$ARMOR is live on Robinhood Chain via Pons and on Ethereum, with cross-chain bridging connecting both chains.
CA :
ETH : 0x6a967dBea60Ca2050eB629551EEF63d21CaCf5D5
ROBINHOOD : 0x0594692Ea1C2421b37DE06a5966084AC9aAd4eA9
Every token launched on Armoreum has its creator’s private key publicly disclosed, while creator rewards remain protected by our hash-based authorization system.
We’re building a new standard for onchain security, where asset protection goes beyond the private key.
armoreum.io
ArmorProof and security research
We’re building Armoreum with the belief that security deserves more than a list of features.
ArmorProof is part of our broader direction around protected vaults, hash-based authorization, and clearly defined security boundaries.
We want to keep making the underlying concepts easier to examine and discuss, from authorization logic to vault isolation and privileged access.
The work of security researchers and communities like @immunefi shows how valuable independent scrutiny can be across the ecosystem. As ArmorProof develops, security research is an area we’d like to engage with more deeply.
Our goal is to keep building, keep testing our assumptions, and make Armoreum’s security model something people can understand beyond the surface level.
Vault isolation and contract permissions
At Armoreum, we’re thinking about asset protection at the architecture level, not just the wallet level.
Our approach includes isolated vaults, explicit authorization requirements, and carefully defined contract permissions. These boundaries matter when building infrastructure that handles creator rewards and other protected assets.
Upgradeability and access control are also important parts of the design. That’s why we’re interested in established patterns from @OpenZeppelin and the broader security research around smart contract permissions.
We’re building toward an architecture where every protected operation has a clear authorization model and a defined scope of access.
That’s the kind of foundation we want Armoreum to grow on.
Cross-chain infrastructure
Cross-chain infrastructure is a major part of what we’re building at Armoreum.
Our architecture uses LayerZero infrastructure with a custom DVN, bringing message verification and destination execution into the bigger picture of asset protection.
We want to make moving assets across ecosystems part of a broader system with explicit verification rules and clearly defined trust assumptions.
The work around @LayerZero_Core is particularly relevant to this direction. Cross-chain messaging isn’t just about connecting networks. It’s also about how systems establish that a message should be trusted and acted upo
Hash-based authorization
One of the core ideas behind Armoreum is using hash-based authorization to add another layer to protected asset operations.
We’re exploring how cryptographic proofs can work alongside smart contract permissions to create a separate authorization boundary for vaults.
There’s a lot of interesting work in this space, especially around cryptographic design and how authorization rules are enforced onchain. Teams like @trailofbits have done extensive work in smart contract security and cryptography, which makes these topics particularly interesting to follow as we continue building.
Our goal is to make asset protection more programmable, with clearly defined authorization requirements at the contract level.
Beyond the private key
At Armoreum, we’re building around the idea that asset protection can go beyond the private key.
Our approach separates wallet control from the authorization requirements of protected vault operations. The goal is to make sure that controlling a wallet doesn’t automatically satisfy the separate authorization rules protecting a vault.
Hash-based authorization is a big part of this direction, and we’re excited to keep exploring what’s possible with it.
We’ve been building with established smart contract infrastructure like OpenZeppelin while developing our own approach to protected asset operations.
Beyond Keys. Secured by Hashes.
This is how Unjail works.
Your creator password is set locally on your device. Your QRC (Quantum Recovery Capsule) is also generated and downloaded locally. Keep it offline and never share it.
To withdraw ETH from your Creator Vault, enter the password you chose at launch. The password itself stays on your device—it is used to derive the cryptographic authorization required for the withdrawal.
Wrong password → invalid authorization → no withdrawal.
This video shows a successful Unjail: the correct password, creator-wallet signature, and one-time hash-based proof authorize the request. JailETH is then burned, and the corresponding ETH is released to the designated recipient.
The creator private key alone is not enough. The vault’s additional authorization checks must also pass.
