Leather: keys, security, fees and reviews
In short
- Key control
- Non-custodial: Leather has no access to users' seed phrases, passwords or wallets.
- Risks and caveats
- Leather does not store the Secret Key; losing it means losing access to the wallet.
- Checked
- 31 October 2026
Visitor ratings: do you like Leather?
Key facts
- Official site
- leather.io
Key facts checked on 31 October 2026 against official sources.
Status
Renamed from Hiro Wallet to Leather on 31 August 2023, when Leather Wallet LLC, a Trust Machines subsidiary, acquired the wallet assets from Hiro Systems PBC.
What is Leather
Leather is a self-custodial wallet for Bitcoin and the Stacks layer 2, offered as a browser extension and as iOS and Android apps. It was known as Hiro Wallet until August 2023 and is now developed by Leather Wallet LLC, a Trust Machines subsidiary.
Who holds the keys
| Parameter | Details |
|---|---|
| Key control | Non-custodial: Leather has no access to users' seed phrases, passwords or wallets. |
| Seed phrase | Leather does not store the Secret Key (seed phrase); users must secure it themselves. |
| Wallet encryption | Hot wallet: keys are stored on the user's device and encrypted with a password key derived by Argon2id (previously PBKDF2). |
Features and supported networks
| Parameter | Details |
|---|---|
| Platforms | Browser extension (Chrome) and mobile apps for iOS and Android. |
| Supported networks | Bitcoin and Stacks, including Ordinals, Stamps, BRC-20, Runes and sBTC. |
| Swaps | In-wallet decentralized swaps of over 100 tokens via Bitflow, Velar, ALEX and the sBTC bridge. |
| Hardware wallet support | Ledger devices for Bitcoin and Stacks transactions. |
| Staking | Stacks pooled and liquid staking, and an sBTC rewards programme. |
Security and audits
- Open source under the MIT licence; the code moved from the leather-io/extension repo to the leather-io/mono monorepo.
- Least Authority audited the wallet in 2021, when it was Hiro Wallet, before the first browser extension release.
- Bug bounty with HackerOne from 2023 to 2026 and with Immunefi since August 2026.
- Leather disclosed and fixed two vulnerabilities: an unlocked-session issue across tabs (December 2022) and browser caching of an imported Secret Key (August 2023).
Security incidents
No security incident is recorded in the sources checked on 31 October 2026 (the company’s own channels and incident databases): api.llama.fi/hacks, rekt.news/leaderboard, hacked.slowmist.io/search, leather.io/blog, forum.stacks.org/t/upgrade-stacks-wallet-for-web, api.github.com/repos/leather-io/extension/securi
History
| Date | Event |
|---|---|
| 2021 | Least Authority audit of Hiro Wallet ahead of the first browser extension release in the Chrome and Firefox stores. |
| 31 August 2023 | Hiro Wallet renamed Leather after Leather Wallet LLC, a Trust Machines subsidiary, acquired the wallet assets from Hiro Systems PBC. |
| 29 February 2024 | Password key derivation switched from PBKDF2 to Argon2id (described in a February 2024 post). |
| August 2026 | Bug bounty moved to Immunefi. |
Risks and caveats
- Leather does not store the Secret Key; losing it means losing access to the wallet.
- Leather warned of an active email phishing scam and says it never sends emails.
- Hot wallet: keys sit on the device where the wallet is installed; a Ledger can be connected for cold storage.
About the developer
- Legal entity
- Leather Wallet, LLC.
- Parent company
- Trust Machines (co-founded by Stacks co-creator Muneeb Ali); the repository licence names Nassau Machines as parent.
- Licence / registration
- Terms of service governed by the laws of the State of Delaware.
Official links
- Website: leather.io
- Support: app.leather.io/help-center
- Source code: github.com/leather-io/mono
- Security: leather.io/posts/security
Questions and answers
Is Leather self-custodial?
Yes. Leather does not store users' Secret Keys or passwords; keys are kept encrypted on the user's device.
Is Leather the same as Hiro Wallet?
Yes. Hiro Wallet was renamed Leather on 31 August 2023 when Trust Machines' subsidiary Leather Wallet LLC acquired the wallet from Hiro Systems PBC.
Is Leather open source and audited?
Yes. The code is MIT-licensed on GitHub, Least Authority audited it in 2021, and it runs a bug bounty, with Immunefi since August 2026.
Which networks does Leather support?
Bitcoin and the Stacks layer 2, including Ordinals, Runes, BRC-20 and sBTC, with Ledger support.
Sources
- Leather — Home
- Leather — Security
- Leather — Introducing Leather (31 August 2023)
- Leather — How Leather carries out secure transactions
- Leather — Terms of service
- GitHub — leather-io/mono LICENSE
- GitHub — leather-io/extension (deprecated)
More in this section
How voting works
Votes are anonymous and carry no text. Each device has one vote per item; press the same button again to remove it. Cloudflare Turnstile checks that a person is voting. We keep a random device ID in a cookie and a salted hash of the IP address to limit abuse — no names, no accounts. Votes are visitors’ opinions, not investment advice.
Page updated: