Cardano founder Charles Hoskinson told attendees at Consensus 2026 that the future of crypto wallets is already in their pockets, arguing that secure chips inside iPhones, Android devices, and Samsung phones outperform the silicon in dedicated hardware wallets like Ledger and Trezor. He went further, suggesting that "users should probably never have their private keys" and that "something should have the private keys for the users" — a direct challenge to the long-standing "not your keys, not your coins" ethos that has defined self-custody since Bitcoin's earliest days.
The case rests on hardware most consumers already trust. Apple's Secure Enclave isolates key material from the main processor even if the application kernel is compromised, Android Keystore supports hardware-backed, non-exportable keys bound to a Trusted Execution Environment or StrongBox, and Samsung's Knox stack layers TrustZone with DualDAR for managed work profiles. FIDO reported on May 7 that 5 billion active passkeys now exist globally, with 75% of consumers having enabled at least one — a behavioral precedent the crypto industry has so far failed to ride.
Why it matters
Seed-phrase self-custody has been retail adoption's bottleneck for over a decade. Users forget their 12 or 24-word recovery phrases, photograph them, store them in cloud notes, or lose them outright. Coinbase's smart wallet already operationalizes the alternative: onboarding without a recovery phrase, using Apple or Google passkeys to bind a non-exportable credential to secure hardware, with Face ID or a PIN as the only user-facing interface. Ethereum's EIP-4337 has enabled more than 26 million smart wallets and 170 million UserOperations, and Pectra's EIP-7702 now extends programmable wallet behavior to externally owned accounts — the infrastructure for permission-based, seedless wallets already runs at meaningful scale.
The architectural shift goes further when AI agents enter the payments stack. Granting an agent a master private key is something most users would never accept; the workable pattern is bounded delegation — preset spend limits, time-boxed sessions, and full audit logs without direct key access. Base's Spend Permissions, Coinbase's AgentCore Payments, and AWS's stablecoin-agent tooling all implement that model.
Market impact
The sharpest limitation in Hoskinson's framing is that key non-extractability and transaction security are separate guarantees.
Frequently asked questions
-
What did Charles Hoskinson actually say about crypto wallets at Consensus 2026?
He argued that secure chips inside iPhones, Android phones, and Samsung devices outperform those in Ledger and Trezor, and that users should "probably never have their private keys" — letting device hardware hold non-exportable credentials instead.
-
Why would a phone-based wallet be more secure than a hardware wallet?
Apple's Secure Enclave, Android Keystore with TEE/StrongBox, and Samsung Knox with DualDAR isolate key material from the main processor, and 5 billion active FIDO passkeys show users already accept biometric-bound, non-exportable credentials as normal authentication.
-
What is the main risk of seedless, phone-based self-custody?
Key non-extractability does not equal transaction security. CertiK's Bybit post-mortem showed attackers deceived signers into approving a malicious transaction even though the private key never left the device, and Chainalysis reported impersonation scams grew 1,400% in 2025.
-
How do AI agents fit into this wallet model?
Agents get bounded delegation — preset spend limits, time-boxed sessions, and audit logs — rather than direct access to a master private key. Base Spend Permissions, Coinbase AgentCore Payments, and AWS stablecoin-agent tooling all implement that architecture.
-
What share of new retail users could phone-primary self-custody reach by 2028?
If approval UX and intent verification hold, 70% to 85% of new retail users. If mobile-signing losses keep producing high-profile thefts, the model stalls at 20% to 35% and damaged users return to custodial exchanges.
CryptoSlate