Cryptnox Crypto Hardware Wallet — Smart Card Cold Storage with Dual-Card Backup

Frequently Asked Questions

Which cryptocurrencies does the Cryptnox hardware wallet support?

The Cryptnox hardware wallet card supports a wide range of cryptocurrencies through the free Cryptnox app — Bitcoin, Ethereum and the 1,000+ EVM-compatible tokens and altcoins, Tron (TRX and TRC-20 tokens), and XRP (XRP Ledger). The full list of coins and blockchains pre-programmed in the app is published at cryptnox.com/coin-blockchain-support — additional EVM-compatible networks and tokens can be added manually for advanced users, along with supported custom tokens on Tron and XRP. Through WalletConnect, you can also use the card with DeFi aggregators, DEXs, NFT marketplaces, and bridge aggregators on Ethereum and other EVM-compatible networks supported by the Cryptnox app.

Is this a cold storage wallet?

Yes — it’s a true cold-storage device. Private keys are generated inside the card’s EAL6+ secure element and never leave it. The card only signs transactions when tapped against your phone via NFC; between taps, nothing is online. That’s colder than any USB hardware wallet that plugs into a networked laptop.

Do the cards ship pre-initialized? How do I set them up?

No — the cards always ship blank, for a critical security reason: nobody between the chip foundry and your hands ever sees your seed. You initialize the cards yourself in the Cryptnox app, using one of three methods:

• Paired dual-card ceremony (recommended for the Dual Card Set): with both cards present, the Cryptnox app guides you through a brief interactive mini-ceremony. The seed is computed inside both secure elements via a three-step ECDH exchange using randomness from the two cards’ on-chip TRNGs, and committed to both cards immediately one after the other — it never exists outside the two secure elements. You get a primary card plus a built-in backup, with no 24-word seed phrase to write down.
• External seed injection: inject an existing 12/24-word BIP39 seed via the Cryptnox app — useful if you’re migrating from another wallet (Ledger, Trezor, MetaMask, etc.) and want to keep the same seed, or if you want to keep a copy of the seed off-card under your own protection. Both Dual Card Set cards can be loaded with the same injected seed.
• Single-card random init: a single card initializes itself with a random seed pulled from its on-chip certified TRNG. There is no backup — only suitable for short-term holdings or specific experimental use cases.

For the paired dual-card ceremony and single-card random init, the seed is produced by an on-chip TRNG (true random number generator) that is part of the chip’s Common Criteria EAL6+ certification — every TRNG-generated seed is equally likely, and impossible to predict in advance, even by Cryptnox. External seed injection (Method 2) bypasses the on-chip TRNG and uses a 12/24-word BIP39 seed you supply.

How is the Cryptnox “dual card” different from a single hardware wallet?

The Dual Card Set arrives uninitialized — both cards are blank when you receive them. Once you have the cards in hand, the Cryptnox app guides you through a brief paired-card ceremony where both cards compute the same seed inside their secure elements via a three-step ECDH exchange using randomness from the on-chip TRNGs. The seed is committed to both cards immediately one after the other and never exists outside the two secure elements. The first card is your daily-use card; the second is your built-in backup, stored somewhere safe. If the main card is ever lost or damaged, the backup restores full access instantly — no 24-word seed phrase to write down or protect. Alternatively, both cards can be loaded with a 12/24-word BIP39 seed injected via the Cryptnox app, if you’re migrating from another wallet or want to keep a copy of the seed off-card.

Does the Cryptnox wallet work with MetaMask, Uniswap, and other dApps?

Yes — through two standard integrations depending on the platform:

• MetaMask browser extension: pair Cryptnox via the QR-based wallet-signing standard. MetaMask handles dApp connection and transaction building in the browser; the Cryptnox card signs each transaction on-device after a phone tap. You keep MetaMask’s familiar dApp UX with hardware-wallet-level security underneath.
• DeFi platforms (Uniswap, Aave, bridge aggregators, NFT marketplaces, etc.): connect via WalletConnect. The dApp displays a QR code, you scan it in the Cryptnox app, and sign the transaction by tapping your card against your phone.

In both paths, your private keys never leave the card’s secure element.

How do I actually sign a transaction — app, cable, or what?

You install the free Cryptnox app on iOS or Android, connect your hardware wallet card by tapping it against your phone (NFC), and confirm transactions in the app. For desktop browsers, scan a WalletConnect QR code with the app and sign on your phone. For normal mobile use: no USB cables, no batteries, no charging. Optional Cryptnox readers are available for desktop workflows.

What makes Cryptnox unique vs. a Ledger or Trezor seed-phrase wallet?

Three things, all from the paired dual-card ceremony that ships with every Cryptnox Dual Card Set:

1. The seed is never displayed in the clear — ever. Traditional hardware wallets generate a 12/24-word seed phrase that you must read off the device's screen and write down on paper. That moment, and that piece of paper, is the single biggest attack surface in self-custody (theft, photography, weak storage, social engineering). Cryptnox doesn't have that moment. The seed is computed inside both Secure Elements simultaneously via a three-step ECDH exchange (dual-generation mode) and committed to both cards immediately one after the other. It never appears on any screen, never gets written down, and cannot be seen — not by you, not by Cryptnox, not by anyone, not even briefly. There is nothing to photograph, nothing to memorize, nothing to lose.
2. Built-in backup, generated atomically with the primary. Instead of "write down a seed phrase and hide it somewhere," you get a second physical card that already holds the same seed. The backup is identical to the primary but you never use it for daily signing — it sits in the NFC-shielded casing alongside the pre-printed Access Card (PIN/PUK) somewhere safe. If you ever lose or damage the primary, the backup restores full access instantly with a single tap.
3. Fast: under 23 seconds end to end. Tap card 1, tap card 2, ceremony completes — both cards are initialized with matching seeds and ready to use. The Access Card is already factory-printed with your PIN and PUK, so there is no key-ceremony setup overhead. Store the Access Card together with the backup card in the casing, and you're done.

