Mentioned in This Article
1. Ethereum Foundation brings a signer to the Passport Prime hardware wallet
The Ethereum Foundation (EF) is launching a signing app called the Universal Ethereum Signer on the Passport Prime hardware wallet, according to Zach Herbert, co-founder and chief executive of device maker Foundation. Speaking in an October 22 interview, Herbert said the app, written by Ledger co-founder Nicolas Bacca, will run on KeyOS, the operating system that powers Passport Prime.
Herbert described the project as the first time the EF has collaborated on a signing app designed to run on hardware wallet-like devices. That makes it a notable step for the organization, which supports research and development across the Ethereum ecosystem but has not previously put its name behind software for this category of device.
The app is not yet available to the public. As of November 4, neither the EF nor Foundation had posted publicly about it, and the code carries clear warnings that it is still at an early stage.
2. What is the Universal Ethereum Signer?
The Universal Ethereum Signer is an app that lets a hardware device sign Ethereum transactions. Its code sits in a public GitHub repository under the Ethereum organization, where it is described as a reference implementation for Ethereum hardware signers, meaning it is intended as a model that shows how such software should work.
A signing app is the part of a hardware wallet that handles the most sensitive step in any crypto transaction: approving it with a private key. The key stays on the device, and the app is responsible for presenting the transaction to the user and producing the signature that authorizes it. Because so much depends on this step, the quality and security of signing software matter a great deal to anyone holding funds on a hardware device.
The repository lists no releases so far. It notes that a download channel for KeyOS is still being worked out, and it warns that the code has not been audited. Later versions may add support for Clear Signing, a standard the EF introduced in May.
3. How Clear Signing fits in
Clear Signing is aimed at one of the most persistent problems in crypto security: users approving transactions they cannot actually read. Hardware wallets often display raw data or long strings of characters when asking for approval, which leaves people signing on trust rather than understanding exactly what they are authorizing.
A standard that presents transaction details in a readable way can make it harder for attackers to trick users into signing something harmful, such as a transfer to the wrong address or an approval that hands control of tokens to a malicious contract. Adding Clear Signing to the Universal Ethereum Signer in future versions would connect the app to that broader effort.
For now, however, Clear Signing support is described only as a possibility for later releases. The current code is a starting point rather than a finished product.
4. Why a hardware wallet signing app matters
Hardware wallets exist to keep private keys away from internet-connected computers and phones, where malware and remote attackers pose the greatest risk. The device holds the key, and every transaction must be approved on the device itself, so even if a user's computer is compromised, an attacker cannot simply move funds without physical confirmation.
That protection only works as well as the software running on the device. The signing app decides what information the user sees before approving a transaction and how the signature is produced. If it hides important details or contains a flaw, the hardware's isolation offers less protection than users might assume.
This is why the EF's involvement stands out. A reference implementation created under the Ethereum organization gives developers and device makers a shared example of how Ethereum signing should be handled, which could help bring more consistency to how hardware devices treat Ethereum transactions.
It also signals a shift in how the foundation approaches user security. Much of its work has historically focused on the protocol itself, including research, upgrades and client development. Lending its name to software that runs on end-user devices extends that attention to the point where individuals actually authorize the movement of their funds.
5. How Nicolas Bacca started the project
The app did not begin as a formal partnership. Herbert said Bacca received developer units of Passport Prime after meeting Foundation's team at a conference in Europe, and then began building the signer on his own initiative.
There was no formal planning session with the EF, Herbert said. He added that he did not think Bacca contacted Foundation about the project until he already had something built to show.
Bacca's background gives the project added weight. As a co-founder of Ledger, one of the best-known names in hardware wallets, he has long experience with the kind of secure signing software that the Universal Ethereum Signer is meant to provide. His decision to build for a competing device's operating system underlines how open the KeyOS platform is intended to be.
6. How apps reach a Passport Prime device today
For now, installing the signer requires sideloading. Users load it onto Passport Prime from a computer or a flash drive and then choose to trust the developer's certificate, which tells the device that the person installing the app accepts software from that source.
KeyOS is built to limit the damage any single app can do. Each app runs in its own sandbox, and instead of receiving the master seed that controls a user's wallet, it gets a hardened key derived from the user's master key. Herbert argued that this design means a malicious app cannot break out of its sandbox.
The approach mirrors a principle familiar from modern smartphone operating systems, where apps are isolated from one another and from the core of the system. On a device built to protect private keys, that separation is meant to ensure that installing a third-party app does not put the rest of a user's holdings at risk.
7. Foundation plans an app catalog with trusted publishers
Sideloading is not meant to be the long-term model. Foundation plans to launch an app catalog with a review process, through which organizations trusted by the community would be able to push updates and emergency patches directly to users.
Herbert compared the setup to the way F-Droid works on GrapheneOS, the privacy-focused mobile operating system, where an open app repository delivers software and updates to users. He named the EF as an example of the kind of organization that could serve as a trusted publisher in the catalog.
The ability to send emergency patches is especially relevant for signing software. If a flaw is found in an app that approves transactions, the speed at which a fix reaches users can determine whether funds are exposed. A catalog run by trusted publishers would allow fixes to be distributed without every user having to sideload a new version by hand.
On October 22, Herbert said the catalog would arrive within the next month or two. As of November 4, no launch date had been announced.
8. Developer devices in circulation
Foundation has been seeding its platform with developers. Herbert estimated that the company has handed out probably over 200, and maybe over 250, of the 1,000 Passport Prime devices it set aside for developers.
That program is how Bacca came to build the Universal Ethereum Signer in the first place, and it reflects Foundation's strategy of growing an ecosystem of third-party apps around KeyOS. The more developers who have hardware in hand, the more software is likely to be ready once the app catalog opens.
For a hardware wallet maker, a broad developer base can be a competitive advantage. Devices that support a wider range of apps can serve more users and more use cases, and a signer backed by the EF gives Passport Prime a credible option for people who hold Ethereum (ETH) and Ethereum-based assets.
9. Foundation discloses a backend security incident
A few days after the interview was recorded, Foundation disclosed a security incident. Attackers gained access to some of the company's backend systems and used that access to send phishing emails to customers.
In a post on X, Foundation said that funds held on Passport devices are safe and that the hardware itself has not been compromised. Herbert said the company would publish a formal report on what happened.
Foundation has since shared several incident updates on its community forum and says a full report will follow once its investigation is complete. The distinction it drew between its backend systems and the devices themselves is central to its message: phishing emails are designed to trick users into taking harmful actions, but they do not change the security of keys stored on the hardware.
10. What's next for the signer and Passport Prime
Several pieces still need to fall into place before the Universal Ethereum Signer reaches ordinary users. The app has no public release, the KeyOS download channel is still being finalized, and the code has not been audited. Support for Clear Signing remains a possible addition for later versions.
Foundation's app catalog is the other key milestone. Once it launches, organizations such as the EF could distribute the signer and future updates directly through a reviewed channel, rather than relying on sideloading. Herbert's timeline pointed to a launch within a month or two of late October, though no date has been set.
Foundation also owes customers its full report on the backend breach. Until then, the EF's first venture into hardware signing software remains a promising but unfinished project, built by a veteran of the hardware wallet industry and waiting on the infrastructure that will carry it to users.