ERA Wallet Review: What the Keylabs Audit Actually Says

Disclosure: This review is based on the ERA Wallet product materials supplied by the vendor and the publicly released Keylabs security audit, plus independent research. CoinCodeCap was not paid for this review and has no affiliate relationship with ERA Wallet at the time of publication. We have not physically tested a production unit — where that limits a conclusion, we say so.

Risk warning: Hardware wallets hold bearer assets. A lost seed backup is an unrecoverable loss. Don’t invest unless you’re prepared to lose all the money you invest. Nothing here is financial advice, and no security audit — including a good one — is a guarantee that a device is safe.

ERA is a credit-card-sized, QR-only air-gapped hardware wallet from HWLT FZE in Dubai. It runs an STM32H753 microcontroller alongside a Microchip ATECC608C secure element, has a front-lit 2.7-inch e-ink touchscreen behind Gorilla Glass 6, is IP67 rated, charges wirelessly, and has no USB port at all. It sells for roughly $226.

It also ships with something most wallet startups never obtain: a public security audit by Keylabs, the team behind wallet.fail — the 35C3 presentation that broke the Ledger Nano S, Ledger Blue, Trezor One and KeepKey on stage in 2018. ERA published that report with the failures left in.

That audit is the most interesting thing about this product, and it is also the reason to slow down before buying. It is dated 30 December 2024, it was performed on pre-production hardware and pre-release firmware, and its retest section runs to seven lines. Six of the thirteen findings were never retested. Three findings marked “Fixed” are, in the auditor’s own words, not fixed.

If you are still choosing a category rather than a model, start with our 10 Best Hardware Wallets for Bitcoin roundup. The closest direct comparison in this review is the NGRAVE ZERO, the other premium air-gapped, QR-only device on the market.

TL;DR

ERA Wallet at a Glance

What Is ERA Wallet?

ERA is a cold storage device that never connects to anything. You build a transaction in a normal software wallet — MetaMask, Rabby, Sparrow — and that wallet shows you a QR code. You scan it with the camera on the ERA. The device decodes the transaction, shows you what you are signing in plain language, and you approve it with your PIN. ERA then displays a second QR code containing only the signature, which you scan back into the software wallet to broadcast.

Your private keys never leave the device, and there is no cable, no Bluetooth pairing and no proprietary desktop bridge in the loop. That model is not unique — Keystone and the NGRAVE ZERO work the same way — but ERA does three things differently.

• Ten independent seeds. Not ten accounts from one seed, and not passphrases. Ten separate wallets with ten separate recoveries on one device.
• ERA Lens. An on-device transaction decoder that turns raw contract calldata into readable English without an internet connection or an ABI registry.
• NFC Recovery Cards. An encrypted, PIN-protected card replaces (or supplements) the paper seed phrase, with an optional Shamir-style split across several cards.

The company behind it, HWLT FZE, is a Dubai free-zone entity. The device launched in March 2025 and is on firmware v1.3.x as of early 2026.

The Counterargument First: What Is Wrong With ERA Wallet

The ERA marketing deck leads with “Don’t trust it. Verify it.” That slogan sets a bar the product does not clear, so we will start there.

1. You cannot verify the firmware

ERA’s GitHub organisation is honest about this, which is worth crediting. The companion app is fully open under GPL-3.0. The four repositories that actually matter — the bootstrapper, the bootloader, the firmware and the crypto library — are labelled “Partially Open”, and the organisation’s own README states they cannot be independently built without the private components.

That is the whole argument. “Verify it” means reproducible builds: you compile the source, you hash the binary, you compare it against what is on your device. ERA’s self-verification flow does something different. The device signs a challenge, the ERA app checks it against ERA’s keys, and the app tells you “genuine”. That proves your unit was not swapped by a counterfeiter or a reseller. It proves nothing about what the firmware does with your seed.

Trezor ships everything open. Keystone ships its firmware open. ERA charges more than both and ships less. Confidence: high — this is stated on ERA’s own GitHub organisation page.

2. Six of thirteen audit findings were never retested

Keylabs recorded eight hardware findings (four Low, four Informational) and five firmware findings (three Medium, one Low, one Informational). The retest section covers seven of them. Here is the complete ledger:

Every un-retested item is a hardware finding, and two of them — H2 and H5 — are ones Keylabs explicitly told ERA to physically remove from production boards. The report’s closing paragraph says these findings “are being addressed in the production design”. Present continuous tense. Nobody went back with a microscope and confirmed it.

