[Wallets](https://revain.org/wallets/) › Leather

# Leather: keys, security, fees and reviews

## In short

- **Key control**: Non-custodial: Leather has no access to users' seed phrases, passwords or wallets.
- **Risks and caveats**: Leather does not store the Secret Key; losing it means losing access to the wallet.
- **Checked**: 31 October 2026

## Key facts

- **Official site**: [leather.io](https://leather.io/)

Key facts checked on 31 October 2026 against official sources.

## Status

Renamed from Hiro Wallet to Leather on 31 August 2023, when Leather Wallet LLC, a Trust Machines subsidiary, acquired the wallet assets from Hiro Systems PBC.

## What is Leather

Leather is a self-custodial wallet for Bitcoin and the Stacks layer 2, offered as a browser extension and as iOS and Android apps. It was known as Hiro Wallet until August 2023 and is now developed by Leather Wallet LLC, a Trust Machines subsidiary.

## Who holds the keys

| Parameter | Details |
|---|---|
| Key control | Non-custodial: Leather has no access to users' seed phrases, passwords or wallets. |
| Seed phrase | Leather does not store the Secret Key (seed phrase); users must secure it themselves. |
| Wallet encryption | Hot wallet: keys are stored on the user's device and encrypted with a password key derived by Argon2id (previously PBKDF2). |

## Features and supported networks

| Parameter | Details |
|---|---|
| Platforms | Browser extension (Chrome) and mobile apps for iOS and Android. |
| Supported networks | Bitcoin and Stacks, including Ordinals, Stamps, BRC-20, Runes and sBTC. |
| Swaps | In-wallet decentralized swaps of over 100 tokens via Bitflow, Velar, ALEX and the sBTC bridge. |
| Hardware wallet support | Ledger devices for Bitcoin and Stacks transactions. |
| Staking | Stacks pooled and liquid staking, and an sBTC rewards programme. |

## Security and audits

- Open source under the MIT licence; the code moved from the leather-io/extension repo to the leather-io/mono monorepo.
- Least Authority audited the wallet in 2021, when it was Hiro Wallet, before the first browser extension release.
- Bug bounty with HackerOne from 2023 to 2026 and with Immunefi since August 2026.
- Leather disclosed and fixed two vulnerabilities: an unlocked-session issue across tabs (December 2022) and browser caching of an imported Secret Key (August 2023).

## Security incidents

No security incident is recorded in the sources checked on 31 October 2026 (the company’s own channels and incident databases): [api.llama.fi/hacks](https://api.llama.fi/hacks), [rekt.news/leaderboard](https://rekt.news/leaderboard), [hacked.slowmist.io/search](https://hacked.slowmist.io/search/), [leather.io/blog](https://leather.io/blog), [forum.stacks.org/t/upgrade-stacks-wallet-for-web](https://forum.stacks.org/t/upgrade-stacks-wallet-for-web-alpha-now-to-patch-security-vulnerability/11789), [api.github.com/repos/leather-io/extension/securi](https://api.github.com/repos/leather-io/extension/security-advisories)

## History

| Date | Event |
|---|---|
| 2021 | Least Authority audit of Hiro Wallet ahead of the first browser extension release in the Chrome and Firefox stores. |
| 31 August 2023 | Hiro Wallet renamed Leather after Leather Wallet LLC, a Trust Machines subsidiary, acquired the wallet assets from Hiro Systems PBC. |
| 29 February 2024 | Password key derivation switched from PBKDF2 to Argon2id (described in a February 2024 post). |
| August 2026 | Bug bounty moved to Immunefi. |

## Risks and caveats

- Leather does not store the Secret Key; losing it means losing access to the wallet.
- Leather warned of an active email phishing scam and says it never sends emails.
- Hot wallet: keys sit on the device where the wallet is installed; a Ledger can be connected for cold storage.

## About the developer

- **Legal entity**: Leather Wallet, LLC.
- **Parent company**: Trust Machines (co-founded by Stacks co-creator Muneeb Ali); the repository licence names Nassau Machines as parent.
- **Licence / registration**: Terms of service governed by the laws of the State of Delaware.

## Official links

- Website: [leather.io](https://leather.io/)
- Support: [app.leather.io/help-center](https://app.leather.io/help-center)
- Source code: [github.com/leather-io/mono](https://github.com/leather-io/mono)
- Security: [leather.io/posts/security](https://leather.io/posts/security)

## Questions and answers

**Is Leather self-custodial?**

Yes. Leather does not store users' Secret Keys or passwords; keys are kept encrypted on the user's device.

**Is Leather the same as Hiro Wallet?**

Yes. Hiro Wallet was renamed Leather on 31 August 2023 when Trust Machines' subsidiary Leather Wallet LLC acquired the wallet from Hiro Systems PBC.

**Is Leather open source and audited?**

Yes. The code is MIT-licensed on GitHub, Least Authority audited it in 2021, and it runs a bug bounty, with Immunefi since August 2026.

**Which networks does Leather support?**

Bitcoin and the Stacks layer 2, including Ordinals, Runes, BRC-20 and sBTC, with Ledger support.

## Sources

- [Leather — Home](https://leather.io/)
- [Leather — Security](https://leather.io/posts/security)
- [Leather — Introducing Leather (31 August 2023)](https://leather.io/posts/introducing-leather-the-bitcoin-wallet-for-the-rest-of-us)
- [Leather — How Leather carries out secure transactions](https://leather.io/posts/how-leather-carries-out-secure-transactions)
- [Leather — Terms of service](https://leather.io/posts/terms-of-service)
- [GitHub — leather-io/mono LICENSE](https://github.com/leather-io/mono/blob/dev/LICENSE)
- [GitHub — leather-io/extension (deprecated)](https://github.com/leather-io/extension)

## More in this section

- [Sparrow Wallet](https://revain.org/wallets/sparrow/)
- [Zengo](https://revain.org/wallets/zengo/)
- [Keeper Wallet](https://revain.org/wallets/waves-wallet/)
- [Muun](https://revain.org/wallets/muun/)
- [Phoenix Wallet](https://revain.org/wallets/phoenix/)
- [UniSat Wallet](https://revain.org/wallets/unisat/)
- [All Wallets →](https://revain.org/wallets/)

## How voting works

Votes are anonymous and carry no text. Each device has one vote per item; press the same button again to remove it. Cloudflare Turnstile checks that a person is voting. We keep a random device ID in a cookie and a salted hash of the IP address to limit abuse — no names, no accounts. Votes are visitors’ opinions, not investment advice.

Page updated: 2026-10-31

---
Source: https://revain.org/wallets/leather/