Bitcoin Signing Devices (Hardware Wallets) Reference
Self-custody starts with the device that holds your keys. A Bitcoin signing device — often called a hardware wallet — keeps your private keys offline and signs transactions in isolation, so the keys never touch an internet-connected computer. The neutral reference below compares widely used signers (open-source DIY builds, air-gapped QR signers, and secure-element devices) across the traits that actually matter for sovereignty: firmware openness, secure-element storage, air-gap method, interface, PSBT and multisig support, BIP39 passphrase handling, and whether the device is stateless. It is a machine-readable map of the field, not a ranking — the right signer depends on your own threat model. Each device name links to the manufacturer’s own documentation, and the full dataset is downloadable as CSV and JSON under CC BY 4.0.
Advisory, 2026-08-06. Coinkite disclosed a COLDCARD seed-generation vulnerability on 2026-07-30 affecting seeds created on Mk2, Mk3, Mk4, Mk5 and Q devices under specific firmware versions. Installing the patch does not repair an existing seed. If you own a COLDCARD, read Coinkite’s official advisory and our affected-versions breakdown. This is a developing situation.
Quick answer
A Bitcoin signing device (hardware wallet) keeps your private keys offline and signs transactions in isolation, so the keys never touch an internet-connected computer. Sovereignty comes down to a few axes most comparisons blur: open FIRMWARE (you can read and rebuild the code that guards your seed) is different from open HARDWARE (you can source or build the device yourself so no vendor sits in your supply chain) — only SeedSigner and Krux are fully open on both, with Blockstream Jade the closest commercial device. A dedicated secure-element chip resists physical key extraction but is usually closed silicon (the exception since Oct 2025 is the Trezor Safe 7's auditable TROPIC01). And the air-gap TRANSPORT is the attack surface: a QR code is a one-way channel you can inspect, while USB and Bluetooth are live bidirectional links. This reference lists 20 signers across all of those, with a sovereignty grade — but the grade is a starting point, not a verdict on your threat model.
There is no single best signer, only honest trade-offs. Grade A: fully-open, air-gapped, verifiable signers (SeedSigner, Krux, Blockstream Jade/Jade Plus, Coldcard Q, Foundation Passport) — and SeedSigner/Krux you can build from commodity parts no vendor knows you bought. Grade B: open-firmware devices with a closed secure element or a USB/BLE link (Trezor Safe, BitBox02, Keystone 3 Pro) — well-engineered tradeoffs, not failures. Grade C: closed-OS/closed-SE or screenless designs (Ledger, Bitkey, Tapsigner). Ledger's May-2023 Recover announcement showed the seed can leave the secure element under a firmware update the user cannot independently audit — stated as fact, not attack. Verify every spec against the manufacturer before trusting a device with savings.
Download CSV Download JSON REST API →
| Device | Maker | Open firmware | Open hardware | Sovereignty | Secure element | Air-gap | Interface | PSBT | Multisig | Passphrase | Stateless | BTC-only | Notable |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Coldcard Mk4 | Coinkite | Partial | Partial | B | Yes — dual (Microchip ATECC608B + Maxim DS28C36B) | microSD / NFC | USB-C, microSD, NFC-V, keypad, LCD | Yes | Yes | Yes | No | Yes | Bitcoin-only signer with two secure elements from different vendors; pioneered air-gapped PSBT over microSD. USB and NFC data can be physically and permanently disabled by cutting a PCB trace. Firmware source is published and reproducible under a custom (non-OSI) license. |
| Coldcard Q | Coinkite | Partial | Partial | A | Yes — dual (Microchip ATECC608B + Maxim DS28C36B) | QR / microSD / NFC | QR scanner, QWERTY keyboard, dual microSD, USB-C, NFC, 3.2-inch LCD | Yes | Yes | Yes | No | Yes | Larger Coldcard with a full QWERTY keyboard, built-in QR scanner and a 320x240 LCD; runs on AAA batteries for fully air-gapped operation. Shares the Mk4 dual-secure-element security model. |
