New wallet uses Amazon hardware security modules to eliminate seed words

The newly launched crypto wallet by Kresus requires users to sign in with “magic links,” meaning password hashes don’t need to be stored.

A new crypto wallet has just launched in Apple’s App Store store that uses Web2 trickery to ensure users don’t need to interact with seed phrases or passwords.

According to a May 11 announcement from the app’s developer, Kresus, the new wallet stores users’ private keys in an Amazon Web Services Hardware Security Module (HSM) and uses “magic links” and 2FA to authenticate users.

Most crypto wallets require users to write down a recovery phrase or “seed words” when they set up an account. If the user loses their recovery phrase and their device crashes, they lose access to their account forever.

For this reason, some crypto users prefer to store their crypto in an exchange account. But events like the collapse of FTX have also led to fears that keeping crypto in an exchange could also be unsafe.

*A screenshot of the Kresus iOS app. Source: Kresus Labs*

Speaking to Cointelegraph, the Kresus team said that their new wallet app attempts to fix this problem using a wallet infrastructure and software development kit (SDK) called “Magic,” which stores the user’s private key on an Amazon Web Services computer that is specifically designed to store highly sensitive information.

The AWS computer encrypts the user’s key with a Master Key that cannot leave the hardware module, much in the same way that a hardware wallet does. This eliminates the need for seed words or private keys to be stored on the device or kept as a paper backup, the team said.

Unlike a centralized exchange, Kresus does not use passwords to authenticate users, since stealing password hashes and cracking them is one of the most common techniques hackers use to get access to web accounts. Instead, it requires users to click a link from within an email each time they attempt to log in.

The app also uses 2FA to protect the account in case the user’s email address becomes compromised.

When it comes to sending crypto, users don’t need to cut and paste crypto addresses on Kresus. Instead, the app allows each user to register for a free .kresus domain name through Unstoppable Domains, which they can use to send crypto to others.

“We’re really trying to offer something that is truly a better mousetrap for any Web3 user,” Kresus CEO Trevor Traina told Cointelegraph. “Where you can move all of your things from multiple places into one place, have it be very accessible but highly secure […] but also a gateway portal for people who aren’t comfortable yet on Web3 because they’re terrified they’ll be locked out.”

The Kresus team stated that because of the way Magic infrastructure works, neither they nor the Magic development team are able to see the user’s private key during account creation or login, so they cannot make unauthorized transactions.

The Web3 app developer closed a $25 million funding round to support the development of its so-called SuperApp in March.

Web3 superapp @Kresusofficial raised $25M in a Series A funding round led by @LCVentures, with participation from @FTI_US and JetBlue Ventures.https://t.co/ymXkN5DBAx pic.twitter.com/Cgw30Hvimo

— Crypto Fundraising #StandWithUkraine (@Crypto_Dealflow) March 7, 2023

Kresus is not the only wallet to offer seedless onboarding through Magic SDK. Web3 gaming company Immutable told Cointelegraph that it is also developing a seedless wallet called “Immutable Passport” that uses the same infrastructure. Passport will work on the Immutable X and Immutable zkEVM networks and will be used to onboard players of Immutable’s Web3 games, such as Gods Unchained and Guild of Guardians.