Duress mode
For when someone is watching
Set a second PIN. Under pressure, it opens a believable decoy wallet, while your main funds quietly switch to a withdrawal delay.
How duress mode worksCold card · Hot app · Coming soon
Knows nothing about you. Gives up nothing under pressure.
NULLA is a cold NFC card and a hot app that work as one wallet. We never ask who you are, and large transfers follow rules your phone alone can't override.
Security quiz · 15 questions · 3 min
Answers never leave this page
Before anything else: how exposed is your wallet right now?
1 / 15
Where do you keep most of your crypto?
-
No account required
Pay in crypto. Connect over Tor.
-
Duress mode
A second PIN opens a decoy wallet.
-
One tap to sign
Keys stay inside the card's chip.
One system
Spend from your phone. Move real money with the card.
Most people keep a hot wallet for daily use and a hardware wallet for savings, and move funds between them by hand. NULLA joins both into one wallet with one set of rules.
Below limit
From your phone
24h
Above limit
Card tap, allowlist, 24-hour window
-
Your limit
You set a spending limit for the hot side. Everyday payments below it go straight from your phone.
-
Above the limit, the card decides
Anything larger needs a physical tap of your NULLA card. A stolen or compromised phone can't sign it.
-
Allowlist and a 24-hour window
Large transfers go only to addresses you approved in advance, and wait 24 hours before they leave. If something looks wrong, you cancel.
Built on a smart account on Ethereum and EVM networks, and a timelocked vault on Bitcoin. The rules live on-chain, not in the app.
Capabilities
Built for the moments other wallets don't plan for.
No seed phrase
Nothing to write down, nothing to find
Recovery is split into key shares held by people and devices you trust, plus a time lock. No single paper, person or drawer can restore your wallet alone.
How recovery worksZero data
We can't leak what we never had
No account and no email to sign up. Pay in crypto, connect through Tor, and verify open firmware with reproducible builds.
Read our principlesHow signing works
Four steps. Your key never leaves the card.
-
Build
Prepare the transfer in the NULLA app: amount, network, recipient.
-
Check
The app shows the destination against your allowlist and the rules that apply. Read it in plain words before you sign.
-
Tap
Hold the card to the back of your phone. It has no battery and no screen: the phone's field powers the chip just long enough to sign.
-
Send
The signed transaction returns to the app. Large transfers start their 24-hour window, and you can cancel any time before it ends.
The key is generated inside the card's secure element and stays there.
Principles
What we hold ourselves to.
-
Collect nothing
We don't ask for your name, email or phone. What we never store can't be leaked, sold or subpoenaed.
-
Keys stay in the chip
Your private key is created inside the card's secure element and is never exported, even to us.
-
Verify, don't trust
Firmware and app will be open source, with reproducible builds, so anyone can check that what ships matches the code.
-
Rules over reflexes
Limits, allowlists and delays are enforced on-chain, so a rushed moment or a stolen phone can't skip them.
-
Plan for pressure
Threats aren't only remote. Duress mode is designed for the moment someone is standing next to you.
-
Say what we can't do
No wallet is risk-free. We'll be clear about the limits of every feature, including ours.
Security team
The people behind the rules.
-
Mira Okonkwo
Head of Security
Spent her career breaking payment hardware so others could fix it. Now she decides what NULLA refuses to ship.
-
Jonas Varga
Firmware Lead
Writes the code that runs inside the card's chip and insists every build can be reproduced byte for byte.
-
Leila Haddad
Cryptography Engineer
Designs the key-share recovery and the time locks behind it. Prefers proofs to promises.
-
Tomas Reyes
Smart Contract Engineer
Builds the on-chain rules for limits, allowlists and delays, and reviews every change twice.
-
Anya Lind
Threat Modelling & Privacy
Thinks about who might come for a holder's funds, and how. Shaped duress mode and the zero-data policy.
Our code will be public before launch. Review it, challenge it, tell us what we missed.
FAQ
Questions, answered plainly.
What exactly is NULLA?
A cold NFC card and a hot mobile app that act as one wallet. Small payments go from your phone; larger ones need a tap of the card and follow rules you set in advance.
Does the card need charging or pairing?
No. It has no battery and no screen. Your phone's NFC field powers the chip for the moment it takes to sign.
What happens if I lose the card?
Your funds don't live on the card, and the card is useless without your PIN. You recover access through your key shares and the time lock, then set up a new card.
How does duress mode work?
You set a second PIN. Entering it opens a decoy wallet that looks normal, and quietly puts your main funds on a withdrawal delay. It's designed to buy time, not to guarantee safety in every situation.
How do I recover without a seed phrase?
During setup you split recovery between people and devices you trust. Enough of them together, plus a waiting period, restore your wallet. No single share can do it alone.
Which networks are supported?
Bitcoin, Ethereum and EVM networks at launch.
Why don't you collect any data, even an email?
Because a list of crypto holders is a target. We'd rather not have one. You pay in crypto, use the app over Tor, and never create an account.
When can I get one?
NULLA is in development. We'll announce the launch on this page. Check back here — we won't be in your inbox.
Coming soon
We'd ask for your email. But that would be the first thing we know about you.
There's no waitlist and no sign-up form. When NULLA is ready, it will be here. Until then, find out where your current setup stands.