Ambire · hardware signer

Ambire Signer

The hardware signer built for Safe.

Keys are created inside two certified security chips and never leave them, so there is no seed phrase to lose or leak. Every transaction is decoded on the device's own screen, one physical switch takes it fully offline, and the see-through case hides nothing.

Configure yours Build it yourself

Why it matters

What lost money in 2024–2026

$1.4BBybit, Feb 2025. Signers approved a Safe transaction their hardware wallets could not decode; it was a DELEGATECALL.

~$120MColdcard, Jul 2026. A build bug generated seeds from a weak random-number generator.

$72–93MLedger reseller implant, Sep–Oct 2026. An LTE implant was hidden under the screen; the tell was a visible wire.

None of these needed a lab, and Ambire Signer answers each one by design: it decodes the Safe transaction on the device, creates keys inside certified chips, and puts the whole board on display.

The solution

Five reasons it is different

Tight integration with Ambire and Safe

Designed around Ambire and Safe accounts from day one.

Private and open source

Open hardware and firmware. Anyone can inspect it, and anyone can build one.

Post-quantum ready

Add a post-quantum key to your Safe as soon as chains support it.

Perfect clear signing

See exactly what you sign: every Safe action, decoded on the device.

Trezor compatible

Built on Trezor's open-source firmware, battle-tested for over a decade.

Device configurator

Make it yours

Pick the board print and the case, then order one or download everything and build it yourself.

Loading the 3D model…

Drag to turn it, or take it apart. The airgap switch is on the left edge, the joystick (its centre press is the power key) and USB-C at the bottom; the QR camera looks out through a window in the back.

Clear signing

What you see is what you sign

Every action, decoded. The device rebuilds the Safe transaction itself and spells out each step of a batch, so what you see is what you sign.

The Bybit attack, stopped. Handing the Safe's control to unknown code (a DELEGATECALL) is blocked unless the target is on a short allowlist. Changes to owners, threshold and modules get their own warnings.

Inside

Offline at the flip of a switch

One switch, fully offline. It cuts USB data and the radio's power in hardware, not software. The light is wired to the radio itself, so it cannot lie. Offline, the device signs over animated QR codes in both directions.

Built to be looked at

About the size of a credit card, and every part sits on the back, where the see-through case shows it.
The screen, one AAA cell and the joystick sit on the front, so nothing is hidden behind them. The cell stands out of the case: any AAA, rechargeable or not, goes in and out without tools.
Carefully designed and audited in-house: the board passes a full set of checks before every order.
A factory assembles it. Only the screen and camera go in by hand. DIY friendly, fully open source.

Architecture

Under the hood

Part	Choice	Why
First key	NXP SE050E2 secure element	secp256k1 and P-256 keys generated inside, never exported. The PIN retry counter lives in the chip. Public docs, open firmware.
Second key	Infineon OPTIGA Trust M V3	An independent P-256 key from a second vendor. The Safe counts the device as one owner that needs both signatures, so breaking one chip yields one key, not the device. JLC has none in stock, so early boards can leave it unfitted.
Main chip	STM32U585	Same family as Trezor Safe 5/7, certified to PSA Level 3. Runs the screen, transaction decoding and camera.
Radio	nRF52840 BLE module	Untrusted pipe for phone and extension. No Wi-Fi on the board.
QR camera	OV2640, refocused to 15 cm	Reads animated QR from a phone or laptop screen. A global-shutter sensor is the upgrade path.
Power	One AAA cell	Rechargeable NiMH, lithium or alkaline: the device runs from any of them, and charges a cell over USB only once it has identified it as NiMH. Roughly 1.5 hours of full use on an eneloop pro and 2 hours on an Energizer lithium (estimates until measured).
Transports	USB HID · BLE · QR	WebHID for the extension, BLE for iOS and Android, animated QR (ERC-4527) when airgapped.
Seed mode	Planned firmware on the STM32U585	For a seed-phrase wallet that does not rely on a second secure element: the PIN is stretched by about a second of encryption inside the main chip, under a hardware-unique key that software cannot read. Guessing PINs off the device first needs a physical attack on the chip. Not built yet; the speed gets measured at bring-up.
Recovery	The Safe itself	The device is a replaceable owner, so losing it means swapping an owner.
Post-quantum	Later, as an extra owner	ML-DSA-44 signs in about 25 ms on this chip. On-chain verifiers are still unaudited, so it waits.

Status · 22 October 2026

Proto 1: one AAA cell and a joystick

In design

The next board is designed. It runs on one AAA cell instead of a built-in battery, which makes the device about 6 mm thinner, and it adds a joystick under the screen and a buzzer. The first three devices, ordered on 18 October, are the previous board.

What changed

Any AAA cell: rechargeable NiMH, lithium or alkaline. The cell stands out of the case and swaps without tools.
USB charges a cell only once the device has identified it as NiMH; a lithium or alkaline cell is never charged.
A joystick with a centre press, below the screen.
A buzzer for confirmations.
Case colours: ice blue, orange and purple (all see-through) and clear.

Order the first proto 1 boards and print the case.
Firmware for the cell, the charger, the joystick and the buzzer, from the fork of Trezor's open-source firmware.
Measure the battery life; until then the figures here are estimates.