Your own node
The wallet talks to your node and no one else's — no third party ever sees your wallet exists.
In development · Rust-native · Open source
A Monero wallet built to disappear.
The ermine turns white in winter — not to hide that it exists, but to be indistinguishable from the snow. That's how your money should move.
0third-party serversyour node, your rules
0telemetry or trackerswe can't see you either
1Tor circuit per accountno shared path to the node
100%open sourceRust, end to end
Why another wallet?
Monero's cryptography is world-class. The wallets around it still leak — and the fixes are folklore only experts perform by hand. Ermine's thesis: make every one of those behaviors automatic, default, and provable.
Someone else's node
Most wallets default to a remote node — it sees your IP and can tie it to your transactions.
Your own node ships with the wallet. Nobody else ever serves your history.
Tor as an expert toggle
Network privacy is optional and usually off — your IP walks with your coins.
Tor is the default, and every account gets its own circuit — the node never learns your address or that two accounts are yours.
Churn is folklore
Experts churn their coins by hand. Everyone else's history just sits there.
Churn is built in and automated — randomized timing, no ritual required.
Nothing to say under duress
If someone forces your wallet open, most wallets show them everything you own.
A duress unlock opens a believable decoy — or destroys the real wallet. Your choice, made in advance.
"Trust me" privacy
Wallets claim privacy in prose. You can't verify a promise.
Every privacy invariant is a machine-checked test, run in the open on every change.
Decades of C++ underneath
Nearly every major wallet sits on the same legacy memory-unsafe core.
Rust end to end — memory-safe from key handling to interface.
Built to vanish. Built to prove it.
Five privacy pillars, one discipline: nothing ships on trust alone.
Tor isolation per account
Each account gets its own Tor circuit, so the node can't tie your identities together by connection.
Automated churn
Your history quietly sheds its past on a randomized schedule — the molt, automated.
Plausible deniability
A wallet that can honestly show nothing — decoy and duress wallets by design, not as an afterthought.
Proven, not promised
Every privacy invariant is enforced by a machine-checked assurance harness, built in the open.
Rust, end to end
Memory-safe from key handling to interface — one core for Linux, Windows, macOS, Android and iOS.
Where the build stands
We build in the open, one proven slice at a time.
Now
- Architecture locked: Rust end to end, specs written in the open
- Phase 0: the full wallet loop on Monero stagenet — create, scan, sign, broadcast, restore
Next
- Your own node, bundled and supervised
- Per-account Tor stream isolation
- Automated churn with randomized timing
Later
- Plausible deniability: decoy & duress wallets
- Change-privacy controls
- Public assurance dashboard: every invariant, machine-checked
Support development
Ermine is unfunded, unsponsored, and will never sell your data — it can't see any. If you want this wallet to exist, the only fuel it takes is Monero.
446UKXAjf9PPHCaoiCz1cTCP5bcohbKTQS3c78CXPDVUWtXNuFy2b1UCkRgdAJL7MRbyD4t2eLFP9SgUqfqCu9oZ1tbzsiE
Scan with any Monero wallet
We build in the open.
No release yet. No downloads, no promises sold — just a wallet earning its claims one proven invariant at a time. Follow along.