NDS-Signer

NDS-Signer is an #AirGapped, stateless #Bitcoin PSBT signer for the #NintendoDSi, running #SeedSigner 's code.

Check its repo here: https://github.com/ndssigner/nds-signer

Public Key

npub1n2yw95vqalqzckdnks4sedzyyjg75lasmfntt8xlecdnnwza7kkqn84hjz

Profile Code

nprofile1qqsf4z8z6xqwlspvtxemg2cvk3zzfy0207cd5e44nn0uuxeehpwlttqpzemhxue69uhhyetvv9ujumn0wd68ytnzv9hxg3nyah6

Publishing to

relay.nostr.band

Author Public Key

npub1n2yw95vqalqzckdnks4sedzyyjg75lasmfntt8xlecdnnwza7kkqn84hjz

Show more details

Last Notes

2026-10-20 02:20:38 UTC

- reply

Thank you. It has already been tested on a DSi XL and it worked flawlessly. A user reported to me on Github that he has also tested it successfully, but he did not inform me about the exact model.
I would especially appreciate test reports on the Nintendo 3DS/2DS family. I think that there are even newer DS models, but I'm not sure if it's possible to run homebrew software from the SD card or not.

2026-10-19 20:39:45 UTC

- reply

Patch is in: the python heap gets zeroed on boot now, before anything touches it. Tested in melonDS by filling it with junk over gdb and checking it’s all zero after, then on a real DSi, the boot time didn’t change.
https://github.com/ndssigner/nds-signer/pull/14
Thanks for the push, you’re in the README now 🙏

2026-10-19 19:52:19 UTC

- reply

I'm happy you like the toy (pun intended). I invite you to test and play with it. All feedback is welcome!

2026-10-19 19:49:48 UTC

- reply

Good point... And no: it wipes on the way out (lid close or power button overwrites the python heap, camera/mic/QR buffers and the screens, then powers off), but at startup it just mallocs the heap and trusts whatever is there. A session that died without the wipe (battery pulled, crash) leaves its leftovers. I’ll have a patch that zeroes it on boot ready by next weekend, tracked in #12. And yes, the ARM7 core is NDS-Signer’s own, not the launcher’s, and it never links the wifi stack.
Thank you again for your valuable comments!!

2026-10-19 19:20:02 UTC

- reply

Thanks! Fair point, though there’s no kernel here: it runs bare metal, no OS underneath. The closest thing is what the launcher (Unlaunch/TWiLight) leaves behind when it hands over. Right now NDS-Signer powers the wifi off at boot and its ARM7 core doesn’t even link the network or SD drivers, but it doesn’t reset the rest to a known state. Opened an issue for it: https://github.com/ndssigner/nds-signer/issues/12

2026-10-19 18:41:20 UTC

- reply

@npub1yag…tp3e done, a bit later than “this week” but here it is:
Threat model: https://github.com/ndssigner/nds-signer/blob/main/docs/threat-model.md
Audit guide: https://github.com/ndssigner/nds-signer/blob/main/AUDIT.md
Entropy: https://github.com/ndssigner/nds-signer/blob/main/docs/entropy.md
Went through your list. seed lives only in RAM and gets wiped when you close the lid, nothing touches the SD. restore path (words, passphrase, SeedQR, tones) has its own section now. every QR from the camera is treated as hostile, the C/Python boundary is in the guide. and the PSBT review is where I’d look hardest: what’s shown vs what’s signed.
No relays, no network at all. WiFi driver isn’t even linked and the radio is switched off at boot. So the trust problem is the boot chain and the SD card instead.
Still missing: an actual audit, a real number for the scribble+mic entropy, and fuzzing the QR code in C.
Issues for auditors: https://github.com/ndssigner/nds-signer/labels/audit
Thanks for the push, “boring maps before clever findings” stuck with me :-D

2026-10-19 18:15:20 UTC

- reply

🧵(4/4) 📞 ur-tones v0.3.0: PSBTs, seeds, xpubs and descriptors as telephone tones (DTMF), over a cable or through the air.
It now handles any UR type and makes new seeds in the browser, with or without dice. Still a draft, so don't use it with real funds yet.
https://ndssigner.github.io/ur-tones/
If you like any of them, please share ⚡
https://raw.githubusercontent.com/ndssigner/ur-tones/main/docs/images/hero-light.png

2026-10-19 18:14:25 UTC

- reply

🧵(3/4) 📿 SeedCraft v1.0.1: keep your seed as the order of some objects (beads on a necklace, bricks, stickers…) and read it back with the web tool or by hand with a pencil.
The format is now frozen and the web tool comes in 9 languages.
https://ndssigner.github.io/seedcraft/
(Photo: a public test seed, never use it for funds.)
https://raw.githubusercontent.com/ndssigner/seedcraft/main/docs/images/samples/skd8-strings.jpg