If you buy an ERA Wallet today, no independent party has confirmed that the debug and programming interfaces were removed from the board in your hand. Confidence: high — derived directly from the audit PDF.

3. Three findings say “Fixed” and then say they are not

This is the part that should bother you most, and it is the auditor’s editorial failure as much as ERA’s. Three retest entries carry a “Fixed” heading followed by a sentence describing work that had not been done:

SE TRNG not used for Entropy Generation – Fixed. Will be fixed in software update at launch.

Vulnerable Format String in Bootstrapper – Fixed. Partially fixed additional fixes in future software updates.

Vulnerable Format Strings in Bootstrapper, Bootloader and Firmware. Informational, doesn’t directly lead to exploitation. Will be fixed in the future.

A future commitment is not a remediation. Publishing it under a “Fixed” heading, in a document ERA then cites as “0 critical, 0 high, 3 medium — all resolved”, converts a roadmap item into a verified control.

The entropy finding matters more than the others. The same report’s firmware conclusion says the RNG issue “threatens the integrity of cryptographic operations and user data security, hence these should be fixed before the first production firmware is released”. It may well have been fixed at launch. There is no public artefact showing it.

4. The non-updatable bootstrapper still contains deferred bugs

The audit is unambiguous that the bootstrapper cannot be updated after manufacturing. It is burned in. That is exactly why finding F1 was rated Medium rather than Low despite being a display-string bug. Keylabs wrote: “The inability to update the bootstrapper results in this issue having a higher impact than in code that can be updated after device manufacturing.”

Now read F5 again. It cites a bootstrapper source file containing an sprintf into a seven-byte stack buffer for the battery-level string, and its retest disposition is “Will be fixed in the future”. There is no “in the future” for a first-stage loader. Whatever is burned into your unit is what you own for the life of the device.

In fairness: these are display-formatting bugs operating mostly on internal data, not remote code execution. Keylabs rated them Medium and Informational for a reason. The criticism is about process discipline in immutable code, not about your coins being at risk tomorrow. Confidence: high on the facts, moderate on real-world exploitability.

5. The shipping processor was never glitch-tested

Keylabs successfully glitched an STM32H743 from RDP2 down to RDP1, a security downgrade that re-enables JTAG debugging. Their own words about the chip actually inside the ERA Wallet:

Though the STM32H753AIJ6 used in the ERA Wallet was not evaluated, it is likely that the core is susceptible to the same attack, as these are both variants of the same family.

They rated it Low because the secure element handles PIN verification and key decryption, and because the STM32 system memory bootloader is disabled in firmware. That reasoning is correct — this is the right architectural answer to a glitchable MCU. But “we broke the sibling chip, we assume this one breaks too, and we did not test it” is a hole, and it sits underneath a device sold on physical-attack resistance.

6. “True air-gap” is marketing, not engineering

The deck says: “TRUE AIR-GAP. NO USB. NO BLUETOOTH. NO WI-FI.” All three of those statements are true. The word true is not.

There is an NFC radio in the device. It delivers firmware updates when you tap your phone to the wallet, and it writes and reads the encrypted seed on the Recovery Card. NFC is short-range, the update payload is signed, and the attack surface is genuinely small next to Bluetooth. But an air gap means no electromagnetic communication path at all. ERA has one, and it carries the highest-privilege payload on the device in one direction and an encrypted seed in the other.

The honest framing is “air-gapped transaction signing, NFC for updates and backup”. That is still better than every USB or Bluetooth wallet on the market — including the Ledger Stax, which uses Bluetooth and NFC as primary channels. It simply is not a true air gap, and the audit’s own threat model devotes a section to insecure wireless communications. The NGRAVE ZERO makes a stricter version of this claim and is the fairer benchmark if a hard air gap is your requirement.

7. Firmware rollback ships as a feature, and the threat model warns against it

The Keylabs threat model names downgrade attacks explicitly: “Techniques to downgrade the software and/or firmware to a previous vulnerable version. For hardware wallets this is generally enforced by a bootloader.”

In February 2026, ERA shipped a Companion app update advertising that users can switch between firmware versions at any time in Settings and roll back to a previous version, plus an opt-in Beta Channel for pre-release builds.

