How a wallet turns a seed into keys and addresses, and where that process goes wrong. The category covers BIP-32 and BIP-39 derivation, the secure elements and PIN stretching inside COLDCARD and Trezor, MetaMask's stored secrets, and an entropy defect that produced seeds far weaker than intended.
Alongside the hardware are the other places keys live: multisig setups on Gnosis Safe, custody services built on AWS Nitro Enclaves, and smart contract wallets under ERC-4337 and EIP-7702, with their nonce, deployment and delegation pitfalls. Several articles are threat models rather than walkthroughs, including one on designing for an attacker who has both the device and its owner.
15 posts
How Circle's UpgradableMSCA implements an ERC-6900 modular account: validation entities, hook ordering, ERC-7201 storage, and the factory that deploys it.
2026, Sep 09 —
A line-by-line reading of Circle's SponsorPaymaster, the ERC-4337 v0.7 verifying paymaster behind gasless Circle wallets, and the design choices behind it.
2026, Sep 09 —
How hardware wallets handle an attacker who has both the device and the user - duress PINs, decoy wallets, delta mode, passive wipe triggers - and where each defence stops working.
2026, Jul 31 —
A wallet firmware generated seeds with far less entropy than intended because a linker resolved rng_get() to a software PRNG. How the defect worked, why XOR whitening hid it, and what catches this class of bug.
2026, Jul 31 —
How the COLDCARD hardware wallet firmware works - the bootloader/MicroPython split, dual secure elements, PIN key stretching, trick PINs, signed firmware, and reproducible builds.
2026, Jul 31 —
A walkthrough of Alchemy's ERC-4337 stack — Modular Account V2 and its semi-modular variants, validation selection through the UserOperation nonce, deferred actions, session-key permission modules, the Rundler bundler, and the hosted Wallet APIs.
2026, Jul 30 —
Understanding the dual nonce system in ERC-4337 smart wallets, the differences between CREATE and CREATE2 for contract deployment, and the pitfalls encountered with EIP-7702 delegation.
2026, Feb 17 —
A practical security analysis of EIP-7702 smart wallets covering initialization front-running, access control, signature replay, dual nonce systems, and residual risks inherent to EOA code delegation.
2026, Feb 17 —
Deep dive into blockchain wallets with Circle and Fireblocks and explore how they use AWS services such as AWS Nitro Enclave
2025, Jul 29 —
This article is a deep dive into the generation of private keys until obtaining a public address through the main related BIPs - BIP-32 and BIP-39
2025, Mar 27 —
This article explains the generation of private keys in Bitcoin until obtaining a public address and the different type of addresses.
2024, Oct 28 —
This article presents the different types of crypto wallets (hot, warm, cold) and their associated risks
2024, Oct 15 —
This article presents the different types of crypto wallets (hot, warm, cold) and their associated risks
2024, Oct 08 —
This article focuses on the different secrets available on Metamask, one of the most used crypto wallets.
2023, Jul 20 —
This tutorial present the different steps to create a multi signature wallet with Gnosis Safe on Ethereum.
2022, Aug 12 —
