Blockstream Jade Plus Wallet Review

The Jade Plus is for Bitcoiners who treat auditability as a hard requirement.

• Bitcoin-only holders who want cold storage from a company with more than a decade of Bitcoin-native credibility.
• Open-source purists who refuse to trust a closed secure-element chip they cannot inspect.
• Air-gap users who want camera-based QR signing with a battery and no cables.
• Sparrow, Electrum, and multisig users who want a device that plays well with the whole Bitcoin toolchain.
• Liquid and Lightning users who want L-BTC and swap-based Lightning from cold storage.

It is not for altcoin or multichain holders, since the device signs nothing outside Bitcoin and Liquid. It is not for DeFi or NFT users. And a buyer whose threat model demands an EAL-certified secure element over open-source auditability should look at a certified-chip competitor instead.

The Jade Plus is Blockstream's flagship hardware wallet, launched in January 2025; the $99 Jade Core joined the lineup in April 2026 as the entry model. Blockstream is one of the oldest Bitcoin-infrastructure companies in the industry, it built the Liquid Network sidechain the device supports, and its CEO Adam Back is a cypherpunk whose Hashcash work is cited in the Bitcoin whitepaper. That pedigree is a real trust signal for a product whose entire job is holding Bitcoin keys.

The product identity is worth stating exactly, because past coverage of this device has muddled it. The Jade Plus is a Bitcoin and Liquid cold-storage device. It has no Monero support, no Ethereum support, no altcoin support of any kind, and it is not a software wallet. Keys are generated on the device and never leave it.

The Jade Plus is textbook self-custody. You hold the 12 or 24-word BIP39 seed, you can add a passphrase, and Blockstream holds nothing that can move your coins.

The headline design decision is the security model. The Jade Plus has no traditional secure element. Instead it runs what Blockstream calls a virtual secure element: an open-source blind-oracle scheme in which the oracle stores only a hash of your PIN plus a nonce. The oracle is “truly blind,” meaning it learns nothing about your keys or your wallet, and you can run your own oracle rather than use Blockstream's. Extracting keys from a stolen device requires compromising both the physical hardware and the oracle server.

That absence of a secure element is a deliberate exchange, and it deserves an honest framing. Certified secure elements are closed chips bound by NDAs that no outside researcher can fully inspect. Blockstream gave that up so the entire device, silicon design included, could be published and audited by anyone. For the open-source-first buyer that is the point of the product. For a buyer who specifically wants an EAL-certified chip guarding the seed, it is the one line on the spec sheet that argues for a different device, and it is the main reason this review holds the score under 8 rather than treating the model as a flaw.

The rest of the stack is conventional and solid: signed firmware with secure boot, anti-rollback protection, Genuine Check device verification, and full transaction review on the 1.9-inch screen before anything is signed. The camera enables a fully air-gapped workflow over QR codes, so the device never has to touch a USB cable or a Bluetooth pairing if you don't want it to.

Incident History

A 2026 review has to state this plainly. Firmware versions 1.0.24 through 1.0.36 carried a flaw in the register_descriptor RPC that, given tailored malware and access to the connected host, allowed limited code execution up to potential secret-key extraction. Blockstream released the fix in firmware 1.0.37 in November 2025, added downgrade protection in 1.0.38 a week later, and published a full public disclosure in December 2025. The flaw was reported responsibly by the security group DARKNAVY, and there is no known exploitation in the wild. Anyone buying or holding a Jade Plus should confirm firmware 1.0.38 or later before use.

Two related notes round out the record. When the ESP32 “backdoor” claims (CVE-2025-27840) circulated in 2025, Blockstream publicly assessed the Jade as unaffected, and Espressif itself pushed back on the “backdoor” label, describing the findings as undocumented debug commands rather than a remote backdoor. And a 2025 phishing campaign sent fake “firmware update” emails to Jade owners, which Blockstream countered with a public alert. Neither was a product flaw. There has been no breach of user funds, no insolvency scare, and no regulatory action. Transparent disclosure of the one real vulnerability is exactly how a hardware vendor should behave, and it counts in the device's favor.

Bitcoin mainnet and the Liquid Network. That is the complete list. Liquid support covers L-BTC and Liquid-issued assets, and it is native, not a third-party bolt-on, since Blockstream built the sidechain.

Lightning works through the Blockstream app rather than natively on the device: incoming Lightning payments settle to L-BTC, and outgoing Lightning payments spend L-BTC through an atomic swap. That gets a Jade owner in and out of Lightning without a separate hot balance, but it is not on-device Lightning, and the review would be overstating things to call it that.

No ETH, no EVM chains, no Solana, no stablecoins outside Liquid, no NFTs, no DeFi. Anyone who reads that as a defect is the wrong buyer. The device is built for people whose portfolio is Bitcoin, and scoring it as a failed multichain wallet would miss what it is.

Setup follows the standard hardware-wallet path: generate a seed on-device, write down the 12 or 24 words, optionally add a BIP39 passphrase, and optionally back up the seed as a SeedQR for camera-based restore. Recovery on a replacement device works from any of those. No KYC applies at the wallet level, though third-party buy providers apply their own checks.

The companion app is the Blockstream app, the former Green wallet under its current name. Third-party support is one of the device's best usability facts: it pairs with Sparrow, Nunchuk, Specter, SideSwap, BlueWallet, Electrum, Liana, Keeper, Wasabi, and Bitcoin Safe. A Jade Plus owner is never locked into Blockstream's software, which fits the product's whole auditability pitch.

Day to day, you choose your connection: USB-C, Bluetooth, or camera-only QR signing for a true air gap. The battery means the QR workflow runs without any cable at all. Transaction details render on the device screen for verification before signing, so a compromised phone or laptop cannot silently swap a destination address past you.

Feature depth is intentionally thin, which is consistent with the product. There is no staking, no dApp browser, and no multichain portfolio view. The Blockstream app covers bitcoin purchases through third-party on-ramp providers, Liquid asset management, and the Lightning-via-L-BTC swap path described above. SideSwap integration adds Liquid swaps. Everything else is delegated to the long list of compatible Bitcoin apps, which is where power users will live anyway, with Sparrow or Electrum driving the device for multisig and coin control.

From $149 to $169, and that is the whole cost. Blockstream's official store prices the plastic Classic Black at $149 and the metal variants at $169.99, and international shipping is free. There is no subscription, no software fee, and no charge for any of the companion apps. Against certified-secure-element competitors in the $79 to $249 hardware bracket, an open-source device with a camera, battery, and air-gap workflow at this price is competitive. Buyers who only need the core signing feature set can drop to the $99 Jade Core in the same lineup.