[ANN Preview] Lock.com: software isolation will replace the hardware wallet

[madebylock]

Hi all,

I'm going to make an argument. I know will get pushback in this crowd, which is exactly why I want it here first: for active self-custody, software isolation can replace the hardware wallet.

Hardware wallets solved a real problem. Keeping your keys off a general-purpose computer full of malware, browser exploits, and clipboard hijackers was the right call, and for deep cold storage it still is. Nobody's disputing that.

But "keep the key off the computer" is a narrower guarantee than people treat it as, and for anyone actually *using* their coins it's showing its limits:

• You're still trusting the supply chain, the firmware, the update process, and the companion app. The secure element is small; the trust surface wrapped around it is not.
• The tiny screen that's supposed to be your source of truth can't meaningfully show you a complex swap, bridge, or contract approval. You end up confirming a blob and hoping.
• For real multi-chain use, the surrounding software still owns everything that matters - chain state, providers and routing, transaction context, swaps, bridges, and the entire UX. The device signs; the software decides what it signs.

So the hardware wallet moves the key one step away, off the computer, and then hands every interesting decision back to software you haven't isolated at all.

Lock.com's thesis is that you get more safety by isolating inside the wallet than by isolating from the computer. A hardware wallet isolates the key from the computer. Lock.com tries to isolate the key from the rest of the wallet itself.

To you, it's one wallet app. You open one product and use it like any other wallet. Under the hood, the sensitive roles are pulled apart so a compromise in one piece never reaches the seed:

• Treasury — the only component that touches seed-derived material and signs.

• Node — chain state, providers, routing, RPCs, swaps, bridges, all the network-facing work.

• Wallet — the interface you actually click around in.

• Vault daemon — protects the device key on its own, on platforms that let us do it.

This isn't another skin over the same monolith. The part that can sign is small, walled off, and never shares space with the part talking to the internet or drawing the UI.

On post-quantum, I'll be precise, because the term gets abused. Lock.com uses hybrid classical + post-quantum cryptography inside its own architecture and communication layers. It does not make any existing chain quantum-safe - on-chain signatures still come down to whatever cryptography that chain uses, and that's not ours to change.

My claim, plainly: for most people doing active self-custody, this replaces the hardware wallet. For deep cold storage, a dedicated device may still be the right tool. I want to know exactly where you think that line falls.

What I'm after in this thread:

• Wallet builders and auditors: tear into the architecture and the trust boundaries.
• Hardware-wallet users: tell me where a dedicated device still beats this.
• Self-custody users: the frustrations nothing on the market has fixed.
• Anyone who wants to follow along before it's public.

More to come, including the whitepaper and early access details. Site's here if you want it: https://www.lock.com

Cheers

Here are a few images from our recent Berlin Blockchain Week event:
https://talkimg.com/images/2026/07/03/ULhWDd.jpg
https://talkimg.com/images/2026/07/03/ULh8zb.jpg
https://talkimg.com/images/2026/07/03/ULhKhv.jpg
https://talkimg.com/images/2026/07/03/ULhblH.jpg
https://talkimg.com/images/2026/07/03/ULhDmg.jpg
https://talkimg.com/images/2026/07/03/ULhOVI.jpg

[satscraper]

~

I like this picture.

Empty beer boxes suggest that your coming project is bound to succeed.  

On the serious note, your mentioned "post-quantum schemes inside the wallet's own architecture and its comms layers". Does it mean that your are intend to protect from quantum treat the app itself ^{like its local data,sync, backup, any client-server communication, what else?.} rather than funds it controls?

[madebylock]

~

https://talkimg.com/images/2026/07/03/ULhblH.jpg

I like this picture.

Empty beer boxes suggest that your coming project is bound to succeed.  

On the serious note, your mentioned "post-quantum schemes inside the wallet's own architecture and its comms layers". Does it mean that your are intend to protect from quantum treat the app itself like its local data,sync, backup, any client-server communication, what else?. rather than funds it controls?

Hi satscraper, seeds created from the Lock Treasury are quantum safe, the security is designed for the quantum world. If a blockchain is not quantum safe, this is out of the programs control.

