Zafu Zigner

Zigner turns a spare Android phone into an air-gapped cold wallet and hardware signer. Transactions arrive as QR codes, are displayed for review, and leave as QR codes — the private keys never touch a network.

What it signs

Zcash (Orchard and transparent): RedPallas signatures over shielded actions, secp256k1 ECDSA for t-address inputs, with Ironwood (NU6.3 / V6) support.

Penumbra: all transaction actions — shielded spends and outputs, DEX swaps, liquidity positions, delegations, votes, Dutch auctions, ICS20 withdrawals.

Polkadot, Kusama and Cosmos: generic Substrate and Cosmos chain support.

Security model

Private keys are generated on-device and never leave the signing device. Every transaction is displayed for review before it is signed, and the chain ID is validated on every signing request. The device is meant to stay permanently offline — airplane mode with the wireless radios disabled. On compatible hardware (Pixel 8 and later, Samsung with Knox) seeds are encrypted into the secure element rather than held in main memory.

Features

FROST distributed key generation and threshold multisig, with age-encrypted share backup to one or more public keys. Full Viewing Key export for Penumbra (bech32m, UR). QR transaction protocol with fountain-coded animated QR for large payloads. Metadata parsing from trusted sources for Substrate and Cosmos. StrongBox support on high-security Android devices. Anchor attestation, which prevents fabricated note trees on Zcash.

What this is not

Zigner is not a hot wallet or a payment app, and it is not suited to frequent small transactions. It is a signer — it holds keys and approves transactions, and something else broadcasts them.

https://foss.rotko.net/fdroid/repo

d80e4b0a4f13b483474717373c3b00859c15d370f9f39a513afc4b80299a800c