2026-10-19 18:13:30 UTC

- reply

🧵(2/4) 🎮 NDS-Signer: SeedSigner running on a Nintendo DSi, fully air-gapped.
The threat model, entropy spec and audit guide are now published, and the builds are reproducible. Looking for reviewers: it's still alpha and unaudited.
https://github.com/ndssigner/nds-signer
https://raw.githubusercontent.com/ndssigner/nds-signer/main/docs/images/review.png

2026-10-19 18:11:50 UTC

🧵(1/4) 📟 Updates from my three open-source Bitcoin projects, all born from NDS-Signer. A thread 🧵👇
And I'm working on something REALLY cool… soon 👀
#bitcoin #seedsigner #airgap #opensource
https://raw.githubusercontent.com/ndssigner/nds-signer/main/docs/images/hero.jpg

2026-10-13 18:16:44 UTC

- reply

You may be interested in this other project I'm developing. I need to make some changes and improve its security model (will be done within the next days), but it is a very nice and fun alternative to metal:
https://ndssigner.github.io/seedcraft/

2026-10-13 18:13:00 UTC

- reply

Thank you again. Your feedback is precious. I will contact you again as soon as I update the repo.

2026-10-13 17:51:04 UTC

- reply

Fair criticism. Thanks for your comment. I will update and provide the threat model, the list of critical files and an audit-focused README section within this week.
I'll tag issues specifically for auditors. If you're interested in reviewing anything specific, let me know what you'd prioritize.

2026-10-13 17:36:39 UTC

- reply

Yes indeed. Actually the project is still in alpha stage waiting for people interested in it to audit the most critical parts.

2026-10-13 17:25:33 UTC

- reply

Analyzing the source code is currently affordable for everybody thanks to the latest AI models. Any threat or malicious software can be easily spotted on the fly by multiple actors at the same time, even more when it is such a sensitive piece of software.
For the extremely cautious, they can clone the repo, AI-audit it and build the image on their own.

2026-10-13 17:15:27 UTC

- reply

Hardware wallets have become targeted devices and the incentive to tamper them grows at the same pace that the price of bitcoin. The most terrible part of this is that a compromised device can remain sleeping until a succulent price is achieved. Those few sats worth dollars 5 years ago may have multiplied its value.
The only reliable solution, now that bitcoin is widespread, is relaying both on FOSS, Open Hardware and multipurpose hardware without internet connection like vintage devices (game consoles, mp3 players, graphic calculators, PDAs)
Following this philosophy I am developing some projects, that I'm proud to recognize that they are very cool. For instance, I have implemented @npub17ty…3mgl to run on a Nintendo DSi console: https://github.com/ndssigner/nds-signer

2026-10-13 16:59:02 UTC

- reply

@npub17ty…3mgl 's core cryptographic functions are taken directly from solid and well audited projects like libsecp256k1 (maintained by bitcoin-core devolopers), embit and coincurve.
Then, the main security threat comes from a user that: 1) does not verify the SHA256 of the downloaded software, 2) uses some hardware (rpi0, sdcard) already compromised.
Currently it is safe to say that SeedSigner is very secure.
I have developed an implementation of SeedSigner for Nintendo DSi consoles, leveraging its hardware (cameras, touch screen, buttons) and with the advantage that, unlike the original SeedSigner, there is not any OS layer on the top: the software interacts directly with the hardware.
https://github.com/ndssigner/nds-signer

2026-10-13 04:10:46 UTC

- reply

This attack vector is new (thought predictable) for bitcoin, but it is not the first time that something similar happens... with deadly consequences:
https://en.wikipedia.org/wiki/2024_Lebanon_electronic_device_attacks
One of the weakest points of hardware wallets is that they are single purpose devices, linked to bitcoin owners thus, prone to be targeted. The risk/benefit ratio of tampering such devices is positive for the attacker.
Besides the risk of tampering, single purpose hardware wallets are visually identifiable. As long as the device is seen (or screened by some X-Ray scanner running some AI model), the owner is linked with bitcoin, the plausible deniability becomes difficult and the exposure to the $5 wrench attack increases.
I have developed a project that turns a toy, a Nintendo DSi, into a PSBT signer leveraging the @npub17ty…3mgl 's source code. Its main security model is to go unnoticed embedding a bitcoin signing system within a device for a completely different purpose.
Check its repo: https://github.com/ndssigner/nds-signer
Video demo: https://odysee.com/@ndssigner:9/nds-signer-demo:2

