The first wallet where every update
is verified on-chain.
Keys generated and signed in Rust, never leaving your device. Before any update runs, the bundle hash is checked against an on-chain registry — if the developer's hardware wallet didn't sign it, it doesn't run. Non-custodial. Open source. Built by Velm to prove the architecture ships.
Built with
Three primitives. No trusted server.
Non-custodial from key generation to signing to OTA verification. Every step that could compromise a user's funds happens in Rust with no server in the critical path.
Generate & encrypt locally
Rust generates BIP-39 mnemonic on-device. User sets a password. Keys are encrypted before they ever touch disk.
Sign in Rust, broadcast direct
When you send a transaction, Rust loads the encrypted key, signs in-memory, and pushes directly to the chain RPC. TS only sees a tx hash.
Verify every update on-chain
Before any app update runs, the Rust verifier hashes the bundle and checks the OTARegistry contract. Developer's hardware wallet must have signed that exact hash.
Every threat model, covered in Rust.
Keys never leave your device
Seed phrases are generated locally in Rust. Encrypted at rest with AES-256-GCM. No server ever sees them — not even ours.
On-chain OTA verification
Every update is hashed with keccak256. Before it runs, the Rust verifier queries the OTARegistry contract. Hash mismatch → silent reject. No exceptions.
Rust transaction signing
Keys stay in Rust memory. TS never touches a raw private key. Transactions are signed in the Tauri sidecar and broadcast direct to chain RPCs.
Fully open source
Every line is auditable. MIT licensed. The same Rust OTA verification crate is available on crates.io — integrate it into your wallet in a weekend.
Supply-chain attack?
The update doesn't run.
The 2022 Slope wallet hack — $8M drained — started with a compromised JS bundle pushed via CI/CD. Coin's OTA verifier runs before the bundle executes. An attacker can own your CI/CD, your CDN, your signing server. They cannot forge the on-chain registry entry that your hardware wallet signs offline.
- Verification keccak256 hash checked on-chain before execution
- Signing authority Hardware wallet (offline) — no hot keys in the loop
- Failure mode Silent reject — user never sees a malicious update
- SDK Open source Rust crate — integrate in any wallet
Be the first wallet
with on-chain OTA verification.
Coin is in active development. Get early access or integrate the open source Rust OTA crate into your own wallet today. No funnels — directly to Divyam.