*On-chain transaction proof:*
etherscan.io/tx/0x7eb1407bd1…
Built on Hashes. Designed for Quantum Resistance.
AI uncovering a 26-year-old cryptography mystery is wild. Now let’s see what security researchers can uncover onchain.
At Armoreum, we’ve got a challenge of our own. Visit armoreum.io, click ArmorProof, and try to break our hash-based authorization system.
There are JailETH creator rewards that can be unjailed into ETH, and the creator’s private key is public. Can you get to the rewards without satisfying the system’s separate authorization requirements?
Security engineers, cryptographers, and smart contract researchers: come test it
🚨JUST IN: Anthropic’s Claude solves the NSA’s 26 year cryptography mystery in under 30 minutes.
Claude found the NSA’s “random” seeds for cryptography curves like P-256 were generated from simple 1997 and 1998 timestamps.
Nobody had explained them since NIST published the curves in 2000.
The discovery claims a $36,864 bounty, which will be donated to the Internet Security Research Group.
Anthropic says it is not a weakness in the curves, and it makes backdoor fears “much less plausible.”
This is exactly why we’re building Armoreum around the idea that security shouldn’t stop at the private key.
Hardware security, cryptographic authorization, and protected vaults are all pieces of a much bigger picture. We’re exploring how hash-based authorization can add another layer to asset protection, beyond simply controlling a wallet.
The future of crypto security needs more than better keys. It needs better authorization models.
HOLY SHIT.
For crypto, this is one of the most insane posts of the year, but I'm guessing most people don't understand it.
Let me explain...
Bitcoin's accounts, and subsequently Ethereum's (and therefore every other EVM chain's), are built on a specific elliptic curve called secp256k1.
secp256k1 is a different elliptic curve from the one used across nearly every modern hardware device, including iPhones.
Modern devices mostly use a different curve called secp256r1, which is usually referred to as P-256 - one of the curves investigated in the article.
This mismatch has made it sooo difficult in the past to integrate crypto accounts natively into the security systems of modern hardware.
For example, Apple's Secure Enclave natively supports P-256, not secp256k1.
This has prevented crypto accounts from being able to use the same hardware protection as things like Apple Pay.
Same goes for the web with passkeys - WebAuthn uses P-256 signatures, which means Ethereum accounts using secp256k1 can't use them natively either.
But why did Satoshi do this?
The main theory for choosing secp256k1 was distrust of the P-256 curve - i.e. he thought there was an NSA backdoor.
A "backdoor" here basically means a secret, intentional weakness in the curve that would allow the NSA to exploit it and access private keys.
This was because P-256 was created with involvement from the NSA...
And the NSA provided a mysterious "seed" used to generate one of the curve's parameters without explaining where that seed came from.
This eventually transformed into a ~25-year-old mystery with a 5-figure reward for finding where this seed came from.
Claude figured it out in less than 30 mins.
And the best part is its internal thinking was: "Hmm wait... is it suspicious that such an obvious thing wasn’t discovered in 25 years?"
The solution was stupidly simple - just the time the curve was created, put into a specific random number generator function.
This doesn't 100% prove there's no backdoor yet, but it provides strong evidence that this seed wasn't secretly engineered by the NSA.
And Claude did this with "just a simple prompt" in under 30 minutes.
$ARMOR trades on both Ethereum and Robinhood, and prices won’t always match. Separate markets can create opportunities for arbitrage traders.
Our bridge integrates with LayerZero for cross-chain messaging, with transactions trackable from source to destination.
$ARMOR brings fee-funded buybacks and multichain bridging into the same ecosystem.
On Robinhood, the buyback mechanism uses accumulated ETH to purchase ARMOR and hold the acquired tokens in the multichain vault. This execution spent 0.00441872 ETH and added 1,073,381.74 ARMOR to that vault.
Verified Robinhood buyback:
robin.etherscan.io/tx/0x9e0c…
On Ethereum, the ARMOR-specific buyback design allocates 2/7 of 0.7% foundation-fee receipts toward buybacks, equivalent to a 0.2% buyback allocation, with the remaining 0.5% retained for the foundation.
ARMOR also supports LayerZero-powered transfers between Ethereum and Robinhood. Buyback holdings and spendable bridge reserves are tracked separately buybacks accumulate tokens, while bridge availability depends on the destination’s actual inventory.
$ARMOR brings fee-funded buybacks and multichain bridging into the same ecosystem.
On Robinhood, the buyback mechanism uses accumulated ETH to purchase ARMOR and hold the acquired tokens in the multichain vault. This execution spent 0.00441872 ETH and added 1,073,381.74 ARMOR to that vault.
Verified Robinhood buyback:
robin.etherscan.io/tx/0x9e0c…
On Ethereum, the ARMOR-specific buyback design allocates 2/7 of 0.7% foundation-fee receipts toward buybacks, equivalent to a 0.2% buyback allocation, with the remaining 0.5% retained for the foundation.
ARMOR also supports LayerZero-powered transfers between Ethereum and Robinhood. Buyback holdings and spendable bridge reserves are tracked separately buybacks accumulate tokens, while bridge availability depends on the destination’s actual inventory.
We’re inviting security researchers and ethical hackers to test Armoreuum.
Every token launched on Armoreum has its creator’s private key publicly disclosed as part of our security model. Yet claiming protected creator rewards requires the original launch password, processed locally on the creator’s device to generate hash-based authorization proofs.
A public private key alone should not be enough to claim the creator’s protected rewards.
Think you can break our authorization system? We invite you to put it to the test armoreum.io/explore
Every serious finding helps us identify weaknesses, strengthen our architecture, and improve security for everyone.
Rethinking How Onchain Assets Are Launched, Protected, Recovered, and Moved Across Chains.
Armoreum brings token launch infrastructure, hash-based authorization, protected creator rewards, offline recovery through QRC, and cross-chain infrastructure into one ecosystem.
From publicly disclosed creator keys to separately authorized rewards, from JailETH to our vision for JailBank, we’re building a different approach to onchain asset security.
Not just another launchpad. A new approach to how digital assets are secured throughout their lifecycle.
Armoreum is building toward a quantum-resistant security architecture, starting with hash-based authorization for protected creator rewards.
Every token launched on Armoreum has its creator’s private key publicly disclosed, while access to protected creator rewards requires separate authorization enforced at the protocol level.
We’re also building JailBank, our vision for a new kind of asset protection infrastructure, where access to funds can be governed by more than possession of a private key alone.
From token launches and JailETH rewards to offline recovery through QRC (Quantum Recovery Capsule), we’re working toward an ecosystem built around hash-based security, independent authorization, and stronger protection against compromised keys.
The future of onchain security needs more than another wallet. It needs a fundamentally better authorization model.
armoreum.io
Private keys shouldn’t be the only thing standing between an attacker and your assets.
Armoreum uses password-derived, hash-based authorization for protected creator reward operations, with one-time proofs designed to prevent replay.
The goal is simple: separate wallet identity from permission to claim protected rewards.
Security enforced by cryptographic proofs and smart contracts, not just promises in a UI.
Creator rewards accrue in JailETH and can be redeemed for ETH through a protected Unjail process that requires separate authorization.
The creator wallet key can be public. Access to protected rewards is governed by the protocol.
Different keys. Different security boundaries. A different way to think about asset protection.
armoreum.io
Our QRC recovery system is designed for maximum privacy: no server, no internet, no remote access. The capsule won’t even open while your device is connected to the internet.
armoreum.io/offline-recovery
Your password is processed locally to generate the hash-based authorization material used by Armoreum. Protected transaction proofs are generated on your device and used to authorize transactions without sending your password to a server.
Your credentials stay with you. Your authorization stays local.
Offline by design. Secured by hashes. Built for a quantum-resistant future.
QRC (Quantum Recovery Capsule) is Armoreum’s offline recovery system. It stores your launch password, creator private key, authorization seed, and hash-based H100–H0 proof chains, allowing recovery without an internet connection.
These cryptographic materials support Armoreum’s hash-based transaction authorization system. Anyone with access to the capsule can read its contents and control the creator wallet.
Keep your QRC offline, secure, and never share it. Your recovery security depends on protecting this file.
The Armoreum bridge is live.
Powered by @LayerZero_Core , $ARMOR now moves both ways between Robinhood Chain (@ponsdotfamily ) and Ethereum.
One more thing: we publish the creator wallet private keys in ArmorProof. On purpose.
Those keys alone cannot withdraw from the protected Creator Vaults. Every withdrawal also requires the creator's password and a one-time proof.
Think you can break it? Take the published keys and try to withdraw the ETH from the listed vaults. That's the challenge.
Proof of both directions:
Robinhood → Ethereum
layerzeroscan.com/tx/0x05d3f…
Ethereum → Robinhood
layerzeroscan.com/tx/0x64525…
Check the transactions. Check the contracts. Don't take our word for it.
A private key should never be enough.
Armoreum Bridge is now live.
5% of the supply is held in bridge reserves on both Ethereum and Robinhood as part of the bridge infrastructure.
Ethereum reserve:
0xb6644fabc43cc2f49e0c43982508f488c755e732
Robinhood reserve:
0xa4ad1a816305333e71de731f499fbbf089c32c4f
Built on LayerZero, the bridge allows registered Armoreum Multichain token pairs to move between Ethereum and Robinhood.
How it works:
* Select the source chain and amount
* Review the quote, including the 0.2% bridge fee
* Submit the transaction
* Track every stage through Bridge Explorer: submitted, source confirmed, verified, and delivered
Only registered and activated pairs can use the bridge. Each transfer is routed to its verified counterpart contract on the destination chain, never to an arbitrary address.
armoreum.io/bridge
A private key should never be enough. $ARMOR
Armoreum Launchpad is live. $ARMOR
We’re building the first launchpad around hash-based, quantum-resistant security. Every creator’s private key gets published after launch. But can you actually drain their creator fees?
Some creators already have JailETH rewards waiting to be unjailed into ETH. The key is public. The rewards are still protected by our hash-based authorization system.
Think you can break it? Go try.
armoreum.io
At Armoreum, recovery is local-first too. Your recovery data stays on your device and can be accessed offline, without sending it to a server.
Protected transaction execution uses password-derived, hash-based authorization, with fresh proofs designed to prevent replay.
Security shouldn’t depend on trusting a single key. It should be built into the protocol.
Wrapped zkAPI + Tor + extra cover traffic + local LLM prompt rewriting in an open-AI compatible daemon, and made a "paranoid mode" wrapper for my agent harness (pi):
Each conversation gets assigned a separate Tor circuit, your requests are masked with random cover traffic, zkAPI ensures you don't leak your identity through payments, and all prompts are locally rewritten (bring-your-own-local-model; I'm using qwen3.8-flash-next)
github.com/vbuterin/zkapi/tr…
My agent harness is wrapped with a bwrap sandbox (also experimenting with MicroVM) and wrapped again with torsocks, so everything it does goes through Tor.
Here's what me asking it to do a simple research task looks like.
It's getting quite usable! Though you definitely still pay quite a bit in increased latency, especially when starting a new conversation.
Also, Tor is far from optimal here for privacy; the cover traffic mechanism is okay against passive adversaries but much weaker if the LLM provider is colluding with the guard and actively manipulating timing. This kind of task really requires a more specialized mixnet, probably take the tradeoff of a higher bandwidth multiplier and built-in constant cover traffic.
Also also, much cheaper zkAPI deposit and withdraw gas costs are coming to mainnet soon.



















