PhysiKey Quantum
Coming soonUSDC on Base with a hybrid ECDSA + ML-DSA-44 smart account. The card + password derives both a secp256k1 key and a post-quantum FIPS 204 key, and the account only accepts a transaction when both have signed.
Open source · MIT licensed
PhysiKey: Cold storage on a $0.10 NFC tag.
PhysiKey turns an ordinary NXP NTAG sticker or card into a blockchain hardware key. The card holds random entropy, your password is combined with the card entropy to create an ephemeral key, and the private key exists only for the moment it’s needed. No $50 device, and no manufacturer or supply chain to trust.
How it works
One key-management primitive, shared by every PhysiKey app.
-
1
Write entropy
The app writes 32 bytes of secure random entropy to the tag as an NDEF record, then locks it against accidental overwrite.
-
2
Tap + password
To sign, you tap the card and enter your password. Argon2id stretches card entropy + password into key material.
-
3
Sign, then forget
The key is derived, signs the transaction, and is zeroed. Nothing secret is stored on the phone or in the Keychain in long-term memory.
// card + password → key (Bit Wand derivation)
a = hex( Argon2id(cardSecret + password, salt, t=2, m=32 MiB, p=2) )
privateKey = SHA256( SHA256(a) + a )
address = P2WPKH( publicKey(privateKey) ) // bc1q… / tb1q…Neither half is enough. A stolen card is useless without the password, and every guess costs an Argon2id run.
Every password is a wallet. Like a 25th-word passphrase, each password derives a separate set of keys.
Gas-free for users. The USDC apps use ERC-4337 smart accounts with a Pimlico paymaster, so users only ever hold USDC.
Repositories
Fork them, audit them, build on them. Every app is React Native for iOS and Android.
PhysiKey Card
USDC · BaseTurns an NFC sticker into a cold-storage key card for a USDC wallet on Base. Three-tap setup on NTAG 213/215, an ERC-4337 smart account and a paymaster so the developer covers gas.
Bit Wand
BitcoinAn NFC tag plus a password is the Bitcoin wallet. Native SegWit addresses, and a built-in point-of-sale mode: a merchant types an amount and the customer taps to pay.
PhysiKey Prototype
EthereumThe original proof of concept for the key-management primitive: generate entropy, write it to an NFC card, and sign Ethereum transactions with a tap and a password.
⚠️ Use at your own risk
This software moves real funds and has not been independently audited. Read each repository’s security model before forking for production, and develop on testnet (Base Sepolia, Bitcoin testnet) first. Whoever’s phone you tap on holds your private key at that moment.
Found a vulnerability? Please report it privately as described in each repository’s SECURITY.md.