Working at SEAL (https://www.securityalliance.org/) and with SEAL911 I keep seeing the same pattern: One of the most common incident is private key theft, almost always from desktop wallets. Malware goes after browser extensions because your keys sit decrypted in memory.

So I built Lodgelock. It’s a small companion app for MetaMask that keeps keys off the desktop: - MetaMask works as usual but, when it’s time to sign, the request is proxied to your phone. - Keys live on your phone behind biometrics. - The signed payload is sent back to your wallet for deployment.

It adds ~30 seconds compared to a hot wallet, but the keys never touch the desktop.

Some choices I made: - No MPC or proprietary recovery methods, just a standard seed phrase. - Open source, GPL-3.0. - I'm planning to get audited and apply for a MetaMask Grant before calling Lodgelock production-ready.

This isn't a hardware wallet replacement. If you already use a Ledger every time, keep doing that. Lodgelock is for people like me who _should_ use hardware wallets but default to hot wallets because convenience wins.

If you think this would help you, sign up for the email notifications on the website (https://lodgelock.org/#email-signup) or check out the repo (https://github.com/Robert-MacWha/lodgelock-snap).