Biometric Authentication Solutions

ZenGo integrates biometric authentication as a core layer of both wallet access and account recovery. The wallet's FaceLock feature uses facial recognition to verify user identity during the recovery process, working alongside email verification and an encrypted backup file stored in iCloud or Google Drive to form a multi-factor recovery system. Because the biometric check is one component of a layered recovery model built on MPC cryptography, compromising any single factor is insufficient on its own to gain wallet access. This design ties authentication to the physical user rather than a transferable secret like a password or seed phrase. ZenGo has reported no successful wallet hacks since its 2018 launch, a record it attributes to the combination of MPC key distribution and this layered biometric authentication approach across its 2 million-user base.

Passkeys Wallet is an embedded wallet SDK that replaces seed phrases with WebAuthn passkeys — the biometric standards behind Face ID and fingerprint unlock — to create and sign transactions across Solana, Bitcoin, Ethereum, and over a dozen EVM-compatible chains. Built by Exodus Movement and launched in July 2024, the wallet activates through a browser popup with no extension install required. The biometric event happens entirely on the user device, with no passphrase to memorize or back up. The underlying security model uses multi-party computation (MPC), splitting the private key between the user device and a remote server so neither party alone can authorize a transaction. A signing event requires the client-side partial key — which decrypts only during a biometric authentication — plus the server-side component. Because WebAuthn credentials are cryptographically scoped to the originating domain, phishing pages cannot harvest usable signing material, eliminating a common credential-theft vector that affects traditional crypto wallets.

SollPay integrates biometric authentication as the primary user-facing security layer for its Solana wallet. Face ID and equivalent biometric methods authenticate users at the app level, while a separate zero-knowledge proof layer handles on-chain identity verification. These two layers operate independently, providing defense in depth without relying on passwords or seed phrases. The biometric layer pairs with the device's secure enclave — iOS Secure Enclave or Android TPM — where the private key is generated and stored without ever being transmitted externally. A ZK Proving Server running inside a Trusted Execution Environment handles proof generation, ensuring no personal data is exposed on-chain. The result is a wallet that authenticates through familiar biometric hardware while maintaining cryptographic security standards across both the app and on-chain layers.

Solana Mobile built its Seed Vault as a hardware-backed security boundary that stores private key material in a trusted execution environment isolated from the Android OS, ensuring seed phrases and private keys are never exposed to system software or applications. Transaction signing is completed locally inside the Seed Vault, with biometric authentication gating each authorization before a signed output is returned to the requesting app. The Seeker integrates a power-button fingerprint sensor directly tied to the Seed Vault, and a double-tap gesture on the power button enables quick transaction approvals without unlocking the full device. The Mobile Wallet Adapter protocol routes signing requests from dApps into the Seed Vault, keeping key material inaccessible to application code at all times. This architecture means users authenticate and authorize transactions entirely on-device using biometrics, without relying on software wallets, browser extensions, or externally stored credentials. The biometric-first approach to transaction authorization defines the Solana Mobile security model across both the first-generation Saga and the Seeker.

LazorKit is open-source passkey smart wallet infrastructure for Solana that eliminates seed phrases in favor of device biometrics. Users create non-custodial wallets through a WebAuthn ceremony authenticated via Face ID, Touch ID, or Windows Hello, with the private key confined to the device's Secure Enclave and synced through iCloud Keychain or Google Password Manager. A Program Derived Account is derived from the passkey credential, so the same biometric maps to the same on-chain wallet address every time. The V2 on-chain program uses the Secp256r1 curve, the same elliptic curve as WebAuthn and Apple Secure Enclave, allowing passkeys to sign transactions directly on-chain at approximately 9,441 compute units per operation. Role-based access control structures wallet authority into Owner, Admin, and Spender tiers with strictly enforced hierarchical permissions and self-removal protection. Session keys are ephemeral Ed25519 signers derived from a single passkey prompt, supporting up to 16 immutable permission rules covering SOL spending caps, per-mint token limits, recurring window budgets, and program whitelists or blacklists. Sessions expire by absolute slot with a maximum of 30 days and consume 4,483 to 5,983 compute units versus 9,441 for full passkey operations. The V2 program completed a security audit by Accretion with all 17 identified issues resolved before mainnet deployment.

