Shop
ChinaBridge Fortress air-gapped hardware wallet, titanium black
Flagship cold storage

ChinaBridge Fortress

Flagship cold storage. Absolute control.

4.9 / 5 · 412 reviews
$459

Ships tracked & insured from Hong Kong with signature on delivery. Includes steel backup plate.

  • Dual EAL6+ secure elements (CC-2024-08 + CC-2025-02)
  • Air-gapped QR-code signing, no cables, no radios
  • Capacitive fingerprint + hidden plausible-deniability wallet
  • 3-year limited warranty, steel backup plate included
Key features

For keys that should outlive the threat model.

Air-gapped QR signing

Sign transactions without ever touching USB, Bluetooth, or any radio. The Fortress exchanges QR codes with your host — a fully physical air gap.

Fingerprint + hidden wallet

A capacitive sensor gates the device. A separate passphrase unlocks a second, plausibly deniable wallet. What coercion can't see can't be demanded.

Titanium & sapphire build

Machined titanium shell, sapphire crystal cover glass, IP68 sealed. Engineered to resist what your threat model hasn't modeled yet.

Host (online) unsigned → ← signed Fortress (offline) Scan & sign
Air-gap mode

No wires. No radio. No remote surface.

In air-gap mode the Fortress has no electrical connection to anything. Your host software renders an unsigned transaction as a QR code. You scan it with the Fortress, review it on the AMOLED display, approve with fingerprint + physical press, and show a signed QR back to the host.

This is the same threat model used by nation-state key custodians: the signing device lives in a room with no network, and nothing crosses the gap except what a human can literally look at.

FORTRESS · DUAL-SE ARCHITECTURE SE-A CC-2024-08 Primary keys SE-B CC-2025-02 Attest + counter Both chips must agree before any signature is released
Defense in depth

Two secure elements. One unanimous vote.

The Fortress holds your keys on two independently certified EAL6+ secure elements from different manufacturers (CC-2024-08-CH-NSCIB and CC-2025-02-CH-NSCIB). A signature is released only when both chips independently agree on the transaction payload and the user authentication state.

A theoretical flaw in one chip family does not compromise your wallet. An attacker would need to break two independent certified cryptographic implementations, in lockstep, inside a sealed titanium case.

Primary wallet PIN: •••• Hidden wallet Passphrase-gated Same device. Two wallets. Only you know the second exists.
Plausible deniability

A wallet that can't be coerced out of you.

Beyond the visible "primary" wallet, the Fortress supports a passphrase-gated hidden wallet. Without the passphrase, the device looks like a device with one ordinary balance. With the passphrase, a second, entirely separate wallet appears.

Under duress, you can unlock the decoy without giving up anything material. This is the same construct recommended for journalists, dissidents, and holders in jurisdictions where legal coercion is a real risk — supported natively, with no third-party software.

Technical specifications

Everything, on the record.

Dimensions96 × 58 × 11 mm
Weight62 g
BodyTitanium + sapphire crystal
Display2.5" AMOLED touch
ConnectivityUSB-C + BT 5.3 + QR air-gap
Secure elements2× EAL6+
CertificationsCC-2024-08 · CC-2025-02
BiometricCapacitive fingerprint
Battery72 h active
Water & dustIP68
BackupBIP39 + Shamir + hidden
Assets supported5,500+
SoftwareChinaBridge Desktop + 3rd-party
Warranty3-year limited
In the box

Flagship contents.

ChinaBridge FortressDevice, pre-sealed
Steel backup plateFire & corrosion-proof
USB-C cable1.5 m braided
Aluminum travel caseWith key loop
Tamper sealHolographic, factory-verified
4× recovery cardsFor Shamir shares
Certifications

Audited twice. Certified twice.

CE EU conformity
RoHS Restricted substances
FCC ID 2AZGP-CBBRF1
EAL6+ CC (×2) CC-2024-08 · CC-2025-02
Compatible with

Works with the wallet software you already trust.

Sparrow
Electrum
Wasabi
Rabby
ChinaBridge Desktop

ChinaBridge sells the hardware device only. Pair your Fortress with any compatible open-source wallet software — we do not bundle, sell, or recommend specific tokens, exchanges, or custodial services.

Compare the line

Vault vs Vault Pro vs Fortress.

Feature Vault Vault Pro Fortress
Price$149$279$459
Display128×64 OLED1.9" color touch2.5" AMOLED touch
ConnectivityUSB-CUSB-C + BT 5.3USB-C + BT + QR air-gap
Secure element1× EAL6+1× EAL6+2× EAL6+
Battery—48 h72 h
Biometric——Fingerprint
Water / dustIP54IP54IP68
BackupBIP39BIP39 + ShamirBIP39 + Shamir + hidden
Frequently asked

About the Fortress.

Depends on your threat model. The Fortress is designed for concentrated, long-term storage — family treasury, DAO reserves, high-net-worth holders, or anyone whose threat model realistically includes physical coercion. For day-to-day signing, most users are well served by the Vault or Vault Pro.
It means the Fortress can sign without any electrical connection. Your host generates a QR code of the unsigned transaction. You scan it with the Fortress's camera. You review, authenticate with fingerprint, and press confirm. The Fortress displays a signed QR which you scan back into your host. Nothing crosses the air gap except photons.
The hidden wallet is derived from your recovery seed plus a passphrase that exists only in your head. Without the passphrase, nobody — not even a forensic examiner — can prove the hidden wallet exists on this device. If you're compelled to unlock your device, you unlock the decoy and the hidden funds stay invisible.
No. Fingerprint unlocks the device UI, not your keys. The secure elements still require a separate PIN on first access after a power cycle, and signing still requires physical confirmation on the touchscreen. A failed or bypassed fingerprint falls back cleanly to PIN — it never short-circuits the signature path.
One is enough for most wallets, and the Vault and Vault Pro ship with a single EAL6+ SE. The Fortress is designed for long time horizons — the assumption that a certified chip is safe today is probabilistic, not absolute. Pairing two chips from independent certification paths means a latent flaw in one family does not compromise your wallet.
Also considered

You might prefer one of these.

ChinaBridge Vault Pro
Sovereign standard
ChinaBridge Vault Pro

Color touchscreen, Bluetooth, haptic confirmation, Shamir backup.

$279 Learn more →
ChinaBridge Vault
Everyday wallet
ChinaBridge Vault

Compact, USB-C-only, EAL6+ secure element — the minimalist everyday model.

$149 Learn more →