VEYRNOX · The features that close crypto's #1 attack surface

The features that close crypto's #1 attack surface

Every mainstream self-custody wallet has one screen in common: the one that asks you to write down or paste a 12 or 24 word seed phrase. That single input is responsible for more drained wallets than every smart-contract exploit combined — because attackers do not need to break cryptography when they can imitate a familiar screen. Veyrnox is designed around making that screen unnecessary for default setup, while still supporting seed import when compatibility matters, and then hardening every layer that remains. Below is every feature that ships today, and the ones that ship next.

No seed phrase required for setup

The seed phrase input is crypto's number-one phishing surface. Every fake wallet website, every malicious mobile app, every "urgent security update" DM eventually asks the same question: please re-enter your 12 words to continue. Users have been trained by every wallet on the market to recognise that screen as normal, which is exactly what makes it so effective for attackers. Whole categories of fraud — from clipboard swappers to fake support agents to malicious airdrop sites — collapse the moment the user has no 12 words to hand over.

Veyrnox does not require a seed phrase during default onboarding. Setup is an 8-digit PIN, and recovery uses your existing iCloud or Google Drive account plus that PIN. Veyrnox can also import an existing seed phrase when you choose that path, but it does not force new users into writing one down on day one. That default design removes the phishing ritual users have been trained to accept as normal.

Shamir-sharded seed (Safety Plus tier)

Shamir-sharded seed backup is part of Veyrnox Safety Plus ($5.99/mo). The Free plan uses hardware-bound signing via the Secure Enclave / StrongBox with an 8-digit PIN. See plans →

Under the hood, Veyrnox still uses a standard BIP-39 seed. On Safety Plus, that seed is split using Shamir's Secret Sharing into two shards: one is sealed inside your device's Secure Enclave (iOS) or StrongBox (Android), and the other is encrypted and written to your own iCloud Keychain or Google Drive account. Both shards are required to reconstruct the seed. Neither one, on its own, is enough for anyone — including us — to spend a single satoshi.

Crucially, Veyrnox holds no shard. There is no server-side signing service, no MPC co-signer, no "cloud vault" run by us. This is a deliberate choice: if Veyrnox held a shard, Veyrnox would be a target, and a compromise of our infrastructure would put every user at risk. The only actors with any shard at all are you and the companies you already trust with your phone — Apple or Google.

Hardware-bound signing

Once a transaction is ready to sign, the signing operation happens inside your device's dedicated security chip: the Secure Enclave on iPhone and iPad, or Android StrongBox on supported Android devices. The private key never leaves that chip in plaintext form. The main application processor sees the transaction to sign and the resulting signature, but it never sees the key that produced it — which means malware running in the OS, or even inside the Veyrnox app itself, cannot exfiltrate your keys.

Every signature is gated by biometrics: Face ID, Touch ID, or your platform fingerprint. When a session ends, in-memory key material is zeroised, so a device left unlocked on a coffee shop table cannot be walked away with and drained. If the device is wiped, the shard is destroyed, and recovery falls back to the standard cloud-shard + PIN flow.

Coercion Resistance (decoy wallet)

Included in the Safety Plus tier, Coercion Resistance addresses a class of attack that ordinary security models pretend does not exist: the physical one. If someone with intent — a robber, a border agent, a hostile ex — puts you in front of your phone and demands you open your wallet, a PIN-only wallet has no good answer. Refusing has a physical cost. Complying empties the wallet.

Coercion Resistance lets you configure a second PIN that unlocks a decoy wallet with a small, plausible balance you have pre-loaded. To the attacker, it looks identical to a normal successful unlock — same UI, same asset list, same transaction history. Your primary wallet, and its real balance, remains untouched and invisible. Under duress, you comply visibly and lose only what you were prepared to lose.

RASP runtime protection

Runtime Application Self-Protection ships on every Veyrnox plan, including Free. On launch and continuously during use, the app checks for the environmental red flags that precede a wallet drain: root or jailbreak, an attached debugger, unauthorised hooking or instrumentation frameworks (Frida, Xposed, Cydia Substrate), altered binaries, and screen-recording or screen-mirroring while sensitive screens are visible.

