Pincer1
Everything it does.
A six-legged robot that is a cold wallet. The keys sit in a secure element inside the body. A separate chip with signed firmware is the only thing that can talk to that element, and it signs only after reading the transaction itself, showing it on its own screen and feeling your hand. The main computer is treated as compromised by design.
Bench prototype. Hardware validation in progress. The source is on GitHub, MIT.
Always on
The core. None of this can be switched off, and none of it trusts the main computer.
Signs only when you are in the room
Lidar maps the room and a depth camera looks for a real, three-dimensional person. A photo or a screen does not pass. Voice is checked too. When you leave, or the robot is picked up, it locks.
Signs only with your hand on it
The touch pad is wired straight to the consent chip. Nothing on the computer side can press it for you. Risky transactions need a long touch.
Reads the transaction itself
Solana, EVM chains and Bitcoin, parsed on the consent chip, not on the computer. If what the computer claims and what the bytes say differ, it refuses.
Shows it on its own screen
Amount, destination, token, approval scope. The display belongs to the consent chip, so what you see is what gets signed.
Says it out loud
Every request is spoken before anything happens, with the age and history of the counterparty. You hear "this wallet was created three minutes ago" before you touch.
Says no for you
Drainer patterns, address poisoning, wallet-emptying sends, unlimited approvals, brand-new destinations, unknown programs, durable-nonce tricks and untrusted origins get a red screen and no signature.
PIN is a rhythm, checked in the chip
Four to eight taps on the pad. The secure element verifies it and counts attempts. Five wrong rhythms and the device wipes.
Duress wallet
A second word or a second rhythm opens a decoy wallet you funded at setup with a small, believable balance. The real wallet refuses everything until the real rhythm is tapped again.
Daily limits, per chain
Set a ceiling. Going over it for one transaction takes a long touch and applies once.
One seed, three chains
Solana, EVM (Ethereum, Base, Arbitrum and the rest) and native-segwit Bitcoin from one seed inside the NXP SE050. The keys are made there and never leave. The 24 words are shown once, on the robot's own screen.
Firmware you can check
The consent chip boots only signed firmware. Updates land in a spare slot, need your long touch, run on trial and roll back by themselves if not confirmed. The production image is reproducible and every release lists its hashes.
Approval device for the wallets you already use
A browser extension connects it to any dapp through Wallet Standard, EIP-6963 and PSBT. A request comes in, the robot reads it, you touch, it signs.
Off by default
Switch on what fits your life. Each of these sits on top of the same key safety as the core.
Room lock
Signs only at home, by its own lidar map of the room. Anywhere else, it refuses.
Two-person rule
Transactions above a threshold need a second person in the room, seen and heard.
Offline payments
Signs with a durable nonce while the radio is off and hands you a QR. Broadcast it later, from anywhere.
Air-gap relay
A hardware relay cuts the radio. Strict mode keeps it off; night mode opens short windows only when the robot asks for one.
Dead-man's switch
Your touch is proof of life. If the robot goes untouched for the period you set, a transaction you signed in advance is released to your heir. It lives on the consent chip, counts its own powered time and cannot be cancelled by wiping the device.
Wake-up alarm
A price threshold you set is hit at night. It turns to you and says what happened, louder each time, until you touch its head.
Morning briefing
What moved overnight, what the agent did, what is waiting for your touch. Spoken while you make coffee.
Overnight agent
Give it a budget with a touch before bed. It makes small moves on its own, and brings the big ones to you in the morning.
Swaps, through allowlisted routers only
Jupiter on Solana, 1inch and 0x on EVM, THORChain across chains. Exact-amount approvals, minimum output verified in the transaction, any other destination refused.
Home mapping and navigation
It maps your home once, names the rooms with you, and walks to you when a request needs you.
Charging dock
Below 20% it walks to its own dock and charges. At 90%, or when you call, it leaves.
Locator beacon
A board hidden in the body with its own battery and two radios, Find My and LoRa. It reports where the robot is if it is lifted, tampered with or wiped. Never the funds, only the location.
Machine identity on peaq
Each unit has its own key, machine NFT and DID on peaq mainnet, and signs its activation, firmware version and a weekly heartbeat on chain.
Offline or online
Offline mode: radio off, Lamport-8B on the robot, signing and offline payments still work, no cloud anywhere. Online mode: any brain, swaps, the agent, alarms.
Your choice of brain
Lamport-8B running on the robot, or Claude, ChatGPT or DeepSeek when online. Whichever brain talks, the consent chip signs.
The body
What is in the box, and the numbers we are building to.
- Legs
- Six, tripod, ripple and wave gaits
- Head
- Camera arm, display, touch pad
- Senses
- Lidar, depth camera, microphones, IMU
- Secure chip
- NXP SE050, keys never exported
- Consent chip
- RP2350, signed firmware, own display
- Main computer
- Jetson Orin Nano, treated as untrusted
- Battery
- 200 Wh pack. 160+ minutes walking, 10+ hours on watch
- Charging
- Walks to its own dock below 20%, leaves at 90%
- Software
- Open source, MIT, on GitHub