A hardware wallet.
With a body.
Pincer1 is a six-legged companion for traders, founders and families who hold crypto at home. It sees and hears its owner, explains each transaction, and requires a physical touch for ordinary signing. One seed, every major chain: Solana, Ethereum and the EVM networks, Bitcoin.
Pincer1 / Black & graphiteYour keys.
In the machine.
- Key custody
- NXP SE050 secure element
- Physical approval
- RP2350 consent controller
- Chains
- Solana · Ethereum & EVM · Bitcoin
Black & graphite. Every major chain.
Pincer1 presaleA wallet that can
see, hear and explain.
See the request. Hear the details. Touch to approve. Pincer1 brings the signing decision into the room, with dedicated hardware between your apps and your keys.
01Presence-gated approvalFour checks before ordinary signing.+
Pincer1 combines lidar presence detection, face matching with moving-viewpoint liveness checks, a spoken passphrase with speaker verification, and a physical touch.
- 01Presence
Lidar looks for a three-dimensional person in the room.
- 02Face
The moving depth camera checks the enrolled owner.
- 03Voice
A passphrase is checked against the owner’s voice.
- 04Touch
A dedicated input goes directly to the RP2350.
Presence models run on the untrusted Jetson. The controller’s transaction checks and dedicated touch input form the signing boundary.
02Transaction readingHear what you are about to approve.+
The robot explains the amount, destination and available address history aloud. The consent controller independently parses the transaction bytes, compares them with the main computer’s claims, and shows its own reading on a small display wired to the controller alone; what you touch to approve is what that display shows. Hidden instructions, authority changes and unlimited approvals are flagged.
“0.5 SOL to an address created 3 days ago with no history.”Illustrative transaction explanation.
03Scam filteringReview the request before it reaches your keys.+
The software checks for drainer patterns, address poisoning, fake airdrops, malicious delegations and unfamiliar programs. Refusal policies are implemented on the consent controller as well as in the interface. The owner remains the final authority on correctly disclosed risks.
Scam filtering does not guarantee that every harmful transaction will be detected.
04Approval for appsConnect the browser. Confirm on the robot.+
The Chrome extension registers Pincer1 as a Solana wallet alongside options such as Phantom and Solflare. It forwards requests to the robot for explanation, policy checks and physical approval. The extension is treated as untrusted input.
05Duress modeA separate response when something is wrong.+
A hidden word, or a second tap rhythm entered where you would tap your PIN, opens a decoy wallet and locks the real one. The rhythm is verified inside the secure element next to the real PIN, and the robot answers exactly as it does for a normal unlock: nothing on the screen or the wire shows which wallet is open. You fund the decoy at setup with a small, believable balance. The spoken word also issues a silent alert. Lifting, bagging or losing sight of the owner closes the active signing session.
06A companionConversation with a physical presence.+
Pincer1 talks, listens, remembers and responds when called, with a personality its owner can shape. Choose a local language model or an optional Claude connection for conversation. Camera and microphone perception runs locally.
Cloud conversation is optional and selected by the owner.
07Secure-element custodyKeys and approval have dedicated hardware.+
Pincer1 keeps signing keys inside an NXP SE050, with an Ed25519 signing path for Solana, and connects it to signed controller firmware over an encrypted channel. A rhythm-based PIN is checked inside the chip with a five-attempt limit. Setup shows the 24-word recovery phrase only on the controller’s own display, never over any cable; it is intended for offline storage.
The recovery phrase is a separate backup secret; anyone who obtains it may bypass the robot.
Designed as
a complete system.
A robotics platform built around a Jetson Orin Nano Super, a four-axis camera arm and an aluminium hexapod chassis.
An articulated point of view.
A Luxonis OAK-D Lite stereo depth camera sits on a four-axis arm. The moving viewpoint supports face and liveness checks; a RPLIDAR C1 supplies room and presence data.
One computer can ask.
One controller can approve.
The Jetson and browser extension are treated as untrusted. The RP2350 parses transaction bytes itself, checks the claims and controls the only connection to the secure element. Ordinary signing requires its dedicated touch input.
The untrusted computer.
The Jetson runs networking, transaction explanations, face and voice models, and the agent. It is treated as potentially compromised and has no direct authority to request a signature from the chip.
The controller re-parses transaction bytes and rejects understated claims. Pincer1 pairs signed firmware and secure boot with an encrypted SE050 channel, using channel keys provisioned into RP2350 one-time-programmable memory.
Physical consent, with explicit exceptions.
Ordinary transactions require a touch. The optional overnight agent uses a budget granted on the controller by a long touch, with automatic expiry. Optional inheritance uses a transaction signed in advance and a controller-held timer. These are separate, owner-enabled flows.
What the model does not cover.
A stolen recovery phrase, or an owner who approves a correctly warned harmful transaction, remains outside the protection model. Sensor checks and optional behaviors are not equivalent to chip-level key protection.
NXP describes the SE050 family as Common Criteria EAL6+ certified up to OS level. This is a component certification, not certification of Pincer1. NXP component information
Hardware overviewView the specified components +
- Body
- Hexapod; 18 feedback serial-bus servos; 3 mm aluminium plates
- Arm & camera
- Four-axis arm; Luxonis OAK-D Lite stereo depth camera
- Front display
- 4.3-inch IPS; transaction amount and destination
- Main computer
- NVIDIA Jetson Orin Nano Super 8 GB; encrypted NVMe; secure boot
- Consent module
- Raspberry Pi Pico 2 / RP2350; SE050; dedicated capacitive touch; radio relay
- Sensors
- Slamtec RPLIDAR C1 360° 2D lidar; IMU; four-microphone array; speakers
- Power
- 3S Li-ion 21700 pack, approximately 200 Wh
- Estimated runtime
- 4–5 hours active; 10+ hours standing watch
- Optional dock
- Underbody pogo contacts; floor plate; battery monitoring
- Initial ecosystem
- Solana; chain-agnostic design
- Recovery
- 24-word backup phrase at setup; offline storage required
- Availability
- View presale information
More capable.