SecuX Technology's Shield Bio is a card-format cold wallet that incorporates an onboard fingerprint sensor for biometric authentication, positioning it as one of the few hardware wallets to combine cryptographic key isolation with biometric authorization in a payment-card form factor. Rather than relying solely on PIN entry, Shield Bio requires a registered fingerprint to authorize transactions, reducing exposure to PIN observation attacks and bringing the device experience closer to biometric-protected payment cards. The device retains the CC EAL5+-certified Infineon secure element that anchors the rest of the SecuX lineup, meaning biometrics serve as an access layer on top of a hardened cryptographic core. SecuX's FIDO2 product line — the PUFido Clife Key and PUFido Drive Clife Key — extends hardware authentication into web and enterprise identity. These USB-C security keys are FIDO2/U2F certified and embed Physically Unclonable Function (PUF) technology from eMemory, generating device-unique cryptographic identities from chip manufacturing variation that cannot be cloned or replicated. The PUFido Drive variant combines 128 GB of encrypted file storage alongside FIDO2 passwordless authentication in a single device. Both draw directly on the foundational chip expertise of SecuX co-founder Dr. Charles Hsu, who also founded eMemory. Together, the Shield Bio and PUFido lines represent SecuX's approach to hardware-rooted biometric identity across Solana self-custody and broader web2/web3 authentication scenarios.

Secuwa is a self-custody personal finance platform that eliminates seed phrases entirely through passkey authentication backed by account abstraction smart contracts. Users authorize transactions using the same biometric credential or device PIN they use to unlock their phone, with Apple iCloud Keychain or Google Password Manager handling key backup transparently. Because private keys never leave the user device and are protected by existing cloud infrastructure, phishing attacks that target seed phrase exposure are structurally removed as an attack vector. The platform builds each user account as an account abstraction smart wallet relying on the Safe smart-contract infrastructure, an audited and widely deployed standard in the account abstraction space. This architecture allows passkey modules to tie account authorization directly to device credentials rather than raw private keys, retaining full on-chain self-custody at the contract layer while delivering a consumer-grade experience at the interface layer. Recovery flows through the same systems users already trust for password management, removing the single most common barrier to self-custody adoption for retail users in markets such as the United Kingdom and Nigeria.

Sumsub founders built fraud-detection tools for image manipulation before launching the company, experience that shaped its biometric verification core. Its KYC module performs facial liveness checks, deepfake detection, and age estimation alongside document OCR and address verification, supporting over 14,000 document types. Pass rates reach 96 percent in France and the UK and 92 percent in the United States, with over one million verifications processed daily. The biometric layer connects directly to Sumsub on-chain identity architecture. When completing KYC, a user signs a message proving wallet ownership, binding biometric identity to a blockchain address. Chainlink then issues a Cross-Chain Identity credential derived from that biometric check -- a privacy-preserving attestation usable across Web3 protocols without re-exposing personal data.

HOT Wallet supports biometric login as one of its core authentication methods, alongside SMS verification, Google Authenticator, and email, allowing users to access a non-custodial multi-chain wallet without managing seed phrases for day-to-day authentication. This authentication model is designed to lower the barrier to Web3 entry while preserving self-custody of assets across 140+ blockchains including Solana. The wallet's security architecture pairs biometric and multi-factor authentication options with HOT Protocol's distributed MPC validator network, where threshold cryptography ensures no single party can access user funds even with valid authentication credentials. As of mid-2026, HOT Wallet reports over 35 million wallets, with its combination of biometric-friendly authentication, replaceable seed phrases, and transferable account ownership representing a distinct approach to Web3 identity and access management.