[Zwei]

how is that "True Air-Gapped Security" when the wallet app can communicate with the offline signer via bluetooth or local wifi?

seeds created from the Lock Treasury are quantum safe, the security is designed for the quantum world.

can you explain in more details how the seeds created are quantum safe?

[satscraper]

What I'm after in this thread:

• Wallet builders and auditors: tear into the architecture and the trust boundaries.
• Hardware-wallet users: tell me where a dedicated device still beats this.
• Self-custody users: the frustrations nothing on the market has fixed.
• Anyone who wants to follow along before it's public.

More to come, including the whitepaper and early access details. Site's here if you want it: https://www.lock.com

All of the above can be answered only after your whitepaper sees the light. Until then, your words cannot be taken seriously and our speculations would be meaningless.

But at least now I can say that, in my view, there's no way to achieve absolute isolation of key material in the host machine, as those keys need to communicate with the host which builds the unsigned transactions.

So I'm waiting for your whitepaper for serious discussion.

[nc50lc]

This isn't another skin over the same monolith. The part that can sign is small, walled off, and never shares space with the part talking to the internet or drawing the UI.

When you said "small", you meant a few lines of code that's easy to audit?

Because based from the website,
I can't see any advantage from existing cold-storage feature that's already available in some self-custodial wallets.
e.g.: An air-gap machine with offline wallet and an online watch-only pair.
Open-source so it can be verified even though it's not isolated from the wallet daemon and/or GUI.

Of course, an easy-to-verify source code for the "Treasury" is good if that's what you meant.

[madebylock]

https://talkimg.com/images/2026/07/08/UcnUbb.png

how is that "True Air-Gapped Security" when the wallet app can communicate with the offline signer via bluetooth or local wifi?

seeds created from the Lock Treasury are quantum safe, the security is designed for the quantum world.

can you explain in more details how the seeds created are quantum safe?

Hi Zwei, the air gap is between your Treasury (signer) and the internet, not between the Wallet and the Treasury. Bluetooth/WiFi/USB/Ethernet is the local link the app uses to hand the Treasury something to sign.

The Wallet itself never generates a transaction. The Wallet sends instructions to the Treasury where all the verification and generation of the transaction takes place. Signing happens entirely on the Treasury with no access to the internet.

That link is locked down: end-to-end encrypted with a post-quantum handshake, protected by an 8-digit pairing check against impersonation, and the Treasury is blocked at the OS level from ever making an outbound connection.

As for your question on the seeds being created there are two parts to it. First, the seed: Grover's algorithm halves brute-force strength (256-bit to ~128-bit), so Lock's 36-word Universal Quantum Seed uses 272 bits of entropy  ~136-bit even against a quantum search, with a hardened KDF (PBKDF2 600k + Argon2id) on top.

Second, the seed derives genuine NIST keys (ML-KEM-768 + ML-DSA-65), always paired with classical so both must break, protecting your chat, files, the Wallet to Treasury channel and node auth against "harvest-now-decrypt-later."

The majority of on-chain signatures are still classical (secp256k1/Ed25519). Lock's built to switch the day they do. Until then, your seed already carries the headroom.

What I'm after in this thread:

• Wallet builders and auditors: tear into the architecture and the trust boundaries.
• Hardware-wallet users: tell me where a dedicated device still beats this.
• Self-custody users: the frustrations nothing on the market has fixed.
• Anyone who wants to follow along before it's public.

More to come, including the whitepaper and early access details. Site's here if you want it: https://www.lock.com

All of the above can be answered only after your whitepaper sees the light. Until then, your words cannot be taken seriously and our speculations would be meaningless.

But at least now I can say that, in my view, there's no way to achieve absolute isolation of key material in the host machine, as those keys need to communicate with the host which builds the unsigned transactions.

So I'm waiting for your whitepaper for serious discussion.

Hi satscraper, a laptop without internet access can't leak your private keys. Currently we're planning the Treasury OS, a full operating system that only runs the Treasury. Your laptop or Raspberry Pi becomes your signing device.

One that has verifiable open code.
One that wasn't tampered or swapped in transit.
One that doesn't have your home address or phone number on file.
One that doesn't leave you open to phishing attempts.
One that isn't assembled and compiled by random people you don't know.
One that doesn't require trust.

