Frequently Asked Questions

XColdPro uses AES-256-GCM authenticated encryption — the AES variant specified in NIST FIPS 197 — with PBKDF2 key derivation. Iteration counts scale with the edition: 100,000 by default, 150,000 for USB-bound vaults and 500,000 on Nyxor. Initialisation vectors come from hardware-backed cryptographic randomness with a 256-bit random salt, so identical inputs never produce identical ciphertext.

Your funds remain completely safe. Reverse-engineering the software reveals only standard BIP-39/BIP-44 implementations, address generation logic, and interface design — all of which are publicly known cryptographic standards. What attackers cannot obtain is your seed phrase (never stored anywhere accessible), your master password (only you know it), your private keys (encrypted with AES-256), or your funds (protected by mathematics, not by code secrecy). Additionally, our proprietary memory protection technology, data creation techniques, and Sentinel Guard threat detection architecture add layers that go far beyond what code analysis can bypass.

XColdPro is designed to provide robust protection on any machine through its ten-layer security architecture, including active threat neutralization that detects and eliminates keyloggers, clipboard hijackers, screen capture malware, and phishing attacks in real time. However, for maximum security, XColdPro can be deployed on a dedicated air-gapped system — a computer that has never been and will never be connected to any network. The platform is engineered to function fully in either configuration. Your choice depends on your threat model and the value of the assets you are protecting.

Your private keys are secured by AES-256-GCM authenticated encryption (NIST FIPS 197) — the AES variant specified in NIST FIPS 197. XColdPro applies this encryption across ten independent security layers, meaning there is no single point of failure in the cryptographic architecture. Keys are never exposed in plaintext outside of the encrypted environment. Private keys exist only in RAM during an active operation and are cleared immediately on timeout or close, so they do not persist in system memory after a session ends.

XColdPro uses anti-forensic file architecture. Wallet files appear as ordinary system cache with no identifiable signature of cryptocurrency storage. Hidden system attributes and stealth file naming ensure that even a forensic examination of the device does not reveal the presence of digital assets. Files at rest are AES-256-GCM encrypted, so the device alone yields nothing without your password. Nyxor licences add an optional duress layer covered in the licensed user manual.

XColdPro is not bound to a single physical device in the way a hardware wallet is. With your backup credentials, you can restore your wallets on any compatible air-gapped computer. There is no replacement device to order, no shipping to wait for, and no manufacturer dependency. Detailed backup and recovery procedures are documented in the XColdPro Stable V1.0 User Manual.

No. XColdPro derives from a standard BIP-39 mnemonic using BIP-32 hierarchical derivation and BIP-44 account structure with SLIP-44 coin types. Bitcoin supports legacy, nested SegWit and native SegWit paths, so you hold bc1 addresses. EVM chains derive at the standard Ethereum path, and Cardano follows CIP-1852 rather than BIP-44. In the default configuration your wallet restores in Trezor, Ledger, Sparrow, Electrum, MetaMask or Phantom with XColdPro absent. We do not bind your keys to our software: self-custody would mean very little if we did. Nyxor adds an optional duress layer. Enabling it trades portability for coercion resistance by design, and recovery then runs through XColdPro. It is a layer you choose to enable, not a condition of using the product, and it is documented for licence holders.

XColdPro includes built-in defenses that operate at the application level in real time. These defenses detect and neutralize keyloggers, clipboard hijackers, screen capture malware, and phishing attacks — without requiring any configuration from the user. Encrypted keypad input bypasses keystroke logging entirely. Clipboard monitoring detects address-swap attacks before transactions are signed. These protections are always active from the moment the application launches.

Private keys and other cryptographic material exist only in RAM during an active operation. XColdPro overwrites and releases those memory regions as soon as the operation completes, and clears them again on session timeout or application exit. Keys are never written to disk, so there is nothing to recover through disk forensics, and clearing memory promptly narrows the window for cold boot attacks and memory dump analysis.

No successful attack against a properly configured XColdPro implementation has been documented.