Security
Built for a computer that is already compromised
Most thefts start on an ordinary computer, not in the cryptography. AirNox is designed on the assumption that yours is already lost.
Three setups side by side
- The usual setup
A classic extension wallet
It runs inside the most exposed program on the computer. Its secrets are sealed with encryption that modern graphics cards brute-force at scale.
- Level 1
AirNox Wallet on the desktop
Native C++, with no script engine to inject into. The seed sits in memory only while needed, every request is decoded and screened, and stored secrets are sealed with Argon2id and the TPM 2.0 chip.
- Level 2, AirGap
AirNox Vault on a phone
The seed moves to an offline phone. An attacker who owns the whole operating system finds nothing on the computer to copy.
Eight attacks, three setups
What each setup leaves open
The extension is exposed to every move. The native desktop wallet closes almost all of them. AirGap closes what is left.
| Attack | Extension walletin the browser | AirNox Walletdesktop, native | AirNox VaultAirGap |
|---|---|---|---|
| Copy the seed | exposed | protected | protected |
| Injected or malicious code | exposed | protected | protected |
| Change what you approve | exposed | protected | protected |
| GPU brute-force of secrets | exposed | protected | protected |
| Screen capture | exposed | protected | protected |
| Swap the recipient | exposed | reduced | reduced |
| Trackers and ads | exposed | protected | protected |
| Compromised operating system | exposed | reduced | protected |
Swapping the recipient stays partly open everywhere, because address poisoning targets your eyes rather than the software. The address pictures on both devices are there to catch it.
The series
Twelve parts, one at a time
-
Assume the computer is compromised
Funds rarely leave a wallet because someone broke the cryptography. They leave through a poisoned package, a rogue extension update or a swapped clipboard. In AirGap mode the desktop holds only addresses, and the key sits on a phone that never goes online.
5 min read
-
Mass Adoption Security: the signer is a phone you already own
A dedicated signing device travels a known route from the factory to your desk, and the buyer ends up in a customer database. A phone you already own skips both: nothing marks it as a signer, so there is no shelf to tamper with and no list to leak.
5 min read
-
Three ways across the gap: QR codes, Bluetooth LE and NFC
QR codes are the strict air gap: only light crosses. Bluetooth LE suits a session at the desk, NFC a deliberate tap at a terminal. None of the three is trusted on its own, so picking the convenient one does not lower the bar.
4 min read
-
Invisible on the air: a signer nobody can scan for
A radio that says "wallet here" makes the phone easy to find and follow. AirNox Vault transmits only while the app is open and in front, with no name, a random address and an identifier that changes every few minutes.
4 min read
-
The transport is never trusted
Bluetooth, NFC and QR codes have each been attacked in public, so none of them counts as proof of anything. You pair once by comparing a short code on both screens; after that every message travels end-to-end encrypted and mutually authenticated.
4 min read
-
What the phone shows you: transaction analysis on the signer
Most thefts happen with the owner's consent: a page shows one transaction and asks for another. The phone decodes the request from the bytes it will sign, and look-alike methods, unlimited allowances and unknown spenders keep Accept locked until you acknowledge them.
5 min read
-
The phone keeps its own record
When a transaction you do not recognise turns up, you need a record the infected computer cannot edit. The phone writes every signature, refusal, pairing and lockout to an encrypted journal before it signs, and the journal never leaves the phone.
4 min read
-
The vault on your desktop: Argon2id and a profile that resists guessing
A stolen wallet file is only as safe as the password on it. AirNox Wallet stretches that password with memory-hard Argon2id, tuned so one guess costs about a second on your machine, and anchors the profile in the TPM 2.0 chip where the computer has one.
4 min read
-
dApps without a browser wallet
A classic extension wallet keeps the keys inside the browser, the most exposed program on the computer. The AirNox extension speaks the standard interfaces but holds no keys; permissions are granted on the desktop, per site and per chain.
4 min read
-
An MCP server with rules: AI agents under limits
Handing an AI agent a private key hands it everything. The built-in MCP server refuses every request by default: you choose the wallets, the operations and the fiat limits, every call is logged, and in AirGap mode the phone still signs.
4 min read
-
One protected wallet for all of it
Keeping keys offline should not cost you networks, swaps or bridges. AirNox Wallet covers Bitcoin, EVM networks, TRON, TON, Solana and Sui, checks each swap approval against the router that quoted it, and draws a picture for every address so look-alikes stand out.
5 min read
-
Small and native: C++, no JavaScript runtime, from a workstation to a Raspberry Pi
Many wallet compromises travel through package ecosystems and script injection. AirNox Wallet is native C++ and Qt with no JavaScript runtime, no web view and no telemetry, so there is no page to inject into and nothing that phones home.
3 min read
What this does not fix
An offline signer shows you the truth about what you are signing. It cannot stop you from agreeing to it. Your seed backup is still your responsibility, on paper or steel rather than in a password manager. And no wallet protects you from someone who makes you unlock it. We would rather you hear the limits from us than discover them yourself.
Join the waitlist
Leave your email and we will send release news. Nothing else.