Fresh-address migration infrastructure

MOVE
BEFORE
YOU SIGN.

Map every asset. Verify a fresh destination. Build the migration sequence. Keep funds moving directly from your old wallet to your new one.

Build migration ↓Inspect first

Inspired by the call to move assets into fresh addresses whose public keys remain hidden behind a hash.

RECEIVE-ONLY DESTINATION
PUBLIC KEY: HASHED

Loading hardware wallet…

3D: tigerwutz · CC BY 4.0

NO CUSTODY / NO BLIND APPROVALSETHEREUM MAINNET · READ-ONLY FIRST

BUNKER / The startup thesis

Build the bunker.
Not the hype.

A token with a hardware ambition. An independent startup vision for self-custody that feels like shelter, not a leap of faith.

HARDWARE VISION
SOFTWARE FIRST

Millions of BUNKER devices.
One deliberate mission.

Our ambition is to raise development funding through the BUNKER token and build an independent hardware-wallet startup: research, prototypes, external security reviews, then manufacturing at scale. Millions of devices is our long-term target, not an existing production commitment.

BUNKER is the name of our proposed hardware wallet, not a Ledger product or partnership. The migration interface is available today; BUNKER hardware is a development vision, not a shipping or audited device.

Our answer to the self-custody question

Our answer to Vitalik.
Built for self-custody.

Vitalik argues for better wallet security with less mental overhead. BUNKER is our independent hardware proposal in that direction: deliberate actions, independent checks and fewer blind trust assumptions. His essay advocates social recovery; our proposed hardware is a separate approach, not a claim to implement his full design. It is not commissioned, used or endorsed by Vitalik Buterin.

READ VITALIK'S WALLET-SECURITY ESSAY ↗

01 / PROPOSED

Research & prototype

Define the threat model, key architecture and a hardware design that can be independently challenged.

02 / PROPOSED

Test before trust

External reviews, adversarial testing and a small pilot before any production-scale promise.

03 / LONG-TERM TARGET

Manufacture at scale

Work toward millions of BUNKER devices, subject to funding, engineering, suppliers and validated demand.

WHY ANOTHER HARDWARE WALLET? / THE SECURITY CONTEXT +

Established brands are not exempt from security incidents. Ledger disclosed a customer-data breach in July 2020. On December 14, 2023, its Connect Kit JavaScript library was compromised through a malicious package release. Ledger's incident report says the attacker did not access its infrastructure or code repository; affected users were tricked into signing asset-draining transactions.

These are different failures, not proof that every Ledger device or secure element was hacked. BUNKER's response is a development goal: independently testable security and clearer signing. No hardware wallet can promise absolute safety.

LEDGER / JULY 2020 DISCLOSURE ↗LEDGER / CONNECT KIT INCIDENT REPORT ↗

Development vision, not an active funding offer. Token sale terms, allocation, hardware entitlements and production dates have not been established here. A token is not equity, a guaranteed return or a guaranteed device. The migration tool never routes user assets into a project treasury; any future fundraising would be separate. “Wait for the all-clear” is a brand message, not a live security alert or a guarantee of safety.

01 / Live account intelligence

Start with evidence.

Read Ethereum state without connecting a wallet. The prototype checks account code, transaction nonce, native balance and block evidence through public RPC infrastructure.

BUNKER MODE WALLET / EXPOSURE SCANNER READ-ONLY

Awaiting two addresses.

We will compare source exposure with destination account state at a pinned Ethereum block.

DESTINATION RESULT

Checking…

Source nonce: —
Source ETH: —
Destination nonce: —
Destination code: —
Snapshot block: —

02 / Operational migration console

Move assets directly.

Connect the source wallet only when you are ready. Add exact ETH, ERC-20, ERC-721 or ERC-1155 assets; BUNKER MODE WALLET verifies ownership or balance, keeps ETH last, and asks your wallet to approve each direct transfer.

SOURCE WALLET

Not connected

— ETH

Connection is user-initiated. BUNKER MODE WALLET never requests a seed phrase and never receives custody.

Asset standard

Amount

ERC-20 decimals, balances and NFT ownership are read live from Ethereum before the asset enters the plan. No unlimited approvals are used.

DIRECT TRANSFER PLAN00

Fresh receive-only destination

I verified this exact destination independently in my trusted wallet or hardware device. I understand every asset will be sent there directly.

Connect the source wallet to begin. Execution is limited to Ethereum mainnet and requires a fresh destination with empty code and zero outgoing nonce.

02 / Product architecture

No custody layer.

BUNKER MODE WALLET is an orchestration and verification surface. The default route never asks users to deposit assets into a protocol-owned contract.

Inventory

Resolve native assets, fungible tokens, NFTs, approvals, roles and protocol positions by chain.

Plan

Order every action so dependent positions move first and native gas moves last.

Sign

The wallet shows the exact destination, value and encoded call before requesting approval.

Verify

Authenticate receipt identity and transaction fields, then flag unresolved steps.

03 / Two execution paths

Direct by default.

The safest useful product does not require a custom contract. A bounded one-use migrator can exist later for compatible assets and advanced users.

Recommended / Contractless

Direct Route

Each asset moves from the source wallet directly to the verified fresh destination through standard token and protocol calls.

CustodyNever leaves user control
Approvals to BUNKER MODE WALLETNone
CompatibilityHighest
Transaction countOne or more

Advanced / Future module

Bounded Migrator

A one-use contract binds source, destination, assets, quantities and expiry before any approval is requested.

DestinationImmutable
Admin / upgrade keysNone
Arbitrary callsForbidden
Best useCompatible token batches

04 / Migration manifest

Nothing forgotten.

A migration is not complete when the largest balance moves. It is complete when every asset, permission and administrative responsibility is accounted for.

Protocol positions

Withdraw, unwind or transfer supported DeFi positions.

Adapter review

Fungible assets

Move ERC-20 balances with exact token and amount previews.

Direct transfer

Collectibles

Transfer ERC-721 and ERC-1155 inventory to the destination.

Direct transfer

Administrative roles

Move ownership, multisig seats, guardians and access roles.

Manual review

Residual approvals

Revoke permissions that should not survive the migration.

Revoke

Native balance

Transfer the exact user-selected ETH amount after token and NFT steps.

Final transfer

Reconciliation

Verify receipt identity, approved transaction fields and unresolved journal steps.

Evidence report

Zero hidden custody

No project treasury sits between the source and destination. The product coordinates; the user's wallet executes.

Fresh means receive-only

The destination should not sign during setup. Users verify it through their trusted wallet or hardware device.

✓

Evidence over promises

Every completed step resolves to a transaction hash and a mined receipt matching the approved transaction fields.