Bitcoin Security System
Frostsnap is built so that no single point can be attacked to take your bitcoin: not a stolen device, not a compromised computer, not even a device that generates weak randomness. For an experience-focused discussion of the choices that set Frostsnap apart from other wallets (FROST, no PINs or passphrases), see Design Decisions.
Core Security Model: T-of-N
Frostsnap's security rests on physical access to a threshold number of keys held on geographically distributed devices (or their backups). Everything below builds on that one idea.
No Single Point of Failure
Your wallet is never stored on any one device. Your devices generate it together using FROST, so each holds only its own share and the full private key never exists anywhere, not even for an instant. You choose the threshold: a 2-of-3 wallet, for example, needs any 2 of its 3 devices to sign. Losing a single device, or having one stolen, never puts your funds at risk.
Verifiable Randomness
The keys that protect your bitcoin are only as strong as the randomness they are built from. Hardware wallets have shipped with weak or predictable random number generators before, silently reducing the security of the keys they produce, with the owners none the wiser. Frostsnap removes the need to trust any single device's randomness.
A single device never gets to choose the numbers that matter. Your phone contributes its own verifiable randomness in two places:
- • Key generation. Every device and your coordinator each mix in fresh randomness, and the result is certified. A backdoored device cannot steer your wallet toward a key it secretly knows.
- • Signing. Your phone adds its own secret randomness to the nonce of every signature. A tampered device therefore cannot rig its signatures to smuggle your key share out through them, defeating nonce-exfiltration attacks like Dark Skippy.
In both cases it is your phone's independent randomness doing the work: it keeps the devices honest during setup and during every signature.
Physical Distribution Is the Security Boundary
When your devices live in geographically separate locations, an attacker must physically reach a threshold number of them (or their backups) before they can even start a signing session. There is no single place, and no single moment, where your whole wallet can be taken. This is what makes Frostsnap resistant to theft, seizure, and coercion.
Phone Coordinator
Your devices talk to a coordinator: the Frostsnap app on your phone or laptop. It organizes wallets, watches the blockchain, and assembles signatures, but it is treated as untrusted.
The device checks, you verify
The system assumes your phone or computer could be compromised, so every sensitive action, signing, revealing a backup, or checking a receive address, must be confirmed on the device's own screen. Because the real details appear on the device itself, a compromised phone cannot make you approve something different from what you see.
A coordinator must earn its knowledge
It can only initiate a sensitive operation if it can prove knowledge of the group's public key, which a fresh phone learns by visiting a threshold number of devices. A stranger who plugs into a single device gets nowhere without reaching more of them. That same root public key is also what lets your phone help unlock each device's encrypted share, the subject of the next section.
Encrypted Device Secrets
What stops someone who simply steals a device and reads its memory? Each device stores its key share encrypted, and decrypting it takes two independent pieces at once:
- A secret fused into the device's own chip, which can never be read out of it, and
- The decryption key held by the coordinator, derived from the root key it learned when pairing.
Neither piece can decrypt the share by itself. Your phone keeps its decryption key inside the phone's secure element, released only behind your phone's lock screen (PIN/biometric/pattern). So to control a device's share you need either:
- • A phone with knowledge of the wallet, which therefore holds the decryption key inside its secure element, or
- • A threshold number of devices, enough to set up a fresh phone that learns the decryption key for itself.
A single stolen device is therefore useless on its own: the attacker has neither your phone's decryption key nor a threshold of your other devices. There is nothing immediately valuable to extract.
Device Backups
A backup recovery card is a raw, unencrypted copy of one device's share, but it is still only a single share: an attacker would need a threshold of them (backups or devices) to do anything, exactly as with the devices themselves. Since geographic distribution is already the primary security lever, we sometimes make the counterintuitive suggestion of storing each backup alongside its device. A backup and its device are the same share, so co-locating costs no security while protecting against losing a backup, historically a far more common cause of loss than theft.
Protecting Against Supply Chain Attacks
Frostsnap is designed so that even a tampered or counterfeit device could not compromise your wallet, through several independent lines of defense:
Secure Boot
Frostsnap devices only run firmware that has been cryptographically signed by Frostsnap using multiple of our offline keys. The check is enforced by the chip itself: the signature is verified on every boot against a factory key permanently burned into the device's eFuse. An attacker cannot flash their own firmware onto a device and have it run.
Reproducible Firmware
All Frostsnap firmware is open source, and the build is reproducible: anyone can compile the published source and confirm it produces the exact firmware we sign and ship, byte for byte. There is no gap between the code you can audit and the code running on your device, so a hidden backdoor has nowhere to hide.
Genuine Checks
Every genuine Frostsnap is provisioned at our factory with a unique secret sealed inside its chip (it can never be read out) together with a certificate signed by Frostsnap. The app can challenge a device to prove it holds that secret, confirming it is a real Frostsnap and not a counterfeit. An attacker cannot forge a certificate for hardware they control.
The Threshold Itself
Even if every safeguard above failed, the threshold remains: one compromised device is never enough, and an attacker would still need to reach a threshold of them.
The result is a wallet with no single point of trust: no single device, no single location.