Build Journal

We officially launched the Citadel Vault at BTC Prague and the response was outstanding. The event brought in over 8,000 attendees, which is an excellent turnout for a bear market. Event organizers informed us that our booth saw the top 5% of foot traffic out of 100 vendors. We completely sold out of our Batch 1 units and gathered highly positive feedback to build upon. Ben stopped by the booth while I was speaking and was thoroughly impressed after taking the Vault for a test drive. We also received invitations to speak at Bitcoin conferences and user groups across five European countries. Mike is now leading our enterprise business development, focusing on advisory firms, corporate treasuries, insurance companies, high net worth individuals, and family offices. I am now fully back to writing code and finalizing the software development.

Bill of Materials finalized

On the project development front, we are making steady progress. The hardware Bill of Materials has officially passed its final review.

From NFC to a contact Smartcard reader

As part of this finalization, we decided to change the Vault Card reader from an external NFC reader to a contact Smartcard reader. Both hardware modules are manufactured by ACS and utilize the exact same driver. This ensures the Vault OS maintains full backward compatibility with the previously issued NFC readers.

The new Smartcard reader provides a smoother and more foolproof user experience. It physically shrinks the security attack surface by completely eliminating wireless NFC communication. The device itself is also physically smaller. Both reader types operate exactly as intended, and you can simply unplug them the moment user authentication is complete using your 2 of 3 or 3 of 5 Vault Cards to unlock the Vault.

Securing digital wealth for the next generation has no clean solution. You want your family to inherit your Bitcoin if something happens to you, but you cannot let them access those funds while you are still alive. Citadel Vault solves this with a dead man switch built around a fully offline timelock.

How the Dead Man Switch Works

You configure your Citadel Vault to lock your assets until a specific point in the future. Periodically check in and authenticate with your device, and the Vault pushes that unlock target further down the road. You stay in total control. If you stop checking in, the target time arrives and the Vault enters its recovery phase. Unlike other dead man switch solutions, the Citadel Vault Timelock requires no servers to still be running years or decades later.

The Problem with Normal Clocks

Verifying time on an offline device is harder than it sounds. Standard computers use internal battery-powered hardware clocks. That is a security flaw: anyone with physical access can alter the clock, spoofing the system into believing years have passed to bypass security restrictions.

Citadel Vault contains no internal clock. It is completely blind to the passage of time on its own, so there is nothing for an attacker to manipulate.

Proving Time with Physics

Rather than a hardware clock, Citadel Vault uses the Bitcoin proof-of-work network as an unforgeable timer. Bitcoin produces a new block roughly every ten minutes, and each block requires an enormous amount of physical energy to create.

When the target unlock time arrives, your heirs insert the Citadel Vault microSD card into any internet-connected computer and download the ten most recent Bitcoin blocks. That file goes back onto the card. The Vault reads it and remains air-gapped the entire time.

The Vault calculates the total computational energy required to produce those blocks. Faking that energy expenditure would cost hundreds of thousands of dollars per block. The offline Vault can independently and mathematically confirm that the required real-world time has genuinely passed.

A Trustless Inheritance Layer

Combined, these two features give you an optional but highly secure inheritance mechanism. Your heirs cannot bypass the waiting period by spoofing a local clock: the Vault verifies time against the physical energy of the Bitcoin network. You maintain full authority over your wealth while you are alive. Your legacy transfers safely and verifiably when the time is right.

Citadel Vault is the first solution in the world to offer an air-gapped timelock.

Vault OS is the air-gapped, hardened operating system that ships inside every Citadel Vault. It is a stripped-down build of Debian Linux, an open-source, industrial-grade OS that runs much of the world's server and embedded infrastructure. Its job is to check the security of the system and securely boot the inheritance application suite called Guardian.

Over the past month we reached the milestone we had been pointing at for the better part of a year: the full stack running together on the final hardware. Vault OS boots on the production compute module, Guardian runs on top of it, and a complete working prototype (49 encrypted blocks covering multisig wallets, bank accounts, legal documents, and identity records) can be unlocked using the owner PIN together with 2-of-3 Vault Card verifications. Each Vault Card carries an EAL 6+ certified secure element, and the master passphrase (a BIP39 mnemonic of 12 or 24 words) is sharded across the three cards. Pro, Pro+, Advisor, and Founders Edition ship with five Vault Cards, raising the threshold options to 2-of-4 or 3-of-5. The Advisor and Founders Editions have additional sharding capabilities.

The architecture rests on three tiers: a verified OS image on the compute module inside the Inheritance Computer, customer data encrypted at rest on a removable, industrial-grade USB called the Vault Drive, and the master passphrase that unlocks the Vault Drive sharded across separate Vault Cards. Each tier protects the next. The OS verifies its own state before Guardian boots. The Vault Drive is unreadable without the passphrase. The passphrase exists nowhere on the device, only in the union of cards the owner physically holds. No single tier is enough on its own, and the layers are physically separable so the owner can store them apart.