cinder

Cold storage that holds the heat.

Air-gapped keys. Open firmware. Quiet self-custody for the long hold.

Reserve

Product

Nothing in. Nothing out.

cinder has no radios, no USB data lines and no idea what network you're on. Transactions cross the gap as QR codes or on a microSD card. Your keys never do.

What you see before you sign: every output, the fee rate and the change address.
  • No radios

    Air-gapped by construction

    There's no Wi-Fi, Bluetooth or NFC hardware on the board to switch off. The USB-C port charges the battery; its data lines aren't populated.

  • Reproducible

    Open firmware, byte for byte

    Source, build scripts and release hashes are public. Builds are reproducible, so you can compile the firmware yourself and confirm the release binary matches the code.

  • EAL6+

    Sealed secure element

    Your seed is generated on the device from a hardware RNG, with your own dice rolls mixed in if you like, and sealed in a certified secure element. Thirteen wrong PINs wipe it.

  • E-paper

    Read it before you sign it

    A 2.7-inch e-paper display shows every output address, amount and the fee rate before you approve. It keeps showing the last screen with the battery flat.

  • BIP-39 · SLIP-39 · PSBT

    Standard everything

    Your seed is a BIP-39 phrase with an optional passphrase, or SLIP-39 shares. Signing uses BIP-174 PSBTs. If cinder disappears tomorrow, your coins don't notice.

  • 18-month standby

    Built to be left alone

    Machined aluminium shell, no moving parts, no screen burn-in. Sleeping in a drawer, it holds a charge for about 18 months. Updates are optional and signed by 3-of-5 release keys.

How a transaction crosses the gap

  1. 01

    Build it on the hot side

    Your wallet app on a phone or laptop builds an unsigned transaction (a PSBT) and shows it as an animated QR code.

  2. 02

    Scan and check

    cinder reads the code through its camera. You check the amounts, the addresses and the fee on the e-paper display.

  3. 03

    Sign and hand it back

    Hold the button to sign. cinder shows the signed PSBT as a QR code; your app scans it and broadcasts. Keys never leave the device.

No camera in your setup? The same exchange works over microSD.

Spec sheet

Display
2.7″ e-paper, 264 × 176 px, readable in direct sun
Camera
Global-shutter QR reader, animated QR (BC-UR) at up to 8 frames per second
Secure element
EAL6+ certified. Seed sealed at first boot. PIN wipe after 13 attempts
Connectivity
None. No Wi-Fi, Bluetooth or NFC. USB-C carries power only
Storage
microSD slot for PSBTs and firmware images
Power
1,000 mAh cell, USB-C charging, about 18 months on standby
Entropy
Hardware RNG, optional 99-roll dice entry
Standards
BIP-32 / 39 / 84 / 86, BIP-174 PSBT, SLIP-39, BC-UR
Assets
Bitcoin only, mainnet and testnet. On purpose
Body
Machined aluminium, 84 × 52 × 9 mm, 68 g. Ash or Ember finish
Firmware
Open source, reproducible builds, releases signed by 3-of-5 keys
Warranty
3 years. We never ask what's on it

Privacy

We can't see your keys. We'd rather not see you either.

Self-custody is quiet by design. This is exactly what cinder knows about you, and what it can't.

  • No account, no app, no login

    cinder works with the wallet you already use. There's nothing to sign up for and no cloud on the other end.

  • The device can't phone home

    The firmware has no network stack because the hardware has no network. There's no telemetry to opt out of.

  • Serials aren't tied to orders

    The serial number is printed inside the tamper-evident bag. Our order system never sees it, so a purchase can't be matched to a device.

  • Plain box, plain label

    No brand on the outside. The carrier label says "electronics". Your neighbours learn nothing.

  • Card details never touch our servers

    Payment is handled by the processor. We see that it cleared, not the number.

What we keep

WhatWhyFor how long
Email addressTo tell you when your unit is ready and, if you asked, to send firmware release notesUntil you unsubscribe, or 30 days after your order ships
Shipping addressTo ship the unitDeleted 30 days after delivery
Order total and dateBookkeepingAs long as tax law requires, then deleted
Device serialWarranty, if you choose to quote itNever linked to your order
Anything from the deviceNothing. It can't send anythingNever

FAQ

Fair questions.

Short answers to the ones we get most.

Do I have to trust cinder?

As little as possible. Keys are generated on the device, the firmware is open and reproducibly built, and the secure element is sealed at first boot. Verify the release hash against the signed tag before you flash anything.

How does an air-gapped device sign anything?

Your wallet app builds an unsigned transaction and shows it as an animated QR code. cinder scans it, you check the details on the e-paper display, sign, and cinder shows the signed transaction back as a QR code for your app to broadcast. Nothing but light crosses the gap.

Prefer no camera? Use the microSD slot for the same exchange.

Which wallets does it work with?

Any wallet that speaks PSBT over animated QR (BC-UR) or microSD. Single-signature and multisig both work; for multisig, cinder registers the wallet descriptor so it can verify change addresses.

Why Bitcoin only?

Fewer parsers, less code, smaller attack surface. Every extra asset is another format the firmware has to understand and another place a bug can hide. We'd rather do one thing well and be boring about it.

What happens if the battery dies?

Nothing. Your seed sits in the secure element and in your backup. The e-paper display keeps showing its last screen without power. Charge it over USB-C and carry on.

What if cinder the company goes away?

Your seed is a standard BIP-39 phrase (or SLIP-39 shares) and restores into any compatible wallet. Firmware source and build scripts are mirrored, and the device keeps working without us.

How is it shipped?

In a plain box with a plain label, inside a tamper-evident bag. The serial number lives inside the bag and is never linked to your order.

Can I reserve more than one?

Up to five per reservation. If you're building a multisig setup, mixing cinder with a signer from another vendor is a good habit.

Is there a charge to reserve?

No. Reserving holds your place in the first batch. You pay when we email you that your unit is ready, and you can walk away at any point before then.

Reserve

Hold a place in the first batch.

No charge to reserve. The first batch ships in spring 2027, and we'll email you when your unit is ready to order.

Up to five per reservation.

First batch: spring 2027

Finish

Nothing is charged until you order.