Only when you choose.
Each option is enabled individually by the owner. Optional capabilities stay off until you choose them, and cannot be activated remotely.
Room lock+
Use lidar room fingerprints or a home map to allow signing only in an enrolled location.
Two-person rule+
Above an owner-defined threshold, require two enrolled people to be present, using body counting and face matching.
Offline payments+
Prepare durable-nonce transactions without a network. Show a signed transaction as a QR code or retain it for later broadcast, subject to nonce validity.
Air-gap relay+
Physically switch radio power according to presence or an owner-authorised agent window.
Inheritance / dead-man’s switch+
Pre-sign a transfer to a named heir. A timer on the consent controller tracks powered time and resets its proof-of-life state only on the owner’s touch, with advance warnings.
Wake-up alarm+
Set an asset or portfolio threshold: “If my holdings drop 15%, wake me.” The robot finds you and escalates the alert until touched, or rings your phone when you are away. Quiet hours are owner-controlled.
Mapping & navigation+
Map the home with lidar, name rooms while standing in them, and navigate between them.
Charging dock+
Return to the dock below 20% charge, then leave at 90% or when called. Uses underbody pogo contacts and a floor plate.
Overnight agent+
Grant a budget with a long touch before bed. The agent monitors portfolio and smart-money activity, executes within the controller-authorised allowance, and presents larger proposed moves in a morning report. Allowances expire automatically; keys remain in the secure element.
Locator beacon+
A hidden board with its own battery, GPS and two radios. If the robot is carried off, tampered with, or you use the duress word, it reports its position over Apple’s Find My network and over LoRa to your base station, with no internet on the robot. A thief gets a machine that cannot sign and tells you where it is.
Offline and online modes+
Offline: the radio stays physically off except when needed, the brain is Lamport-8B, nothing leaves the robot. Online: Wi-Fi stays on, any brain, the overnight agent, and swaps straight from the wallet through allowlisted routers only (Jupiter on Solana, 1inch and 0x on EVM, THORChain across chains), with the minimum output embedded in the transaction and verified before you touch.
Choose the brain+
The companion’s conversation runs on Lamport-8B, our own crypto-specific model on the robot, trained to recognise phishing, scams and theft patterns, or on Claude, ChatGPT or DeepSeek through their APIs. Whichever brain you pick, it only talks: no security decision comes from it.
What people ask
before they trust it.
Short answers. The long ones, with the threat model, are in the security document in the repository.
Who controls the private keys?+
You do. Nobody else, including us. The keys are generated inside a certified secure element and never leave it. The chip does not expose them to the robot’s main computer, to Wi-Fi, to our servers or to our staff; it only answers “sign this” requests from a small controller inside the robot, and that controller only asks after it has re-read the transaction itself and felt your touch. Lamport Robotics has no copy of your keys, no recovery back door, and no way to move your funds.
What if the chip fails or the robot is damaged?+
Your crypto is on the blockchain; the robot only holds the key. At setup it shows a 24-word recovery phrase once. Those words are the master copy of every key it holds, on the standard derivation paths every wallet uses. If the chip dies, the robot is crushed or stolen, or we disappear, type the words into a new Pincer1 or any standard wallet and you have everything back. The decoy wallet has its own 24 words; keep both, on paper or metal, never on a phone or in the cloud.
How is this different from a Ledger?+
A hardware wallet proves someone holds the key and pressed a button. Pincer1 proves you are there: it sees a real person with its lidar, matches your face and voice, and reads the transaction out loud with the counterparty’s history before you touch it. It refuses drainers and unlimited approvals on its own, locks when it is moved, opens a decoy under duress, can work for you overnight inside a budget you granted by touch, and can pass your wallet to an heir if you never come back. Key storage is the same class of certified chip. Everything it claims is open source.
Does it need the internet?+
Not to keep your keys safe or to sign. Signing, presence checks, offline payments and the on-robot brain work with the radio off. Broadcasting a transaction, price alerts, swaps and cloud brains need a connection, and in online mode the robot keeps one; in offline mode it switches its own radio on only when you ask it to send something.
What happens if it is stolen?+
The thief gets a robot that cannot sign. It locks the moment it is lifted, the PIN is verified inside the chip and wipes the device after five wrong tries, signed firmware and secure boot stop a swapped controller, and with the optional beacon it reports where it is. Your funds stay recoverable from your 24 words.
What if someone forces me to open it?+
You open the decoy. Say the hidden word, or tap your duress rhythm instead of your PIN. The robot unlocks as usual, with the same words and the same screen, but the wallet it opens is the decoy you funded at setup with a small, believable balance. The real wallet refuses everything until your real rhythm. Fund the decoy properly: an empty one convinces nobody.
Which chains?+
Solana, Ethereum and the EVM networks (Base, Arbitrum, BNB Chain, Polygon), and Bitcoin, from one seed. Pincer1 appears next to Phantom on Solana apps, next to MetaMask on EVM apps, and as a Bitcoin wallet on PSBT apps. Each chain has its own parser on the consent controller.
Know what holds
your keys.
Explore the systems behind Pincer1, from the physical consent controller to the companion software.
Our open-source repository brings together firmware, robot software, the browser extension, hardware documentation, protocols and the security model.
Explore the repositoryLamport Robotics
A lamport is the smallest unit of SOL. Our name also nods to Leslie Lamport’s work on distributed systems. We build physical machines around digital ownership.
Read the code and security modelPincer1.
At home with you.
First edition.
Presale coming soon.