If any of those checks fail, Veyrnox refuses to unlock the wallet and surfaces a clear reason. This is defensive, not punitive: a rooted device is a device where the OS's security guarantees no longer hold, which is exactly the environment where a hardware-bound key model quietly stops being hardware-bound. RASP is what stops that silent downgrade.

Recovery without a paper backup

Because default setup does not require writing down a new seed phrase, there is no paper backup to lose, burn, or photograph in the common path. Recovery on a new phone is a three-step process: install Veyrnox, sign in to the same iCloud or Google Drive account you used at setup, and enter your 8-digit PIN. Your cloud shard is decrypted with a key derived from your PIN, combined with a fresh device shard generated inside the new phone's Secure Enclave, and your wallet is back.

This flow deliberately relies on infrastructure you already trust and already keep secure — the account that guards your photos, messages, and password manager — rather than a piece of paper in a drawer. It also removes one of the single largest sources of permanent crypto loss: users who wrote down a phrase incorrectly, lost it in a house move, or never wrote it down at all.

Hardware wallet integration (Trezor)

For users holding balances they consider large — or for treasuries and long-term cold storage — Veyrnox pairs with Trezor hardware wallets. The Trezor device holds and signs with its own seed, entirely independent of the Veyrnox-managed key material, and Veyrnox acts as a modern, well-designed mobile interface for it. You get the transaction preview, the top-10 asset list, and the RASP-protected app, with signatures produced on the Trezor's physically isolated screen and button confirmation.

This gives users two independent security domains — the Veyrnox no-seed wallet and the Trezor cold wallet — that can be used side-by-side. Losing one does not compromise the other.

Top 10 crypto assets, natively

Veyrnox ships with first-class native support for the ten assets that account for the overwhelming majority of real user activity: Bitcoin (BTC), Ethereum (ETH), Solana (SOL), USDC, USDT, Polygon (MATIC), Arbitrum (ARB), Optimism (OP), Avalanche (AVAX), and BNB. Every one of them is signed with a hardware-bound key. Every one of them uses the same Shamir-sharded seed, the same RASP-hardened app, and the same biometric flow.

We deliberately do not ship support for thousands of long-tail tokens. Long lists mean long attack surfaces, malicious token contracts, and confused users signing approvals for scams. A shorter, curated list means every asset gets real engineering attention and every transaction screen shows a real, decoded action rather than a wall of unrecognised hex.

AI Security Protection tier (coming soon — $19.99/month)

The AI Security Protection tier bundles ten shipped transaction-level defenses on top of the Shamir + Secure Enclave signing core. Two upfront honesty notes: the "AI" in the tier name refers to the Personal AI Advisor chat interface and to the AI Risk Notes annotation product; the underlying detectors are rule-based, heuristic, and blocklist-driven — not machine-learning classifiers.

The ten features: Address Threat Screening — every recipient address is queried through the Veyrnox TIP (Threat Intelligence Platform) edge function before signing. Phishing Site Detection — a curated blocklist check against a local seed plus a remote phishing feed. Risk Scoring — a nine-signal, rule-based composite scorer that runs pre-sign, deterministic. Token Approval Review — view, assess, and revoke ERC-20 and SPL token approvals with per-spender risk notes. Approval Monitor — periodic background polling for new approvals and risky incoming transfers (polling, not push). AI Risk Notes — per-spender annotations sourced from the TIP screening pipeline. Personal AI Advisor — an on-demand chat interface backed by TIP for questions about a specific address, URL, or contract; advisory only, not autonomous monitoring. Drainer Detection — local heuristics that pattern-match known drainer contract shapes. Transaction Explanation — plain-language breakdown of what a transaction will do before you sign it. Portfolio Q&A — ask questions about holdings and on-chain activity through the Advisor chat. Free and Safety Plus users continue to get the underlying RASP and hardware-bound signing on which every pre-sign warning is enforced.