This isn't another skin over the same monolith. The part that can sign is small, walled off, and never shares space with the part talking to the internet or drawing the UI.

When you said "small", you meant a few lines of code that's easy to audit?

Because based from the website,
I can't see any advantage from existing cold-storage feature that's already available in some self-custodial wallets.
e.g.: An air-gap machine with offline wallet and an online watch-only pair.
Open-source so it can be verified even though it's not isolated from the wallet daemon and/or GUI.

Of course, an easy-to-verify source code for the "Treasury" is good if that's what you meant.

Hi nc50lc, our Wallet, Treasury and Node combined is over +2,000,000 lines of code. You can choose to trust a hardware wallet manufacturer, you can choose to trust they will deliver your device that hasn't been tampered with at the facility where it was made or in transit. You can choose to trust they will keep your personal billing information secure.. or you can choose Lock, who you don't have to trust, where you can verify the code and compile it yourself without even divulging your email address. The security benefits are enormous, we're in a league of our own.

[nc50lc]

This isn't another skin over the same monolith. The part that can sign is small, walled off, and never shares space with the part talking to the internet or drawing the UI.

When you said "small", you meant a few lines of code that's easy to audit?

Hi nc50lc, our Wallet, Treasury and Node combined is over +2,000,000 lines of code. You can choose to trust a hardware wallet manufacturer, you can choose to trust they will deliver your device that hasn't been tampered with at the facility where it was made or in transit.

Not the answer to my question, thanks for the reply anyways.
I guess I have to wait for the official release, whitepaper, documentation for the proper answer.

For clarification, I meant "Cold Storage" setup which doesn't involve a hardware wallet.
E.g.: An offline Electrum wallet that's the signer and an online watching-only wallet for the online-related features.

About the part where I asked about that "small" thing, I'm asking if it's the code of the Treasury (as you said "the part that can sign").
Not asking for the whole codebase's size.

[satscraper]

. Currently we're planning the Treasury OS, a full operating system that only runs the Treasury. Your laptop or Raspberry Pi becomes your signing device.

.

Developing a new OS from scratch for the zoo of available hardware is very risky business. I would never vouch for the security of any chicken OS. Even Linux, which has existed and polished for decades, reveals nowadays that it has hidden flaws that may open the doors. Why not develop a dedicated app to keep key materials in the persistent volume of Tails with the frozen radio channels?

[madebylock]

This isn't another skin over the same monolith. The part that can sign is small, walled off, and never shares space with the part talking to the internet or drawing the UI.

When you said "small", you meant a few lines of code that's easy to audit?

Hi nc50lc, our Wallet, Treasury and Node combined is over +2,000,000 lines of code. You can choose to trust a hardware wallet manufacturer, you can choose to trust they will deliver your device that hasn't been tampered with at the facility where it was made or in transit.

Not the answer to my question, thanks for the reply anyways.
I guess I have to wait for the official release, whitepaper, documentation for the proper answer.

For clarification, I meant "Cold Storage" setup which doesn't involve a hardware wallet.
E.g.: An offline Electrum wallet that's the signer and an online watching-only wallet for the online-related features.

About the part where I asked about that "small" thing, I'm asking if it's the code of the Treasury (as you said "the part that can sign").
Not asking for the whole codebase's size.

Hi nc50lc, It's like you're saying with Electrum, if Electrum was used on an offline computer and you had access to 120 Blockchains instead of 1, along with a highly encrypted chat system where the senders and receivers are hidden, instant swapping with optional fees, online file storage with direct connection to the filecoin network, importing any wallet from all the major wallets including old wallet.dat files from 2009, hidden wallets to create branches from your original seed which are not stored in memory for safe keeping and much more.

Let me try to explain the Treasury, it should only be running on an offline computer of yours, you can use it on your regular computer connected to the internet but that is highly unrecommended, it can be connected to from Bluetooth, Wifi, USB or a direct LAN connection. We offer a seperate Wallet program that can be downloaded on Windows, Mac or Linux. When you send a transaction, its built inside the Treasury and sent back to your Wallet to be broadcast.

Our first version will be released in a few weeks, you will be able to see for yourself

. Currently we're planning the Treasury OS, a full operating system that only runs the Treasury. Your laptop or Raspberry Pi becomes your signing device.