If the bootloader enforces a monotonic version floor — mcuboot supports this, and the ATECC608C’s monotonic counters are the textbook mechanism — rollback is safe and this is simply good UX. If it does not, someone with brief physical access and a phone could push a device back to a build with a known bug. We could not confirm which it is: ERA’s release notes do not say, the firmware is not independently buildable, and the audit predates the feature by fourteen months. Confidence: moderate. This is the single most important open question about the device.

8. Nobody knows who builds this

HWLT FZE, an address at the Dubai World Trade Centre, a Telegram channel and an X account. We could not find a named founder, CTO or firmware lead anywhere — not on the site, not on the GitHub organisation, not in press coverage.

Compare that with the field. Trezor is SatoshiLabs with a public team going back to 2013. Ledger’s executives testify to regulators. Coldcard’s lead is a public figure who argues with critics on X daily. Even smaller entrants like Keevo and ColdLar put names and offices forward. For a device that holds bearer assets, vendor anonymity is a live risk factor. It does not mean anything is wrong. It means that if something goes wrong, recourse runs into a Dubai free-zone entity.

The Case For ERA Wallet

Having spent eight sections on the problems, here is why this device still scores 7.5 rather than 5.

The auditor is not a rubber stamp — and the audit changed the product

Keylabs is the wallet.fail crew. Their 2018 35C3 presentation demonstrated live physical and firmware attacks against the four biggest hardware wallets on earth at the time. They have since audited Cypherock, among others. When ERA hired them, ERA knew it was buying people who would glitch its microcontroller in a socket and photograph its unsoldered RF shields for publication.

More importantly, the audit visibly redesigned the hardware. The architecture assessment documents that ERA started on an STM32H743 — the variant without security features — and moved to the STM32H753 because the H75x line adds the Flash secure-only area, Root Secure Services and the CRYP/HASH accelerators. The report also records that ERA had no secure element selected at all at the outset, and that Keylabs pushed for one specifically to obtain monotonic counters for PIN retry limiting and rollback protection.

The report states it plainly: “Eventually the STM32H753 was selected, in part thanks to this preliminary analysis.” That is an audit doing its job, which is rarer in this industry than the marketing suggests.

The architecture decisions are defensible

• The STM32 system memory bootloader is disabled entirely by remapping the reset address for both boot modes to flash. The system bootloader is the most common attack path against STM32-based wallets. Killing it is correct, and not every vendor does it.
• They rejected the dual-core STM32H757. Keylabs evaluated offloading NFC and wireless handling to a Cortex-M4 as an isolation boundary, then concluded the M4’s memory “cannot be sufficiently segmented and hidden from the Cortex-M7 core”. They chose not to ship security theatre.
• Monotonic counters were prioritised over separate execution environments. Contrarian, but correct for a PIN-protected wallet: exponential backoff and rollback protection are worth more than a second CPU you cannot properly isolate.

ERA Lens is the right answer to blind signing

Blind signing — approving a wall of hexadecimal because your wallet cannot tell you what it means — accounts for a large share of DeFi losses. Every vendor claims to have solved it. Most solutions phone home: Ledger’s Clear Signing leans on ERC-7730 metadata files, and others fetch ABIs from a registry.

ERA Lens decodes on-device, offline, with no registry lookup and no internet connection. For an air-gapped wallet this is not a nice-to-have — it is the only architecture that can work, because the device by definition has no network. Token, amount, destination, contract function, network and fee are rendered in plain language on the e-ink screen before you approve.

The honest limitation: offline decoding can only cover ABIs compiled into the firmware, so coverage is capped by ERA’s release cadence, and unrecognised transactions are blocked. That is the safe default, but it means a novel protocol may simply not work until ERA ships an update. Ask about coverage for whatever you actually use.

Ten independent seeds is a real differentiator

This is genuine compartmentalisation — the thing security-minded users have wanted from hardware wallets for a decade. Business funds separate from personal. A hot DeFi seed separate from cold storage. One phished signature on wallet seven does not reach wallet one.

The cost nobody mentions: ten seeds means ten backups. The dominant failure mode moves from “device compromised” to “user loses track of which card holds which vault”. For most people that is a footgun. For someone already running segregated wallets across several devices, it collapses a drawer of hardware into one card.

