NGRAVE ZERO Review 2026
The Most Expensive Air-Gap Wallet (7.5/10)

Rating Breakdown

Hardware Specs

What Is the NGRAVE ZERO?

The NGRAVE ZERO is a premium hardware wallet manufactured in Belgium by NGRAVE, a company founded in 2018. It is the only consumer hardware wallet to achieve EAL7 Common Criteria security certification, the highest level of independent security evaluation available. The device was developed in collaboration with Jean-Jacques Quisquater, one of the cryptographers whose work was cited in Satoshi Nakamoto's original Bitcoin whitepaper. EAL7 certification testing was performed at imec, a globally respected nanoelectronics research institute in Leuven, Belgium.

In terms of hardware, the NGRAVE ZERO is genuinely impressive. The large 4-inch color touchscreen, fingerprint sensor, IP55 water and dust resistance, and overall build quality place it in a category above most hardware wallets in physical construction. The air-gap implementation is the strictest available in any consumer device: data enters and exits the ZERO only through QR codes displayed on its screen. There is no USB data port, no Bluetooth, no WiFi, no NFC chip, and no microSD slot. The USB-C port is wired for charging only.

At $398, the NGRAVE ZERO costs twice as much as the Foundation Passport and more than double the Coldcard Mk4. The premium buys exceptional hardware quality and EAL7 certification. What it does not buy is open-source firmware, flexible ecosystem compatibility, or the Bitcoin-specific advanced features the Coldcard and Passport provide. For most individual Bitcoiners, that is the wrong tradeoff.

EAL7 Certification: What It Means and Does It Matter for You?

EAL stands for Evaluation Assurance Level under the Common Criteria framework, an international standard for independent security product evaluation. EAL7 is the top level, requiring formal mathematical proofs of security properties and the most rigorous independent testing regime available. No other consumer hardware wallet has achieved it. Most use EAL5+ or EAL6+ Secure Element chips, but they do not pursue full device-level EAL7 evaluation.

For institutional buyers, EAL7 is meaningful. It creates a documented, independently verified security claim that satisfies compliance requirements, procurement policies, and formal audit trails. If your organization must demonstrate that signing hardware met a defined security standard, EAL7 provides that paper trail. That is a real and specific value for custodians, investment funds, and businesses managing Bitcoin on behalf of clients.

For individual Bitcoiners, EAL7 matters less than the marketing suggests. The certification evaluates a specific device build at a point in time. It cannot verify every subsequent firmware update. And it cannot replace the daily value of open-source code that thousands of independent researchers can review continuously. A certified closed-source system is less verifiable on an ongoing basis than an uncertified open-source one. The Bitcoin security community broadly holds this view, which is why the Coldcard, Foundation Passport, BitBox02, and Trezor are rated more highly despite lower formal certifications.

The honest summary: EAL7 is a genuine achievement and a real differentiator for compliance use cases. For personal Bitcoin storage where you control your own threat model, open-source firmware is a more practical and continuously verifiable form of security assurance.

Air-Gap Architecture: QR-Only Signing

The NGRAVE ZERO's air-gap implementation is uniquely strict. Most wallets that claim air-gap capability offer it as an optional mode while retaining USB data connectivity for convenience. The Foundation Passport does QR codes but also has a microSD slot. The Coldcard does microSD but also has a USB-C data port. The NGRAVE ZERO has neither. QR codes are the only communication channel, with no fallback.

This workflow is visually verifiable and architecturally clean. The data channel is visible: you can see the QR codes. There are no hidden wireless transmissions, no cables that could carry unexpected data, and no microSD cards that could be tampered with in transit. For someone deeply concerned about their signing device being compromised through a data channel, the NGRAVE ZERO provides the cleanest possible implementation.

The significant limitation is that this workflow depends entirely on NGRAVE LIQUID. The Foundation Passport does QR signing too, but it works with Sparrow Wallet, BlueWallet, and other open PSBT-compatible software. NGRAVE ZERO is locked to LIQUID, which means your signing capability depends on NGRAVE remaining operational and maintaining their app.

The Light Sensor: A Genuinely Unique Feature

The NGRAVE ZERO includes a light sensor that reads the ambient light spectrum of your environment during seed generation. NGRAVE calls this "Perfect Key" technology. The premise is that the light conditions in your specific location at the precise moment of setup are a source of physical entropy that cannot be reproduced by anyone else. Even if an attacker knew every other parameter of your setup process, they could not recreate the exact photonic environment in your home at that moment.

Combined with the fingerprint sensor, which reads biometric data as additional entropy, the device incorporates more real-world randomness into seed generation than hardware RNG alone. NGRAVE markets this as a meaningful security improvement over standard random number generation.

The practical security benefit over a well-implemented hardware RNG is likely marginal. Cryptographically secure random number generators in modern Secure Elements are designed to be unpredictable by construction. The light and fingerprint sensors add entropy to an already-sufficient process rather than solving a real vulnerability. That said, the principle is sound and the feature is genuinely novel. No other hardware wallet approaches seed generation this way, and more diverse entropy sources cannot hurt.

The Closed Firmware Problem: An Honest Critique

This is the most important criticism of the NGRAVE ZERO and it deserves direct treatment. The device firmware is closed source and proprietary. NGRAVE does not publish the code running on the ZERO. You cannot read it, audit it, compile it yourself, or verify that it does exactly what NGRAVE claims. No independent security researcher outside the EAL7 evaluation process has reviewed the actual firmware code.