Underneath, the chip is the same Common Criteria EAL6+ class used in electronic passports and national ID cards — a high-assurance secure element with Common Criteria EAL6+ certification. The difference is what Cryptnox does around that chip: it removes the seed-phrase ritual entirely and replaces it with a pair of physical cards that share a never-displayed seed.

For the step-by-step procedure, see the Dual Card setup tutorial.

Can I also use the wallet cards as FIDO2 security keys?

Yes — both wallet cards in the Dual Card Set are dual-tech. Each runs the same FIDO2 2.1 stack as the standalone Cryptnox FIDO2 (non-MIFARE) cards, so either can be registered with any service that supports FIDO2 / WebAuthn as a 2FA or MFA security key, and as a passwordless authenticator on the services that support FIDO2 passwordless (Microsoft Entra, Google, login.gov, AGOV, etc.). This is an accessory feature; the card's primary role is crypto cold storage. If your primary need is MFA / passwordless login rather than crypto custody, consider the standalone Cryptnox FIDO2 cards instead — they’re optimized for that role.

If the Cryptnox mobile app is ever unavailable, can I still access my coins?

Yes. Your funds do not depend on Cryptnox-the-company continuing to ship a mobile app. The card runs standard cryptographic primitives (SLIP-0010 / BIP32 hierarchical key derivation with secp256k1 and secp256R1 / NIST P-256 signing) on a Common Criteria EAL6+ secure element and speaks over standard ISO 7816 contact / ISO 14443 NFC interfaces. There are several escape paths:

1. Use the free desktop app, or the open-source CLI available on GitHub. The desktop app ships on Windows (Microsoft Store), macOS (Homebrew tap), and Linux (Snapcraft); the cross-platform Cryptnox CLI is open source on GitHub. With your card and the PIN you set at initialization (or the factory PIN printed on your Access Card), you can authenticate to the card and sign transactions from any computer with a smart-card reader — see cryptnox.com/get-software.
2. Use the open-source primitives directly. The card's protocol is documented in the open-source codebase, so any sufficiently technical user (or a third-party tool you trust) can reproduce the signing flow without depending on Cryptnox software at all.
3. If you used Method 2 (external seed injection). You initialized the cards with a 12/24-word BIP39 seed of your own. That seed is yours; you can re-import it into any other BIP39-compatible wallet at any time.

How does the open-source CLI authenticate to the card?

The CLI accepts either the card PIN, or a hardware-backed user public key (RSA 2048 or P-256 / NIST) that you have loaded onto the card. With key-based auth, the CLI signs a challenge from the card using a private key held in a Windows TPM (via Windows Hello) or a YubiKey PIV slot (cross-platform: macOS, Windows, and Linux) — no PIN typed on the desktop, two physical factors required for signing.

Between the open-source codebase, the standard cryptography, and (optionally) your own seed phrase, your funds are not locked to a single vendor. The Access Card you receive in the box is the long-term escape hatch: keep it together with the backup card in the NFC-shielded casing and you have everything needed to recover, in any future scenario.

Is the Cryptnox Hardware Wallet FIDO2 certified?

The Hardware Wallet ships with two applets on the same secure-element chip:

• Cryptnox Hardware Wallet applet (primary, for BIP32 / SLIP-10 key derivation and Bitcoin / Ethereum signing) — no applet-level certification; relies on the chip-platform certifications.
• Cryptnox FIDO2 applet (shipped as accessory) — FIDO Alliance Certified, FIDO2 v2.1 + CTAP Level 1. The same FIDO2 cert as our standalone FIDO2 cards.

So yes, the Hardware Wallet doubles as a FIDO Certified FIDO2 / WebAuthn security key for logging into Google, Microsoft, GitHub, login.gov, AGOV, SwissID, and any service supporting external FIDO2 keys.

What certifications does the Cryptnox Hardware Wallet carry?

Three layers of certification:

• Underlying chip platform (NXP JCOP 4 on P71D321): Common Criteria EAL 6+ augmented (NSCIB-CC-180212_3) and FIPS 140-2 Overall Level 3 with Physical Security at Level 4 — NIST CMVP certificate #3746.
• Cryptnox FIDO2 applet (shipped alongside the wallet applet): FIDO Alliance Certified — FIDO2 v2.1 + CTAP Level 1.
• Cryptnox Hardware Wallet applet: no applet-level certification — it relies on the chip-platform certifications above for the security guarantees on key material.

Which elliptic curves does the Cryptnox Hardware Wallet support?

The Hardware Wallet applet uses two curves:

• Secp256k1 (also known as the Koblitz / Bitcoin curve) — the canonical curve for Bitcoin (BTC), Ethereum (ETH and ERC-20 tokens), BNB Chain (BEP-20), Tron (TRX and TRC-20), and most major blockchains.
• NIST P-256 (P-256 r1) — used for FIDO2 / WebAuthn flows and some smart-card authentication.

Both curves are accelerated on the chip’s ECC coprocessor. The bundled Cryptnox FIDO2 applet additionally uses only NIST P-256 (per the FIDO2 spec).