| SeedSigner | SeedSigner (open-source project) | Yes | Yes | A | No | QR | QR camera, joystick/buttons, 1.3-inch LCD | Yes | Yes | Yes | Yes | Yes | DIY signer built from commodity Raspberry Pi Zero parts (typically under $50). No WiFi, Bluetooth, USB data or persistent storage — the seed is re-entered each session and never stored; all communication is by QR code. |
| Krux | Krux (open-source project) | Yes | Yes | A | No | QR / microSD | QR camera, touchscreen (some boards), microSD, optional thermal printer | Yes | Yes | Yes | Yes | Yes | Open-source firmware for off-the-shelf Kendryte K210 boards (M5StickV, Maix Amigo). Defaults to a stateless/amnesic mode that holds keys only for the session; signs by QR or microSD and supports Taproot and miniscript. |
| Trezor Safe 5 | SatoshiLabs (Trezor) | Yes | Partial | B | Yes — Infineon OPTIGA Trust M (V3), CC EAL6+ | none (USB) | USB-C, color touchscreen, haptic feedback | Yes | Yes | Yes | No | Yes | Touchscreen device pairing a general-purpose MCU with an EAL6+ secure element that gates PIN and passphrase entropy. Firmware is fully open source with verified boot. |
| Trezor Safe 3 | SatoshiLabs (Trezor) | Yes | Partial | B | Yes — Infineon OPTIGA Trust M (V3), CC EAL6+ | none (USB) | USB-C, two buttons, OLED | Yes | Yes | Yes | No | Yes | Button-based wallet that introduced a dedicated EAL6+ secure element to the Trezor line alongside the main MCU. Open-source firmware with verified boot. |
| Trezor Model T | SatoshiLabs (Trezor) | Yes | Partial | B | No | none (USB) | USB-C, color touchscreen, microSD (SD-protect) | Yes | Yes | Yes | No | Yes | Long-running open-source touchscreen wallet with no dedicated secure element (keys held encrypted in MCU flash). Discontinued in 2024 in favour of the Safe line. |
| Ledger Nano S Plus | Ledger | No | No | C | Yes — ST33 (CC EAL5+) | none (USB) | USB-C, two buttons | Yes | Yes | Yes | No | No | Wired-only signer built on a banking-grade ST33 secure element running Ledger's proprietary BOLOS OS (individual apps are open source, the OS is not). PSBT and multisig are handled through external coordinators such as Sparrow or Electrum. |
| Ledger Nano X | Ledger | No | No | C | Yes — ST33J2M0 (CC EAL5+) | none (USB / Bluetooth) | USB-C, Bluetooth 5.0, battery, two buttons | Yes | Yes | Yes | No | No | Adds Bluetooth and a battery to the ST33/BOLOS platform for mobile use; the secure element stores keys while BOLOS isolates apps. Operating system is proprietary. |
| Ledger Stax | Ledger | No | No | C | Yes — ST33K1M5 (CC EAL6+) | none (USB / Bluetooth / NFC) | USB-C, Bluetooth 5.2, NFC, E Ink touchscreen, Qi wireless charging | Yes | Yes | Yes | No | No | E Ink touchscreen device on an EAL6+ ST33 secure element with BOLOS; supports wireless Qi charging and NFC. OS proprietary, apps open source. |
| BitBox02 | BitBox (Shift Crypto) | Yes | No | B | Yes — Microchip ATECC608B (paired with an ATSAMD51 MCU) | none (USB; microSD = backup) | USB-C, capacitive touch sliders, OLED, microSD (backup) | Yes | Yes | Yes | No | Yes | Fully open-source (Apache-2.0) and reproducible firmware. The seed is encrypted and held in MCU flash rather than on the secure element; microSD makes instant offline backups. Ships in Multi and Bitcoin-only editions. |
| Foundation Passport | Foundation Devices | Yes | Partial | A | Yes — Microchip ATECC608B | QR / microSD | QR camera, microSD, keypad, color LCD (battery-powered) | Yes | Yes | Yes | No | Yes | Fully air-gapped, battery-powered signer that communicates only by QR and microSD — no USB data path and no wireless. Open-source firmware and hardware; firmware is verified by 2-of-4 Foundation signing keys, and expert users can add their own. |
| Blockstream Jade | Blockstream | Yes | Yes | A | No (Virtual Secure Element + blind-oracle PIN) | QR | USB-C, Bluetooth, QR camera, click-wheel | Yes | Yes | Yes | No | Yes | Low-cost open-source signer on an Espressif ESP32. In place of a hardware secure element it splits the secrets between the device PIN and a remote blind oracle, so a locked Jade alone holds nothing usable. Works air-gapped by QR, or over USB and Bluetooth. |
| Keystone 3 Pro | Keystone | Yes | No | B | Yes — three SEs (Microchip ATECC608B, Maxim DS28S60, Maxim MAX32520) | QR / microSD | QR camera, microSD, 4-inch touchscreen, fingerprint reader; USB-C (charge/firmware only) | Yes | Yes | Yes | No | Yes (BTC-only firmware) | Air-gapped touchscreen signer using three secure elements (two certified CC EAL5+) plus a fingerprint reader. No Bluetooth, WiFi or NFC and no USB data path — signs only by QR or microSD. Open-source firmware. |
