Ambire · hardware signer

Ambire Signer

The hardware signer built for Safe.

Keys are created inside two certified security chips and never leave them, so there is no seed phrase to lose or leak. Every transaction is decoded on the device's own screen, one physical switch takes it fully offline, and the see-through case hides nothing.

Configure yours Build it yourself
Ambire Signer in its translucent purple case, with the flame printed on the board inside
Why it matters

What lost money in 2024–2026

$1.4BBybit, Feb 2025. Signers approved a Safe transaction their hardware wallets could not decode; it was a DELEGATECALL.
~$120MColdcard, Jul 2026. A build bug generated seeds from a weak random-number generator.
$72–93MLedger reseller implant, Sep–Oct 2026. An LTE implant was hidden under the screen; the tell was a visible wire.

None of these needed a lab, and Ambire Signer answers each one by design: it decodes the Safe transaction on the device, creates keys inside certified chips, and puts the whole board on display.

The solution

Five reasons it is different

Tight integration with Ambire and Safe

Designed around Ambire and Safe accounts from day one.

Private and open source

Open hardware and firmware. Anyone can inspect it, and anyone can build one.

Post-quantum ready

Add a post-quantum key to your Safe as soon as chains support it.

Perfect clear signing

See exactly what you sign: every Safe action, decoded on the device.

Trezor compatible

Built on Trezor's open-source firmware, battle-tested for over a decade.

Device configurator

Make it yours

Pick the board print and the case, then order one or download everything and build it yourself.

Drag to turn it, or take it apart. The airgap switch is on the left edge, the power button on the right and USB-C at the bottom; the QR camera looks out through a window in the back.
Board print
Case
Ship to

Ordering opens once the first three devices pass testing.

Clear signing

What you see is what you sign

SAFE · ETHEREUM · NONCE 41 Sign transaction 0x7a3c…e3F1 · Treasury MULTISEND · 2 ACTIONS 1 Send 25,000 USDC to ops-wallet.eth 2 Approve 5,000 USDC for Uniswap Router CALL no refund, no gas token Hold to sign
Every action, decoded. The device rebuilds the Safe transaction itself and spells out each step of a batch, so what you see is what you sign.
BLOCKED Unknown DELEGATECALL Hands control of the whole Safe to another contract. TARGET 0x96221…0F9c not on the allowlist ALLOWED ONLY FOR MultiSendCallOnly · SignMessageLib Reject
The Bybit attack, stopped. Handing the Safe's control to unknown code (a DELEGATECALL) is blocked unless the target is on a short allowlist. Changes to owners, threshold and modules get their own warnings.
Inside

Offline at the flip of a switch

Airgap switch USB data switch USB data lines disconnected Radio power whole module unpowered BLE radio light
One switch, fully offline. It cuts USB data and the radio's power in hardware, not software. The light is wired to the radio itself, so it cannot lie. Offline, the device signs over animated QR codes in both directions.

Built to be looked at

  • About the size of a credit card, and every part sits on the back, where the see-through case shows it.
  • The screen and the battery sit on the front, so nothing is hidden behind them.
  • Carefully designed and audited in-house: the board passes a full set of checks before every order.
  • A factory assembles it. Only the screen, camera and battery go in by hand. DIY friendly, fully open source.
Architecture

Under the hood

PartChoiceWhy
First keyNXP SE050E2 secure elementsecp256k1 and P-256 keys generated inside, never exported. The PIN retry counter lives in the chip. Public docs, open firmware.
Second keyInfineon OPTIGA Trust M V3An independent P-256 key from a second vendor. The Safe counts the device as one owner that needs both signatures, so breaking one chip yields one key, not the device. JLC has none in stock, so early boards can leave it unfitted.
Main chipSTM32U585Same family as Trezor Safe 5/7, certified to PSA Level 3. Runs the screen, transaction decoding and camera.
RadionRF52840 BLE moduleUntrusted pipe for phone and extension. No Wi-Fi on the board.
QR cameraOV2640, refocused to 15 cmReads animated QR from a phone or laptop screen. A global-shutter sensor is the upgrade path.
TransportsUSB HID · BLE · QRWebHID for the extension, BLE for iOS and Android, animated QR (ERC-4527) when airgapped.
Seed modePlanned firmware on the STM32U585For a seed-phrase wallet that does not rely on a second secure element: the PIN is stretched by about a second of encryption inside the main chip, under a hardware-unique key that software cannot read. Guessing PINs off the device first needs a physical attack on the chip. Not built yet; the speed gets measured at bring-up.
RecoveryThe Safe itselfThe device is a replaceable owner, so losing it means swapping an owner.
Post-quantumLater, as an extra ownerML-DSA-44 signs in about 25 ms on this chip. On-chain verifiers are still unaudited, so it waits.
Status · 17 October 2026

The first three are on their way

Ordered

The first three devices are ordered. JLCPCB is making and assembling the boards. The screen, camera and battery go in by hand when they arrive.

Next

  • Firmware work starts soon, from a fork of Trezor's open-source firmware.
  • A 3D-printed case for the first devices, from the model above.
  • The hardware can replace a Ledger or Trezor. The first release focuses on what matters most to us: signing for Safe.

Different from the preview

  • The first boards are plain purple with the old wordmark. The preview shows the next print: the flame alone, in the colours above.
Open hardware

Build your own.

Every file is on this page: the board, ready for JLCPCB or PCBWay, and a case you can print at home.

Get the build files