It is only September, and the crypto industry has already crossed $1.2 billion stolen in hacks and scams in 2026. Of the $6.4 billion lost last year, 80% was attributed to seed phrase exploits and mismanagement. In July alone, over $130 million in Bitcoin was drained from between 5,200 and 7,700 wallets by an attacker who exploited a firmware flaw that had been sitting in Coldcard devices for four years.
The general consensus from the broader community is that the industry just isn’t ready for the mass adoption of self-custody. The current system is built on a piece of paper. Your entire portfolio, secured by 12 or 24 words, with no margin for error, no second chance, and no forgiveness.
In July 2026, Ryder filed a patent application for TapSafe Recovery. We want to explain what that means, why the underlying technology qualifies for patent protection, and why we think the timing could not be more relevant.
The Problem TapSafe Was Built to Solve
The seed phrase model has not changed in over a decade. Write down your words, store the paper somewhere safe, and hope nothing goes wrong. If someone finds it, they can take everything. If you lose it, recovery is likely impossible. If you copy one word incorrectly, you may lock yourself out permanently. Every additional copy you make becomes another single point of failure.
That is the reason many people leave crypto on exchanges even when they understand the risks. Self-custody feels too technical and too easy to get catastrophically wrong. The Coldcard incident made this visible at a scale that can no longer be ignored, but the fragility of the seed phrase model was always there.
TapSafe was built to remove that fragility without removing self-custody.
TapSafe Recovery Explained
TapSafe Recovery is Ryder One's self-custodial recovery system. It’s built on Shamir's Secret Sharing, a proven cryptographic method that divides your recovery into multiple pieces where no single piece reveals anything on its own. You’d need a valid combination of pieces to reconstruct access, which means no single dependency, no single location, and no single point of failure.
In practice, your backup is distributed across three layers: a Recovery Tag holding 50% of your wallet recovery, your paired phone holding 50%, and optional Recovery Contacts each holding 25%. No single backup can unlock your wallet alone, and Recovery Contacts cannot act without additional components. Valid recovery paths include a Tag and your phone, two Recovery Tags, your phone and two Recovery Contacts, a Tag and two Recovery Contacts, or four Recovery Contacts.
If someone finds your Recovery Tag, it is useless on its own. If you lose your phone, your cloud-backed phone backup can still be restored. If you lose everything, you can still restore your backup through Recovery Contacts. If you want more redundancy, you can add more Recovery Tags or Recovery Contacts without starting over. That flexibility is deliberate, and it is one of the things that makes TapSafe's architecture convenient.
Your seed phrase still exists on your Ryder One as a last resort and follows the BIP-39 standard. You can also import or export a BIP-39 seed phrase if you want that option. However, for most people, TapSafe is the default recovery experience, and the seed phrase is there if you ever need it, not because you depend on it daily.
How Ryder's Shamir Implementation Is Different
Most Shamir’s Secret Sharing implementations work like a one-time event. You choose a fixed number of pieces, choose a fixed threshold, generate that exact set, and the internal generation state is discarded. That approach does not fit real life, it’s basically creating a similar seed phrase situation.
People lose things. They buy new devices, they move countries, they want to add backups later without starting over. Ryder built TapSafe around a different set of requirements: no single backup should provide wallet access, no single backup should reveal information about the wallet, backups should not reveal how many backups exist, and users should be able to create more backups later that remain fully compatible with earlier ones.
To support this, TapSafe uses a generator stored securely in the EAL6+ secure element on the Ryder One. That generator allows the device to create additional compatible backup pieces at any time, without forcing you to restart your wallet setup from scratch. It is technical sophistication that produces a simpler user experience: you just tap.
We filed this patent because TapSafe takes a new and much-needed approach to hardware wallet recovery and self-custody. The combination of distributed cryptographic backup, NFC-based recovery mechanics, a generator stored in the secure element that allows future compatible backups, and the specific architecture that allows recovery without exposing the seed phrase to any single device or person is an architecture the USPTO has not seen before in this context. Filing in July 2026 establishes our priority date, the legal marker that says this is ours, and we built it first.
The Hardware Behind the Recovery
The recent Coldcard incident revealed fears of the broader community, that self-custody and hardware wallet security are only as strong as its weakest step. Seed generation, firmware integrity, recovery architecture, and audit transparency all matter. A device can have an excellent secure element and still fail at the step before it, or the step after it.
Ryder One was built with TapSafe Recovery. The full hardware wallet experience addresses what happens when things go wrong, when a device is lost or damaged and when a user cannot find their backup or is no longer able to access it.
The Ryder One hardware wallet is fully offline with no ports, no Bluetooth, and no WiFi. It uses NFC for interaction, has a 1.6-inch AMOLED screen for transaction verification, an Infineon secure element rated CC EAL6+, and IP67 dust and water resistance.
Recovery Tags use an NXP MIFARE DESFire EV3 chip rated CC EAL5+, with 25-year data retention and durability against water, dust, and daily wear. As we’ve learned, recovery is only as trustworthy as the system that stores and protects it, which is why TapSafe is built on secure hardware, physical interaction, and distributed backup logic rather than a cloud account holding your wallet.
The Questions You Should Be Asking Right Now
If you already own a Ryder One, your recovery is protected by TapSafe. You do not need to do anything differently. The architecture described in our patent filing is what is running on your device today.
If you are evaluating hardware wallets after the events of July 2026, here are the questions every manufacturer should now be answering publicly: How does your device generate seeds, and has that process been independently audited? What happens to your backup if your device is lost or destroyed? Does your recovery depend on a single piece of paper? What independent security review has your recovery architecture undergone?
We can answer all of those questions for Ryder One. The Halborn audit, conducted between October and December 2025, independently validated our BIP-32, BIP-39, and BIP-44 implementation, our Shamir's Secret Sharing implementation, and our side-channel resistance. Ryder also has a roadmap to open-source TapSafe and its Shamir implementation as part of a broader transparency commitment. Those findings are published.
The industry was not ready for self-custody at scale. We’ve built the infrastructure to make it ready.
FAQ
What does patent pending mean?
Patent pending means a patent application has been filed with the United States Patent and Trademark Office and is currently under review. It establishes a priority date and signals that the invention has been formally documented as novel. It does not guarantee a patent will be granted.
Does the patent application change how TapSafe works on my device?
No. The TapSafe Recovery architecture described in the filing is what is running on Ryder One today. The patent application documents what already exists.
Does TapSafe eliminate my seed phrase?
TapSafe removes the dependency on your seed phrase in normal use. Your seed phrase still exists on your Ryder One as a last resort and follows the BIP-39 standard, so you can always import into any compatible wallet if needed.
What is Shamir's Secret Sharing?
Shamir's Secret Sharing is a cryptographic method that divides a secret into multiple pieces, called shares, where no single share reveals anything about the original secret. You need a minimum number of shares together to reconstruct it. TapSafe uses this principle to distribute your backup across three layers with no single point of failure.
Can I add more backups after initial setup?
Yes. Because TapSafe stores a generator in the secure element, you can create additional compatible Recovery Tags or add Recovery Contacts at any time without restarting your wallet setup.
Has TapSafe been independently audited?
Yes. Halborn conducted an independent security audit between October and December 2025, covering our BIP-32, BIP-39, and BIP-44 implementation, Shamir's Secret Sharing, and side-channel resistance. The findings are published at halborn.com.
Share: