Security Architecture
How Stasher protects your keys
A plain, honest account of what Stasher defends against and how. No marketing hand-waving — the real building blocks, named. If a claim isn't here, we don't make it.
Threat Model
What Stasher defends against — and what it can't
Self-custody moves the trust from a company to your own device. We're clear about where that protection starts and stops.
Remote attackers
The device holding your keys has no internet, Wi-Fi, or Bluetooth. Attackers on the network cannot reach it.
A compromised phone
The phone app never sees your keys. Malware on your phone cannot move funds — every transaction is confirmed on the device itself.
Physical theft
Keys are sealed in a certified secure element and gated behind your password, with escalating lockout on wrong tries.
Firmware tampering
The device only boots firmware carrying valid signatures, with anti-rollback so old vulnerable firmware can't be forced back on.
What we can't protect
If you lose your 24-word recovery phrase, or hand it (or your password) to someone, no wallet can help. Guard your recovery phrase offline.
Certified Secure Element
Keys sealed in a JIL High secure element
Private keys are generated on-device and stored inside a dedicated secure element — a tamper-resistant chip certified under Common Criteria to JIL "High" attack-potential resistance, the same class of chip trusted in bank cards and passports. The storage key is wrapped by the secure element, so seed material can't be read out even with direct access to the flash.
Air-Gap Architecture
Two domains, one air gap
Stasher splits the job in two. A cold domain holds your keys, generates addresses, and signs transactions — it has no radio and no network stack, and its only external contact is one narrow serial channel. A warm domain talks to the internet and relays approved transactions and balance updates. The two exchange authenticated messages, never secrets: your keys and the network never share a wire.
Post-Quantum Cryptography
Quantum-resilient where it counts
Stasher uses NIST post-quantum standards everywhere it controls the cryptography: device pairing runs a hybrid X25519 + ML-KEM-768 key exchange, and secure boot verifies firmware with a dual quorum of Ed25519 and SLH-DSA signatures plus a monotonic anti-rollback epoch. Coin transaction signatures still follow each blockchain's own rules (classical ECDSA / EdDSA) — true of every wallet on the market — but every channel Stasher owns end-to-end is built quantum-resilient today.
Clear Signing
The device decides what it shows you
Blind signing — approving a transaction you can't actually read — is how most wallet users get drained. When Stasher receives an EVM transaction it inspects the raw bytes itself: if the destination is a known token contract and the payload carries an ERC-20 transfer, it decodes the real recipient and amount and displays those. Without that step a token transfer looks deliberately misleading on screen, showing a zero-value transfer to the token contract rather than to the person actually being paid. The critical part is where this happens: entirely on the offline device, from the transaction bytes alone. Nothing in the protocol tells it "this is a token transfer", so a compromised computer that misrepresents what you're signing is caught rather than trusted. Tokens the firmware doesn't recognise are shown as raw data — we'd rather display less than display something we can't verify.
Defense in Depth
Layered protection
Security doesn't rest on any single feature.
Encrypted at rest
The seed exists in flash only as encrypted entropy — AES-256 with a memory-hard key derivation bound to your password and the device.
Flash readout protection
Production devices enable the microcontroller's readout protection, blocking debug extraction of memory.
Escalating lockout
Wrong password attempts trigger delays that grow from seconds to hours to a full day — brute force becomes impractical.
True hardware randomness
Keys are generated from a hardware random number generator, not predictable software pseudo-randomness.
On-device confirmation
Every transaction is shown on the device's own screen and must be approved with its physical button before it can be signed.
Independent Assurance
Verified, not trusted
Independent security experts are reviewing Stasher's hardware and firmware ahead of launch, and we will publish the results. Certification and audit documentation will be linked here as it becomes available.