.

Developing a new OS from scratch for the zoo of available hardware is very risky business. I would never vouch for the security of any chicken OS. Even Linux, which has existed and polished for decades, reveals nowadays that it has hidden flaws that may open the doors. Why not develop a dedicated app to keep key materials in the persistent volume of Tails with the frozen radio channels?

Hi satscraper, The Treasury OS is not an actual operating system the way you're thinking. It makes it so you're computer only runs the Treasury and nothing else, the app itself becomes the OS.

[nc50lc]

Hi nc50lc, It's like you're saying with Electrum, if Electrum was used on an offline computer and you had access to 120 Blockchains instead of 1, -snip-

Oh, I didn't take that into account.
I mainly use Bitcoin and Bitcoin wallets, but being a multi-coin wallet is indeed an advantage since I rarely see one with cold-storage feature.

Let me try to explain the Treasury, it should only be running on an offline computer of yours, you can use it on your regular computer connected to the internet but that is highly unrecommended, it can be connected to from Bluetooth, Wifi, USB or a direct LAN connection. We offer a seperate Wallet program that can be downloaded on Windows, Mac or Linux. When you send a transaction, its built inside the Treasury and sent back to your Wallet to be broadcast.

Thanks, but I'm aware of this.
It's just the note about it being "small" that I'm interested with.

But since it'll be released in just a few weeks, I'll just wait for it to check.

[satscraper]

. Currently we're planning the Treasury OS, a full operating system that only runs the Treasury. Your laptop or Raspberry Pi becomes your signing device.

.

Developing a new OS from scratch for the zoo of available hardware is very risky business. I would never vouch for the security of any chicken OS. Even Linux, which has existed and polished for decades, reveals nowadays that it has hidden flaws that may open the doors. Why not develop a dedicated app to keep key materials in the persistent volume of Tails with the frozen radio channels?

Hi satscraper, The Treasury OS is not an actual operating system the way you're thinking. It makes it so you're computer only runs the Treasury and nothing else, the app itself becomes the OS.

But it needs drivers to interact with hardware.

 Will you write them yourself to ensure the integrity of Treasury OS? And what about the connection to Tor?

Still, I think the Tails approach would be more reliable, taking into account that you're going to target virtually all existing hardware. It's one thing when you build your own hardware ^{like Apple and  Foundation do} and make the dedicated OS for it, but it's another when  OS has to run on the whole zoo of devices.

[LoyceV]

I know will get pushback in this crowd, which is exactly why I want it here first: for active self-custody, software isolation can replace the hardware wallet.

As they say: Extraordinary claims require extraordinary evidence. If you claim your software is safer than a hardware wallet, you'll have a tough time convincing us here.

a laptop without internet access can't leak your private keys. Currently we're planning the Treasury OS, a full operating system that only runs the Treasury. Your laptop or Raspberry Pi becomes your signing device.

So you're replacing a hardware wallet by an entire laptop? I can already sign offline using a laptop, with software I trust. Why would I want your software instead? No, I do not need 120 different blockchains.

over +2,000,000 lines of code.
~
or you can choose Lock, who you don't have to trust, where you can verify the code

I don't know a single person who has the skills and time to properly review 2 million lines of code.

I mainly use Bitcoin and Bitcoin wallets, but being a multi-coin wallet is indeed an advantage since I rarely see one with cold-storage feature.

From what I've seen, people who are into many different altcoins usually keep "their" coins on an exchange. They don't care about self-custody.

you can use it on your regular computer connected to the internet but that is highly unrecommended

That's what makes hardware wallets so easy to recommend to beginners: it's much easier to keep secure than a manual cold storage setup.

[nc50lc]

I mainly use Bitcoin and Bitcoin wallets, but being a multi-coin wallet is indeed an advantage since I rarely see one with cold-storage feature.

From what I've seen, people who are into many different altcoins usually keep "their" coins on an exchange. They don't care about self-custody.

Probably for the mainstream,
Although Bitcoin isn't much different for them, most of them also store their bitcoins in Exchange, if not, in popular Multi-coin wallets like MEW.
In my viewpoint, I'm seeing more posts throughout the internet about the latter.
But since there's no actual survey or study regarding this, we can't be assured on the actual numbers.