What protects a Blomo Wallet

Who can move the money

One person: whoever knows the passcode on the device where the wallet lives, or whoever holds the recovery phrase. Blomo is not on that list.

This is not a promise of good behaviour, it is an absence of ability. We hold the key only in encrypted form, and the passcode that opens it we do not hold at all. There is no internal tool, no admin screen and no support procedure that moves funds out of a Blomo Wallet, because there is nothing for such a tool to use.

The single exception is co-control, and it exists only if the user switches it on. Until then, a connected card cannot spend from the wallet either.

What a breach of Blomo would give an attacker

Assume the worst honestly: our database is copied in full. What the copy contains is encrypted keys — and nothing that opens them.

Opening one takes the passcode, which is not in that database, and a second piece, which is not in it either: that piece is kept by a separate service and released only to a signed-in user, a limited number of times. So the attacker cannot sit at home and try passcodes against the stolen copy. Every attempt has to come back through Blomo, where it is visible and slowed down.

That is the whole point of the design. An offline guessing attack is the one that succeeds quietly, at the attacker's own pace, and it is the one this makes impossible.

The recovery phrase is the only backup

The recovery phrase is shown once, when the wallet is created, and it must be written down then. Blomo never sees it and does not keep a copy.

This cuts both ways, and it is fair to say so plainly: with the phrase, a lost passcode is an inconvenience; without it, a lost passcode is a lost wallet, and we cannot help. A service that could restore your key without the phrase would be a service that could also take your money.

Signing happens where the key is

A transaction is assembled and signed on the device. What travels to Blomo is the finished, signed transaction, which we relay to the network.

The key does not travel. The passcode does not travel. Even a Blomo server fully under someone else's control sees only what a public block explorer will see a moment later anyway.

Co-control, if you want it, and only within your rules

Connecting the wallet to a Blomo card turns on co-control: the key is split into two shares, one with the user and one with Blomo, and signing needs both. It is off by default and is switched on deliberately.

Blomo's share does not sign whatever it likes. It signs inside a spending limit, a list of allowed recipients and a stop switch — all three set by the user in advance, and all three enforced by the signing service rather than by our good intentions.