Read this first.

Unaudited software

arkum is new. The program and the signing code haven't been independently audited. Hash-based signatures are well studied, but any new implementation can have bugs. Only put in what you can afford to lose, and start small.

You hold the keys

Vaults have no recovery, no admin override and no support desk that can open them. If you lose your secret, the funds stay locked for good. If someone else gets your secret, they can take everything.

Your browser does the signing

Your secret is used inside this page and never sent to us. Anything that can read your browser (malware, a bad extension, a shared computer) could read it too. "Remember in this browser" is a convenience, not a vault.

Never reuse a key

Each vault key is meant to sign once. The app always moves leftover SOL to a fresh vault and sends deposits to vaults whose key is unused. Sending SOL by hand to an old vault address weakens its protection.

Quantum timelines

No one knows when, or if, quantum computers will break ed25519. arkum is a precaution, not a prediction. Nothing here is financial advice.