes doing this cleanly a mess (especially without relying on TPM/BitLocker junk). But it’s something I’d love to explore if there’s demand + help on the dev side.

If you’re interested in trying the concept with a TPM-locked key or YubiKey fallback on Linux/Windows, I’d be happy to brainstorm a flow.

[cryptopendevelopment]

🚀 v1.0.1 “Enclave-Merge” released – Secure Enclave signer now in main tree.

Key points
• Mac Secure Enclave key + Touch ID = 1 cosigner 
• 2-of-3 multisig wizard (add Coldcard, SeedSigner, etc.) 
• No cloud, no telemetry – PSBT via QR/NFC 
• MIT licence, reproducible dmg (hash + GPG sig)

Bug bounty: up to 250 k sats for critical vulns.

Download + source: https://github.com/CryptOpenDevelopment/specter-desktop