2026-10-13 03:51:57 UTC

- reply

What about combining scribbling on a touchscreen with microphone input to generate entropy?
https://raw.githubusercontent.com/ndssigner/nds-signer/refs/heads/main/docs/images/new-seed.png
Check NDS-Signer:
https://github.com/ndssigner/nds-signer

2026-10-13 02:19:31 UTC

- reply

I appreciate you pushing on this. Beyond any single device, the principle stands: repurposing multipurpose hardware is a legitimate security strategy, not just obfuscation. When hardware serves an obvious primary function (email, photos, games), it blends into the noise of everyday digital life. Specialized devices scream their purpose, and become predictable targets for supply chains and screenings alike. Yes, older or repurposed gear has audit challenges and legacy vulnerabilities, but so does everything: phones, laptops, and "secure" hardware wallets all depend on auditable-but-proprietary silicon no one truly trusts (check the recent #ColdCard incident).
The real asymmetry is this: who intercepts a million Game Boys versus a thousand Trezors? Who flags which item at customs? Plausible deniability has security value. I'm not saying this replaces thorough auditing. It complements it for threat models where visibility itself is the vulnerability. Different contexts demand different priorities.

2026-10-13 01:34:15 UTC

- reply

My strategy for avoiding tampering and scanner detection is to use hardware intended for different purposes. Hardware wallets are, obviously, going to be used by bitcoin owners, so they are going to be targeted both for tampering and screening. The commercial ones are easily recognizable. I think that reusing disconnected general devices can help to avoid these threats.

2026-10-13 01:17:57 UTC

Sooner or later all #bitcoin users need to be aware that some "targeted" devices are prone to supply chain attacks, and hardware wallets are, of course, such kind of devices to be aware of.
The first time I got really obsessed with the possibility of supply chain tampering was during the 2024 Lebanon electronic device attacks. When I saw on the news what actually happened I really freaked out.
And it isn't only the tampering risk that should scare us, but also the possibility to be flagged during screenings. Current AI technology is very capable of spotting well known hardware. Just imagine when X-ray scanners at the airport become able to detect your tiny #Trezor inside your luggage.
That's one of the reasons that made me begin this project: nds-signer – A #NintendoDSi software implementing @npub17ty…3mgl.
https://github.com/ndssigner/nds-signer/
My main obsession is to go unnoticed and reuse multipurpose hardware to avoid problems like the one we are witnessing.

2026-10-13 00:08:09 UTC

Want to check how NDS-Signer actually works? Check this demo featuring DTMF and QR code scanning from the #NintendoDS
https://odysee.com/@ndssigner:9/nds-signer-demo:2
#bitcoin #nintendo #nintendoDS #seedsigner #homebrew

2026-10-12 19:05:02 UTC

Scared about the recent issues with #HardwareWallets like #Ledger or #ColdCard? Check solutions like #SeedSigner or #NDSSigner – Multipurpose hardware (like RPi0 or Nintendo DSi) are immune to #SupplyChain attacks and screenings because they are not flagged!!
https://github.com/ndssigner/nds-signer
#bitcoin #coldwallet #raspberrypi #nintendoDS

2026-10-11 13:20:48 UTC

No camera? Send the #PSBT as telephone tones instead. Same UR parts as the #QR, with error correction. Cable or through the air.
#SeedSigner #NintendoDS #DTMF #homebrew #ndssigner
https://raw.githubusercontent.com/ndssigner/nds-signer/refs/heads/main/docs/images/tones-listen.png
https://ndssigner.github.io/ur-tones/

2026-10-10 14:04:57 UTC

Scan the #PSBT from #Sparrow, check recipients and fee on the top screen, sign, show it back as an animated QR.
#SeedSigner #NintendoDS #Bitcoin #airgapped #ndssigner
https://raw.githubusercontent.com/ndssigner/nds-signer/refs/heads/main/docs/images/review.png https://raw.githubusercontent.com/ndssigner/nds-signer/refs/heads/main/docs/images/signed-qr.png

2026-10-10 04:49:55 UTC

A #SeedSigner on a Nintendo DSi. SeedSigner's own Python, unmodified, running on a 2008 handheld through MicroPython. Camera, two screens, battery, no network. Alpha, signet-tested.
github.com/ndssigner/nds-signer
https://npub1n2yw95vqalqzckdnks4sedzyyjg75lasmfntt8xlecdnnwza7kkqn84hjz.blossom.band/2d3d12e609b1a9dd0c2fefc835233e0fdac232af6fc03955680ca53d8a56d01f.jpg

2026-10-10 03:55:24 UTC

Hello world! #introductions
Nerdy #bitcoin vibecoder sharing cool projects
#seedsigner #ndssigner #nintendods