VEYRNOX · Learn · Hardware Wallet
Hardware Wallet
A hardware wallet is a dedicated physical device that stores private keys in tamper-resistant hardware and signs transactions on-device. The keys never leave the device, and signing requires a physical button press or PIN.
How it works
On setup, the device generates a seed on-chip and displays it once for the user to record. From that seed it derives keys internally. To sign a transaction, a companion app on a phone or desktop assembles the unsigned transaction and sends it to the device over USB or Bluetooth. The device shows the transaction details on its screen, waits for a physical confirmation, signs internally, and returns the signature. The seed and private keys are never exposed to the connected computer — even a fully compromised host cannot extract them.
Why it matters
Hardware wallets isolate the signing surface from the general-purpose computer, which is the biggest single defence against malware-based key theft. Trezor, Ledger, and others popularised the pattern. The remaining threats — physical coercion, supply-chain tampering, seed-phrase phishing during recovery — require additional defences that the device alone cannot provide.
Related concepts
- Software Wallet — A software wallet is a wallet application that runs on a general-purpose computer or phone.
- Seed Phrase — A seed phrase — also called a recovery phrase or mnemonic — is a human-readable list of 12 or 24 words that encodes the entropy behind every private key in a wallet.
- Self-Custody — Self-custody is the practice of holding your own cryptographic keys rather than delegating custody to an exchange or custodian.
- iOS Secure Enclave — The Secure Enclave is a dedicated security coprocessor in Apple silicon (A7 and later, all M-series) that generates and stores cryptographic keys in hardware.
Frequently asked questions
Do hardware wallets protect against wrench attacks?
No. A hardware wallet signs what the user tells it to; physical coercion of the user is a separate problem.
Is a phone with Secure Enclave as good as a hardware wallet?
For most users, yes — Secure Enclave provides hardware-isolated signing without a second device.
Can hardware wallets be hacked?
They can be attacked physically with lab equipment, but not remotely under normal conditions. Supply chain is a real concern; buy directly from the manufacturer.
In Veyrnox
Veyrnox pairs with Trezor for users who want an external hardware signing surface alongside a mobile-native UI. The Secure Enclave on iPhone provides comparable hardware-bound signing for the mobile-only case. See Trezor iOS alternative.