Hardware wallets are an essential security tool for crypto users, keeping private keys isolated from internet-connected devices. They protect the keys themselves, but understanding what a transaction does before signing it remains challenging, particularly when dealing with complex smart contracts.

Ambire is addressing that problem with Ambire Ice, a new open-source hardware wallet designed specifically for Ambire and Safe smart accounts. The device aims to make multisig transactions more transparent by allowing users to inspect individual on-chain actions directly on the hardware wallet's screen before approving them.

The product targets a growing challenge in Ethereum's smart account ecosystem, where transactions can involve multiple operations, contract interactions, and administrative permissions that aren't always easy to interpret. The scale of that ecosystem is considerable. According to Safe's Q2 2026 report, its smart accounts processed nearly 130 million transactions during the quarter, while monthly active accounts reached 2.73 million in June.

Making Sense of Complex Transactions

Traditional hardware wallets are built around one security model: keep private keys offline and require physical confirmation before signing transactions. However, the information presented during that confirmation is not always understandable.

This is particularly relevant for Safe smart accounts, which allow multiple parties to control a wallet through predefined signature requirements. They also support transaction batching, enabling several operations to be executed together.

A single transaction might involve transferring assets, approving a smart contract to spend tokens, or modifying permissions. Efficient, but these operations become difficult to verify when a hardware wallet only displays technical data or a transaction hash.

The practice of approving transactions without being able to understand their full contents is commonly known as ‘blind signing.’ The issue attracted attention from Ethereum's developers, with the Ethereum Foundation announcing a clear-signing initiative in May of this year. It’s being created to address a security weakness it identified as contributing to major cryptocurrency losses.

The risks with blind signing became clear during the Bybit hack that occurred last year, when North Korea's Lazarus Group stole approximately $1.5 billion in cryptocurrency. Attackers compromised Safe's infrastructure and manipulated its wallet interface, tricking Bybit's multisig signers into approving what appeared to be a routine transaction. In reality, they were authorizing malicious instructions that allowed the attackers to seize control of the wallet and drain its assets.

Ambire Ice is designed to help prevent this type of attack by decoding transactions independently on the hardware device, allowing users to verify what they are actually signing rather than relying on information displayed in a potentially compromised browser. It cannot guarantee protection against every exploit, but the additional layer of verification helps users identify suspicious transactions before authorizing them.

Ice addresses this through on-device transaction decoding. Rather than relying entirely on a connected computer or wallet application, Ice reconstructs Safe transactions and displays their individual actions on its own screen.

Users will be able to review token transfers, approvals, and batched operations before signing. The device also provides warnings for sensitive administrative changes, including modifications to Safe owners, signature thresholds, and modules.

These are particularly important operations for organizations managing shared crypto treasuries. Changing a signature threshold or enabling a module can alter who has authority over an account, potentially creating security risks if the change goes unnoticed.

Hardware Security Beyond Private Keys

The wallet also introduces several hardware-level security features aimed at protecting the signing process.

The device uses two secure elements from NXP and Infineon for key generation and protection against physical attacks. It also includes a physical airgap switch that disconnects USB data and cuts power to Bluetooth connectivity, allowing transactions to be signed offline through animated QR codes. Users can still choose USB or Bluetooth connectivity when needed.

Ambire has also taken an open-source approach to the hardware itself. Ice's firmware is built on a fork of Trezor's open-source code, while its hardware designs and board files are intended to be publicly inspectable. A transparent enclosure allows users to see the internal components.

The company is also planning for potential post-quantum security upgrades. Its proposed approach would involve adding a post-quantum signing mechanism as another Safe owner, although the functionality remains dependent on further development and network support.

A Different Focus for Hardware Wallets

Ice is not the first hardware wallet to address blind signing, but Ambire's approach is more specifically focused on the complexities of Safe accounts, particularly the ability to inspect multiple operations and changes to account permissions.

The launch builds on Ambire's existing software wallet ecosystem. Earlier in the year, the company introduced support for Safe accounts, allowing users to manage multisig wallets, batch transactions, and interact with decentralized applications across Ethereum-compatible networks.

Ice extends that functionality into dedicated signing hardware, targeting advanced users, DAO treasuries, and organizations managing shared digital assets.

Of course, making transactions easier to understand does not get rid of smart contract vulnerabilities or guarantee that every malicious operation will be detected. The effectiveness of clear signing still depends on accurate transaction decoding and users carefully reviewing the information presented.

Ambire expects preorders to open shortly after October 30, beginning with a limited batch of 200 devices. The hardware wallet will retail for $150, with the first preorder round offering a discounted price of $119, including a $10 deposit, with shipping expected to begin in early 2027.

As smart accounts make cryptocurrency transactions more flexible and sophisticated, hardware wallet security is expanding beyond simply protecting private keys. With Ice, Ambire is betting that helping users understand what they are signing is just as important as protecting the keys used to sign it.

This story was published on HackerNoon under our Business Blogging Program