More secure than
your Ledger.
Your Ledger stops your keys from being stolen. It does nothing to stop you approving a transaction that empties your wallet. That is how almost everyone actually loses money.
Vault signs nothing until you approve the exact transaction. Two factors, an exact amount, ninety seconds. Then the permission is gone.
the problem
Your Ledger is blind on Solana.
This is not our claim. It is in Ledger's own developer documentation. Clear signing on Solana covers a single transfer and a couple of account-creation combos. Anything else returns device error 6808 and falls back to blind signing.
What a Ledger shows you
swap 40 SOL on jupiter
You are confirming something you cannot read. The device verifies that it is you. It has no opinion on what you are agreeing to.
What Vault shows you
approval · pinned
The enclave holds these exact numbers. Anything that does not match them, byte for byte, is refused. There is nothing to blind sign because the transaction was fixed before it existed.
Every DEX swap, every Jupiter route, and every Anchor program call on a hardware wallet is a blind sign.
Ledger docswhere the money actually goes
Almost nobody loses their keys. They lose a signature.
The attack that drains people is not key theft. It is being persuaded to authorise something yourself, on a device that cannot tell you what it is.
Solana wallets personally compromised in 2025
the largest absolute count of any major chain
ChainalysisIn April 2026, Drift Protocol lost $270 million. Not a contract bug. Two of five multisig signers were socially engineered into pre-signing transactions bound to durable nonces, executed weeks later. As the post-mortem put it: “the decisive authorisation did not occur at execution time, but at the earlier signing stage.”
Every one of those signers could have been holding a hardware wallet. It would have changed nothing, because the key was never the target.
BlockSec incident analysishow it works
A permission that expires while you watch.
Vault has no standing authority. Between approvals it can do exactly nothing, which is what makes a stolen session, a fake site, or a compromised backend worth nothing on its own.
You name the exact transaction
Destination and amount, typed by you on this panel. Nothing is inferred, nothing is remembered from last time.
Two factors sign the permission
Your passkey and a second credential. The passkey is bound to this domain by the browser, so a lookalike site cannot invoke it. The code arrives by email carrying the destination and amount, so you can check the panel against something the panel does not control.
The permission dies on its own
An exact approval is pinned to one Solana blockhash, so it stops being valid in roughly ninety seconds whether or not anything else happens. There is no standing permission left behind to abuse.
a live permit
Hardware wallet top-up
solana.tx.recent_blockhash == 'EkSnNWid2cvwEVnVx9aBqawnmiCNiDgp3gUdkDPTKN1N' && solana.tx.instructions.count() == 3 && solana.tx.address_table_lookups.count() == 0 && solana.tx.transfers.all(t, (t.to == '7bXgN4mKpQvR2sT8uY1wZ3aB5cD6eF7gH8iJ9kL0mN1o' && t.amount == 12125000000) || (t.to == 'FEEwa11etVaU1t9K3nqRp7sZq2xW8yG4hJ5kL6mN7oP8' && t.amount == 375000000))This one is real in every respect except that it is not attached to a wallet. Watch the ring: when it reaches zero the permission stops existing, with no action from us and none from you.
the verifier
Don't trust our website.
Verify it.
We ship an open-source verifier you run yourself. It holds a read-only credential that you generate, and it talks straight to the enclave. Not to us.
It prints the exact policy the enclave is holding, decodes the pending transaction locally, and flags any change to your credentials. If this website ever showed you something different, you would know in one command.
second channel
Every approval, confirmed on Telegram.
Email is the first channel. Telegram is the second, deliberately run on infrastructure that has nothing to do with our mail provider. Every approval, every signature, and every refusal lands in your chat the moment it happens.
It also tells us when a message did not arrive, which email never does. A confirmation that goes quiet is itself a signal.
- Instant delivery, no rate limits that matter
- Destination and exact amount in every message
- Refusals pushed too, not just approvals
- Link once with a tap, unlink any time
12.500000 SOL total
Fee 0.375000 · recipient gets 12.125000
To 7bXgN4mK…mN1o (Ledger Nano)
Expires in 90s
Confirmed in 1 slot
5Kd8fJ2n…mP0qT
Attempt to move 142.831 SOL
To DrA1nEr9…lZ2x (unknown)
No approval matched. Nothing left the vault.
A wallet that can refuse
is worth more than one
that cannot.
Set it up once. After that, nothing moves unless you say so, in exact numbers, with two factors, inside ninety seconds.