| Coinkite Tapsigner | Coinkite | No | No | C | Yes | NFC | NFC tap (credit-card form factor) | Yes | Yes | No | No | Yes | Card-format single-key signer that holds a BIP32 extended private key (XPRV, not a BIP39 phrase) in a secure element and signs over an ECDH-encrypted NFC tap. Serves as a multisig cosigner with wallets like Nunchuk and Sparrow; the NFC protocol is open, the card firmware is closed. |
| Bitkey | Block, Inc. | Partial | Partial | C | No (secure MCU — Silicon Labs EFR32MG24, ARM TrustZone + PUF) | NFC | NFC, fingerprint sensor | Yes | Yes | No | No | Yes | Seedless 2-of-3 multisig system — keys live on the device, the phone app and Block's server, with no BIP39 recovery phrase. Fingerprint-authenticated NFC hardware key; firmware uses signed secure boot and is being progressively open-sourced. |
| Trezor Safe 7 | Trezor / SatoshiLabs | Yes | Partial (open SE) | B | Yes — DUAL: Tropic Square TROPIC01 (RISC-V, the first OPEN/auditable secure element) + Infineon Optiga Trust M | USB (± Bluetooth; no QR) | USB-C, touchscreen | Yes | Yes (basic) | Yes | No | Yes | Launched Oct 2025 as the first wallet with a transparent, auditable secure element (TROPIC01). A June-2026 coordinated vulnerability disclosure (found by Ledger's own Donjon audit team, funds unaffected) is the open-SE model working as intended. Still a USB-tethered, non-QR device. |
| BitBox02 Nova | Shift Crypto | Yes | No | B | Yes — Infineon Optiga Trust M V3 (EAL6+, closed silicon) | Bluetooth (‘Whisper’ minimal-trust BLE) + USB-C | USB-C, BLE, touch | Yes | Yes | Yes | No | Yes | Released June 2025; adds Bluetooth for iPhone users. The Whisper BLE stack treats the radio as untrusted (end-to-end encryption above it) — honest engineering, but a radio is still more attack surface than a QR code. Apache-2.0 firmware. |
| Blockstream Jade Plus | Blockstream | Yes | Yes | A | No — virtual/blind-oracle model (MCU only) | QR + microSD | Camera, screen, microSD, USB-C, BLE (optional) | Yes | Yes | Yes | Yes (stateless SeedQR mode) | Yes | Launched Jan 2025; the only commercial device close to fully-open on both firmware AND hardware, with a real QR air-gap and an air-gapped firmware-update path (JadeLink). Default PIN mode trusts a Blockstream blind oracle for rate-limiting (removable via stateless mode). |
| Foundation Passport Prime | Foundation Devices | Partial | Partial | B | Yes (ATECC-class hardener; chip unverified) | QR + microSD (+ NFC, post-quantum BLE) | Camera, touchscreen, microSD, NFC, QuantumLink BLE | Yes | Yes | Yes | No | No | GA May 2026. A from-scratch Rust microkernel (KeyOS) with an isolated post-quantum BLE radio — impressive engineering, but a young OS, more radios, an app-store surface and open-source claims not yet fully community-verified. A ‘human authority device’, not a purist signer (NOT Bitcoin-only). |
Source: each manufacturer's own product documentation, firmware repositories and security pages (linked on each device name). Capabilities can change with firmware revisions — verify before relying on them. Related glossary: self-custody, hardware wallet, air-gapped signing, secure element, PSBT, multisig, seed phrase. The software coordinator that pairs with these signers — and whether it talks to your own node — is the wallet sovereignty matrix. What each signer actually derives — default derivation path, seed standard (BIP39 vs SLIP39), passphrase behaviour and what a restore elsewhere really requires — is the wallet recovery & derivation-path matrix. See the open data hub.
Related products, repair, and setup paths
- how D-Central diagnoses ASIC repairs
- ASIC troubleshooting library
- ASIC manuals and repair guides
- replacement hashboards
- ASIC control boards
- ASIC power supplies
- S19 family replacement hashboard
- C52 replacement control board
- APW12 S19 power supply
- compare specs in the ASIC miner database
- compare ASIC miner specs
- ASIC miner database
- ASIC repair services
- Antminer S19 specs and profitability
- buy a tested Antminer S19
- Antminer S19 maintenance guide
- Antminer S19 repair service
- Antminer S21 specs
- Bitmain Antminer S21
- Antminer S21 maintenance guide
- BM1370BC S21 Pro chip
Last reviewed August 6, 2026.