Blockstream Jade

Blockstream Jade is a hardware wallet produced by Blockstream for securing Bitcoin and Liquid assets. It signs transactions on-device and communicates with companion software over USB, Bluetooth, or QR codes depending on the workflow, so it can run in connected or fully air-gapped configurations. Blockstream also offers Jade Plus, a later model with revised hardware, and the Jade line has become one of the most affordable entry points to dedicated-hardware signing.

A different answer to the secure-element question

Most hardware wallets protect the seed with a dedicated secure element — hardened silicon that is effective but closed-source, forcing a trade between physical security and auditability. Jade takes a different path. It has no conventional secure element; instead, its security model is built around what Blockstream calls a blind oracle: the wallet secret is encrypted on the device, and unlocking it requires a key held by an external server that participates in the decryption without ever learning the seed, the PIN, or anything about the wallet. Brute-forcing a stolen Jade is impractical because the oracle rate-limits and locks out after failed attempts. Because no proprietary chip is required, the entire stack — firmware, hardware design files, and companion-app code — is published as open source on GitHub and can be audited end to end. Users who prefer not to rely on the oracle at all (or on Blockstream's default instance — the oracle can be self-hosted) can run Jade in a stateless mode, entering the seed phrase each session so the device stores nothing when powered off, in the same spirit as SeedSigner.

Workflows

Jade pairs natively with Blockstream's Green wallet and works with third-party coordinators including Sparrow and Specter Desktop, exchanging PSBTs for single-signature and multisig use. Models with a camera support fully air-gapped QR signing: the coordinator displays the unsigned transaction as animated QR codes, Jade scans, the user verifies details on Jade's own screen, and the signed result returns the same way — no cable, no radio. The Liquid support reflects Blockstream's sidechain focus, but the device is entirely usable as a Bitcoin-only signer.

Where it fits

Operationally, Jade rewards the same habits as any signer. Verify receive addresses on the device screen, not the host's; test recovery from the written seed backup before funding; and if you use the QR-only workflow, practice it end to end once so the ceremony is familiar before it matters. Two Jade-specific notes are worth knowing. First, the oracle dependency has a specific failure shape: if the oracle is unreachable, a PIN-mode Jade cannot unlock until connectivity returns, though funds are never at risk because the seed backup always restores the wallet on any compatible device — and self-hosting the oracle or using stateless mode removes the dependency entirely. Second, because the firmware is fully open, Jade has become a popular target for community builds and DIY-adjacent experimentation, part of the same commodity-hardware current that produced Krux-style signers. As always, buy from official channels and verify firmware signatures on update. For budget-conscious savers assembling their first real custody setup, that combination of price and auditability is hard to argue with.

Jade's combination of low cost, full-stack openness, and flexible trust model makes it a strong first hardware signer and a credible cosigner in a multisig quorum — mixing device vendors across a quorum is good practice, and an open-stack device diversifies against closed-silicon risk. The honest trade-off is the oracle: the default model introduces a server dependency (mitigated by self-hosting or stateless mode) in exchange for eliminating closed silicon. Which trade a user prefers is a matter of threat model, not dogma. For surrounding concepts, see hardware wallet and self-custody.