Firmware Signing
Firmware signing is the manufacturer's digital signature on each firmware release, which a hardware wallet verifies before it installs or runs the code.
What Is Firmware Signing?
Firmware signing is the practice of attaching the manufacturer's digital signature to every firmware release, so that a hardware wallet can check where an update comes from before running it. The vendor signs a hash of the firmware with a private key kept offline; the matching public key is built into the device's bootloader.
When an update is installed, and on many devices at every start, the bootloader recalculates the hash and verifies the signature. Firmware that was modified, corrupted in transit or built by someone else fails the check and is refused or flagged with a clear warning. Some vendors require signatures from several key holders, so that one compromised person or key is not enough to release an update.
This blocks a common attack path: a fake update offered through a phishing site or pushed by malware on the computer. Some open-source devices still let owners install unsigned firmware of their own, typically after wiping the stored keys and with a warning at startup.
A valid signature proves origin, not quality. Signed firmware can still contain bugs, and the scheme relies on the vendor protecting its signing keys. Open-source code and reproducible builds complement it by letting outsiders confirm that the signed binary matches the published source.
Firmware is the software that runs on a hardware wallet itself: it generates keys, shows transaction details on the screen and signs.
Read full definition: FirmwareA digital signature is a cryptographic method that uses a private key to sign blockchain transactions, verifiable with the public key to prove authenticity and prevent tampering.
Read full definition: Digital SignatureA hardware wallet is a dedicated device that keeps private keys offline and signs transactions internally, so the keys never reach an internet-connected computer or phone.
A private key is the secret number that proves ownership of a crypto address and signs its transactions. Whoever has it controls the funds.
A public key is computed from a private key and lets anyone verify its signatures. Addresses are derived from public keys; knowing one does not allow spending.
Read full definition: Public KeyA bootloader is a small program that initializes hardware and loads the main operating system or firmware on a device, often used in blockchain hardware wallets for secure startup.
Read full definition: BootloaderMalware is malicious software that steals or redirects crypto, for example by logging keystrokes, swapping copied addresses or reading wallet files.
Read full definition: MalwareReproducible Builds refer to the process where the same source code consistently produces identical binary outputs, ensuring verifiable and trustworthy software in blockchain and crypto projects.
Read full definition: Reproducible BuildsReal-World Examples
Example 1: A Coinkite Coldcard Q user downloads a firmware file for a microSD update and first compares its checksum with the PGP-signed list that Coinkite publishes. The device then verifies the signature itself before installing.
Example 2: A phishing email links to an “urgent security update”. The file is not signed by the manufacturer, so the wallet's bootloader refuses to install it.
Firmware is the software that runs on a hardware wallet itself: it generates keys, shows transaction details on the screen and signs.
Read full definition: FirmwareColdcard is an air-gapped hardware wallet for Bitcoin, made by Coinkite, that stores private keys offline and signs transactions without internet exposure.
Read full definition: ColdcardA bootloader is a small program that initializes hardware and loads the main operating system or firmware on a device, often used in blockchain hardware wallets for secure startup.
Read full definition: BootloaderFrequently Asked Questions
Does a valid signature mean the firmware has no bugs?
No. A valid signature proves origin, not quality: it shows that the release came from the holder of the vendor's signing key. Signed firmware can still contain bugs, and the scheme relies on the vendor protecting its keys. Open-source code and reproducible builds complement it by letting outsiders check the signed binary against the published source.
What happens if I try to install a firmware file from a phishing email?
The bootloader recalculates the hash of the file and verifies the signature against the vendor key built into the device. A file not signed by the manufacturer fails the check and is refused or flagged with a clear warning. This blocks fake updates offered through phishing sites or pushed by malware on the computer.
Can I run my own firmware on a wallet that checks signatures?
On some open-source devices, yes. They let owners install unsigned firmware of their own, typically after wiping the stored keys and with a warning at startup. On other devices the bootloader accepts only vendor-signed code. Either way, unsigned firmware is not the vendor's release, and the device makes that visible.
Ready to Choose a Secure Wallet?
Use our tools to find the right hardware wallet for your needs.