NGRAVE's position is that EAL7 certification compensates for the lack of open source. Their argument: the most rigorous independent testers verified the security at the highest level, so the result should be trusted. The Bitcoin community's counterargument is well-established: certification happens once, verifies one specific build, and cannot be independently reproduced by users after the fact. Open-source code can be verified by anyone, at any time, for any firmware version.

Consider what the alternatives offer. The Coldcard publishes every line of firmware and the hardware schematics on GitHub. The Foundation Passport publishes firmware, hardware design, and the Envoy app. The BitBox02 and Trezor both publish open firmware. With those devices, you do not need to trust the manufacturer's word. The code is public, auditable by the community, and any suspicious changes would be called out publicly within days.

Paying $398 for a device whose security claims cannot be independently verified is a meaningful tradeoff to understand. For individual Bitcoin holders focused on self-sovereignty, this is difficult to justify. For institutional buyers with formal compliance requirements, EAL7 may matter more than community auditability. Know clearly which category applies to you.

NGRAVE GRAPHENE: The Proprietary Backup System

GRAPHENE is NGRAVE's stainless steel seed backup system. It uses two plates: one with a QR-coded grid pattern unique to your device, and one containing your encrypted key data. Both plates are required together to reconstruct your wallet. Neither plate alone reveals anything useful.

The concept is legitimate. Splitting a backup into two pieces stored at separate physical locations is a valid security strategy. If one location is compromised, an attacker still cannot access your funds without the second plate. GRAPHENE delivers this idea in premium stainless steel designed to survive fire, flooding, and physical damage.

The issue is cost and proprietary lock-in. GRAPHENE costs approximately $99 on top of the $398 device, bringing the full setup to roughly $497. A standard stainless steel BIP-39 seed backup plate that works with any hardware wallet costs $30 to $80. If you want a two-location split backup strategy with any other device, you buy two standard backup plates. GRAPHENE encodes the same underlying BIP-39 seed, so the proprietary format is a wrapper around a standard. The premium reflects the brand experience, not a fundamental security advantage.

GRAPHENE is a well-executed product for NGRAVE users who want the full premium ecosystem. It is not required for solid seed security, and its price premium is hard to justify compared to open, standard alternatives that work across any wallet.

LIQUID App Dependency: The Vendor Lock-In Risk

The NGRAVE ZERO requires the NGRAVE LIQUID app to function as a signing device. Unlike most hardware wallets that work with multiple open-source wallet applications, the ZERO is designed exclusively for the LIQUID ecosystem. It cannot be used with Sparrow Wallet, Electrum, BlueWallet, or any standard Bitcoin software that implements the PSBT specification.

This creates a specific and real risk: if NGRAVE ceases operations, LIQUID stops receiving updates, or the app becomes unavailable on your phone's operating system, your ZERO cannot sign transactions. Your seed phrase is always recoverable to any BIP-39 wallet (the underlying standard is open and portable), but the device itself becomes unusable for signing without a working LIQUID app. Recovery would require abandoning the ZERO entirely and restoring to a different wallet from your seed backup.

NGRAVE is a smaller company operating in a competitive market. Longevity risk is real. Compare this to Sparrow Wallet, which is open-source and community-maintained, or Electrum, which has operated since 2011 without dependence on any single company. A Coldcard or Foundation Passport user's signing workflow continues regardless of what happens to any particular software company.

The LIQUID app also lags behind Sparrow in feature maturity. Coin control, custom fee management, and multisig coordination that Sparrow handles with precision are less developed in LIQUID. Users who want full control over their transaction construction will find this limiting. NGRAVE has been improving the app, but it is not at feature parity with what a Sparrow-connected device can do.

How Does the NGRAVE ZERO Compare?

An honest comparison across the wallets most buyers consider alongside the NGRAVE ZERO.

Pros and Cons

Who Should Buy the NGRAVE ZERO?

The NGRAVE ZERO has a real and specific audience. Institutional users, fund managers, compliance officers, and organizations that require documented EAL7 certification for their custody processes have a genuine reason to choose this device. EAL7 creates a verifiable audit trail that no other consumer device can match. If your procurement process demands a formal security evaluation at the highest level, the NGRAVE ZERO is the only answer.

High-net-worth individuals who value premium hardware quality above open-source transparency will find the NGRAVE ZERO satisfying. The build quality is exceptional. The large touchscreen and fingerprint sensor make the device feel genuinely advanced compared to most hardware wallets. If the physical experience of using a premium device matters and $398 is not a constraint, this is the best-constructed signing device available.

For most Bitcoin holders, the honest recommendation is the Foundation Passport at $199 instead. The Passport is fully open-source across hardware, firmware, and app. It is air-gapped via QR codes, Bitcoin-only, works with Sparrow Wallet, and has excellent Envoy app support. You get better Bitcoin-specific security properties, a more open and durable ecosystem, and you save $200. The only things you give up are EAL7 certification and premium hardware aesthetics.

If open-source air-gap security with maximum features is your priority, the Coldcard Mk4 at $157 provides the most security-hardened option with full firmware and hardware auditability, dual Secure Elements, and features no other wallet offers.

The NGRAVE ZERO is not for beginners, and it is not the right choice for Bitcoiners who prioritize open-source transparency. It is a niche product for a specific buyer. Understanding whether you are that buyer matters before committing $398.

Frequently Asked Questions