Multi-source entropy, including the fix the audit demanded

Camera capture, touch swipe patterns, accelerometer motion, the MCU’s TRNG and — following the audit — the ATECC608C’s TRNG. Finding F3 exists precisely because the original design leaned on the STM32H7’s uncertified TRNG alone. Keylabs also recommended mixing in the STM32 unique ID and the secure element serial, plus factory-injected static entropy in OTP memory.

The “create two wallets with different inputs, get different seeds” demonstration in the deck is a user-facing sanity check, not proof of entropy quality — a broken RNG would also produce two different-looking seeds. But the multi-source design is right, and the fact that it exists because an auditor complained is the story of this entire product.

The hardware is objectively the nicest in the category

54 × 86 mm at 5.5 mm and 45 g, so it lives in a card slot in your wallet. Gorilla Glass 6 over a front-lit e-ink panel, which means it is readable in direct sunlight and in a dark safe. IP67. Aluminium frame. Qi wireless charging with no port to corrode or short. Roughly 300 transactions per charge and up to a year in Storage Mode, so the safe-queen use case works: take it out, power on, sign immediately.

The trade-off is that no USB port means no wired fallback. If the Qi coil fails or you lose the charger — not included, per hands-on reviews — the device is inert until you source another Qi pad. Your seed is fine, which is what the backup is for, but the device is not. Card-format rivals such as Tangem avoid this by having no battery at all, at the cost of having no screen.

It does not lock you into an ERA app

EIP-4527 and UR2.0 QR encoding are open standards. ERA works with MetaMask, Rabby, OKX, Sparrow, Nunchuk and BlueWallet, with no proprietary bridge, no mandatory desktop suite and no account. The ERA Companion app handles setup, authenticity checks and firmware only. Some reviewers list that as a drawback because it is not a portfolio app. It is a feature: less code touching your keys.

The Supply Chain Story

ERA’s strongest marketing section covers manufacturing: firmware written once in a secure facility and never rewritable, the secure element and MCU cryptographically bound so neither can be swapped, debug interfaces permanently disabled, hardware identity locked, and a QR-based authenticity check you run from the app before first use.

Two caveats. First, the verification is circular. The device proves itself to ERA’s app using ERA’s keys. That defeats a third-party counterfeiter. It does not defeat ERA, and it does not defeat anyone who compromises ERA’s signing infrastructure. “You don’t have to trust our manufacturing process” overclaims — you have to trust their key management instead.

Second, “debug interfaces are permanently disabled” is precisely what findings H2 and H5 were about, and precisely what was never retested. The claim may well be true. It is unverified.

The Recovery Card: Convenient, and a New Dependency

Instead of stamping words into steel, you tap an NFC card to the wallet and the seed is written to it encrypted and protected by a PIN with brute-force limits. Multishare splits one recovery across several cards so that no single card reveals the secret. ERA claims 50-plus year durability.

This is a real usability win. Seed-phrase handling is where most retail users actually lose money, and the split-card option is a legitimate Shamir-style improvement on a single paper backup. Keevo built a similar thesis around a physical backup carrier, and our Keevo review ran into the same question ERA now faces.

Ask this before you rely on it: if HWLT FZE ceases to exist in 2029, can you restore from that card without ERA hardware? If the card holds a standards-documented encrypted BIP-39 or SLIP-39 payload, the answer is yes and the format is auditable. If it is proprietary, you have put your seed into a format only one vendor’s firmware can read — vendor lock-in on the one asset that should never have any.

ERA does also support plain paper seed backup. Use it in addition to the card until this is documented publicly.

How We Rate ERA Wallet

ERA Wallet vs Competitors

Only a handful of wallets sign transactions purely over QR with no cable and no radio in the signing path. ERA, Keystone and the NGRAVE ZERO are that group; Trezor and Ledger still route signing through USB or Bluetooth. This is where ERA lands:

ERA’s premium over Keystone buys the best physical build in the category, ERA Lens and ten independent seeds. It costs you open firmware, multisig and a track record. Going the other way, the NGRAVE ZERO at roughly $398 charges nearly double for an EAL7-certified secure element and a stricter air gap. Neither ERA nor NGRAVE is fully open source. If you want the certification, pay NGRAVE. If you want the device you will actually carry, ERA wins. If you want to verify the code yourself, buy neither.

Pros and Cons

Who Should Buy ERA Wallet?

Buy it if:

• You want serious air-gapped signing in something that fits in a card slot and will actually be carried
• You want compartmentalised seeds and would otherwise buy three separate devices
• You touch DeFi often enough that offline on-device calldata decoding is worth real money
• You value a public audit by the people who broke Ledger and Trezor over an unauditable “military-grade” claim

Do not buy it if:

• You require reproducible builds and fully open firmware — buy a Trezor Safe 5 or Keystone 3 Pro
• You run Bitcoin multisig — buy a Coldcard Q or Keystone 3 Pro
• You want a vendor with named humans and a decade of incident history
• You are price-sensitive: the Keystone 3 Pro delivers QR-only air-gap, open firmware and multisig for $77 less

Verdict: 7.5 / 10

ERA has done something most hardware wallet startups never do. It hired an auditor capable of embarrassing it, let that auditor redesign the silicon selection, and published the report with the failures intact. The engineering reasoning in that document — H743 to H753, monotonic counters over dual-core isolation, killing the STM32 system bootloader — is better than the marketing wrapped around it.

The marketing is the problem. “Don’t trust it, verify it” promises reproducible builds that partially-open firmware cannot deliver. “True air-gap” ignores an NFC radio that carries firmware. “All medium findings resolved” rests on a seven-line retest in which three items marked Fixed are described as unfinished, and in which six hardware findings — including the exposed SWD and UART/BOOT0 interfaces — were never revisited.

Buy it for the hardware, the compartmentalised seeds and ERA Lens. Do not buy it because a PDF from December 2024 told you it was safe.

Confidence Ledger

We publish what we are sure of and what we are not. Every load-bearing claim in this review, graded:

Frequently Asked Questions

Is ERA Wallet safe?

It is built on sound architecture — a dedicated secure element, air-gapped QR signing, secure boot and a disabled system bootloader — and independently audited by a top-tier firm with no critical or high findings. But the audit covers pre-production hardware from December 2024, six hardware findings were never retested, and the firmware is not independently buildable. “Reasonably safe with real unverified gaps” is the accurate answer.

Is ERA Wallet open source?

Partially. The companion app is fully open under GPL-3.0. The bootstrapper, bootloader, firmware and crypto libraries are “partially open” and, per ERA’s own GitHub organisation, cannot be built without private components. You cannot reproduce the binary running on your device.

Is ERA Wallet really air-gapped?

For transaction signing, yes — QR codes only, with no USB, Bluetooth or Wi-Fi. But the device has NFC, used for firmware updates and Recovery Cards. It is air-gapped signing rather than a true air gap. The NGRAVE ZERO is the stricter comparison.

What is ERA Lens?

An on-device transaction decoder that converts raw calldata into plain language — token, amount, destination and contract function — before you approve. It runs entirely offline with no registry lookup, which is the only architecture that can work on an air-gapped device. Coverage is limited to ABIs shipped in the firmware, and unrecognised transactions are blocked.

How many wallets can ERA hold?

Ten fully independent seeds, not ten derived accounts. Each has its own separate recovery, so compromising one does not expose the others.

Is the ATECC608C as good as Ledger’s secure element?

No, and it is not trying to be. The ATECC608C is Microchip’s CryptoAuthentication IC, providing key storage, ECDSA, a TRNG and — critically — the monotonic counters used for PIN retry limits and rollback protection. It is not in the same certification class as the EAL6+ smartcard secure elements used by Ledger and the Trezor Safe line, nor the EAL7 part in the NGRAVE ZERO. Keylabs chose it deliberately over more powerful ARM-based secure elements because those lack monotonic counters. It is a defensible engineering trade, not a superior chip.

Does ERA Wallet support multisig?

Not at launch, per third-party specification databases. If Bitcoin multisig is a requirement, a Coldcard Q or Keystone 3 Pro is the better buy. Confirm with ERA support before ordering, since this may have changed.

Who makes ERA Wallet?

HWLT FZE, registered at the Dubai World Trade Centre in the UAE. No founders or engineering leads are publicly named.

How much does ERA Wallet cost?

Around $226 for a single unit, with 2× and 3× bundles bringing the effective per-unit price to roughly $189. Store pricing moves with promotions, so check before ordering.

Related Reading

Air-Gapped and Premium Cold Wallets

Mainstream Hardware Wallets

Buying Guides

Sources