One key shouldn't decide everything.

Hardware-wallet incidents, AI-assisted attacks and useful agent payments belong in the same why-now argument. Not to scare people into another device. To make secure ownership easier to use, and easier to verify.

A device is not the whole security model

On 10 October 2026, Ledger Support confirmed an unauthorized hardware implant in an affected user's device. Ledger named the reseller CryptoBilis and said it had no indication that Ledger's own infrastructure, systems or services had been compromised. The statement does not prove that every Ledger device is affected or that the implant extracted a private key.

Coinkite disclosed a different failure in July 2026. Faulty COLDCARD firmware generated weakened seeds. Attackers reconstructed the corresponding private keys offline and stole funds. Coinkite says the devices themselves were not remotely accessed or taken over. Fixed firmware exists, but updating does not repair an already weakened seed.

These are different incidents. They point to the same question: what happens if one key or one signing device fails?

Ledger Support, 10 October 2026 Coinkite: COLDCARD security advisory Coinkite: fixes and AI-assisted review

Our answer is more than one key, not more chores

We want a stolen key not to decide what happens to all the money. Nuri puts Bitcoin multisig behind one passkey, without asking you to manage a seed phrase or configure a set of devices. The optional open-source security card can be another signer or replace Nuri's co-signing server.

Several copies of one seed are not independent keys. Several signers also do not automatically protect a wrong payment that they all approve. Spending protection, signer independence, provider failure and recovery need separate answers.

Our signing and recovery article explains those answers and their limits. The recovery tool can reproduce the user keys locally with a compatible, surviving passkey. It does not replace a lost passkey, recreate a server's private key or skip a timelock.

Nuri: independent keys and recovery Security-card source and reproducible proofs Provider-independent recovery source

AI is a threat and a tool for verification

Chainalysis reports average scam receipts of $3.2 million for operations visibly linked to AI vendors, versus $719,000 for those without such a link. Its reported 4.5x difference is revenue association, not profit or proof that AI caused every loss. The comparison group is not proven AI-free.

AI also helps defenders inspect software. Anthropic reports Claude finding 22 Firefox vulnerabilities over two weeks, including 14 rated high by Mozilla. Mozilla independently credits Claude-assisted findings and fixes. This involved validation and maintainer review, not simply asking a chatbot if a project is safe.

You can ask an AI to inspect Nuri's public code: which keys authorize a payment, what happens when a signer is unavailable, and how recovery works without Nuri. Ask for exact file and line references. Then reproduce the important behavior.

Chainalysis: AI-linked scam revenue Anthropic: Firefox security research Mozilla: credited findings and fixes Security-card source and reproducible proofs Provider-independent recovery source

The payment rails already have demand

Wirex BaaS reported $105 million in onchain card volume in March 2026, up 34% from February. That is actual monthly, partner-wide volume. It is neither Visa-only spending nor Nuri-attributable volume.

Safe reported 63.4 million smart accounts, up 20% year over year, and 2.73 million monthly-active accounts in June 2026. These are accounts, not verified unique people or an exclusively multisig population. McKinsey and Artemis estimated $4.5 billion of stablecoin-linked card spending in 2025, up 673% from 2024.

These numbers show adoption outside Nuri. They are evidence for the market and the need. They do not establish Nuri's user count, retention, revenue or product-market fit.

Wirex: March 2026 card volume Safe: Q2 2026 smart-account report McKinsey/Artemis: stablecoin payments

Agents need wallets that keep the owner in control

An agent buying a data lookup, API call or AI service needs a way to pay. Nuri provides wallet and payment tools for agents as well as people. The point is useful spending under the owner's rules, not giving software unlimited access to savings.

TRM's September 2026 analysis identified $25.62 million of screened likely x402 commerce. Its models classified 0.6% to 7.5% by value as agent-like. That is heuristic attribution, not a census of autonomous purchases or proof of mass adoption.

The opportunity is to make those payments usable and controlled. The Bitcoin wallet, passkey experience, optional security card and optional financial services belong together. Keeping ownership and usefulness together is what we are building.

TRM: measured activity and agent attribution Nuri's wallet and payment tools