We had the pleasure of meeting BitVault at the last edition of the PlanB Forum in Lugano in 2025, an event that gathered the most influential names in European Bitcoin. BitVault is a native Bitcoin open source wallet that combines multisig miniscripts with programmable time delays (2 hours-15 days), designed to protect HODLers from physical heists and digital hacks. Non-custodial, hardware-first and enterprise-ready, it positions itself as a universal security layer. Official website: bitvault.sv.
Here is an interview with Francesco Madonna, CEO of BitVault.
BitVault was born from a specific awareness: traditional wallets are no longer enough. Where does this conviction come from? Was there a specific episode that made you realise that the physical security of Bitcoin HODLers was still unresolved?
This conviction comes from a very concrete experience, not from an abstract theory. I have been in the Bitcoin world for a decade or so and in all that time I have seen it all: cheating, scams, borderline situations, ambiguous propositions and, more generally, a level of risk that has only evolved over time, becoming more sophisticated. Once upon a time, especially in the early years, one reasoned in an environment of meetups, informal gatherings, exchanges between people who were often strangers. Today there is the ETF, there is more institutionalisation, but the underlying problems have not disappeared, they have just moved up a level. In my case, the episode that really triggered something in my head dates back to 2020-2021. I was approached by individuals who presented themselves as investors, but were actually an organised gang trying to find the right target to pluck. The thing already stank from afar, because they told me that they were coming from Dubai but wanted to see me in Rome, without making any calls, without any intermediate steps, without any mutual due diligence. And so I, who was already used to sniffing out certain situations, decided to go, but with the utmost caution: I organised myself, I even paid for an armed guard to follow me with a gun, a scene almost out of a film, but unfortunately not so far removed from the reality of the sector in those years. The meeting took place in a public place, with cameras and all the necessary attention, and they introduced themselves as Swiss diamond dealers, complete with Swiss number. It sounded credible, but then one only had to look at the details to realise that something didn’t add up: rings, clothes, attitude, everything suggested it was a set-up. Eventually they got to the point: they wanted me to put about 200,000 euro in a wallet, controlled by me but indicated by them, as part of a million euro investment. They even told me that I would have to download the wallet to my iPhone, as if that was enough to make everything trustworthy. That was the first real alarm siren. And the thing that really struck me was that the wallet in question was very famous, but not fully open source. I then backed off with a classic excuse, saying that the board had not yet decided. But the doubt remained: either they really wanted to cheat me, or they wanted to take me to a legitimate wallet and then physically hit me and take my funds. There were not many other possible interpretations. It wasn’t until months later, between July and August 2023, that I discovered that I had been right to worry: a blog post came out, which was later deleted, as often happens when someone pays to make the past go away, and there it was explained that just between February and March of that year that wallet had had a serious bug and some people had lost their funds. The lesson I took from that was very simple: never trust a wallet that is not completely open source. That was the real origin of BitVault.
The time delay transaction is the turning point. Multisig with customisable delays from 2 hours to 15 days. It explains in a simple way how it works and why it is a leap from classic multisigs. What happens if someone physically forces you to sign?
To understand BitVault you have to start with a simple concept: in a bank, security is not limited to the security door or the vault, but also includes time. Gold bars, or at any rate valuable assets, are kept in timed safes, and this is not a minor detail. It is a defence principle that has worked for decades, invented in the 1940s in the United States, and which has helped to drastically reduce the number of bank and vault robberies. I wanted to take that concept and bring it on-chain, inside Bitcoin, using miniscript. Miniscript is a kind of language that is more readable, more secure and more robust than the classic Bitcoin Script, because it allows you to construct complex conditions in a predefined, compiled and verifiable way. When working with pure Bitcoin Script, any programming error can become a huge problem; with miniscript, on the other hand, many conditions are already coded, so the margin for human error is greatly reduced. BitVault uses this logic to build what I call a timed safe: you have two keys in the user’s hand and a third key tied to the convenient service. The user sets a time delay that can range from a minimum of two hours to a maximum of 15 days, and that time becomes an irreversible safe. Once decided, it cannot be changed at will, and above all cannot be bypassed. This means that if a person is physically threatened and forced to sign a transaction, the signature may be executed, but the funds do not leave immediately: they remain blocked until the time delay expires. During that time, the user can activate a secret notification on Telegram to trusted persons, so as to warn them in case of coercion or kidnapping, and in the meantime the attacker also sees on the device that the money is not available immediately. This is crucial, because the system must also become obvious to the attacker: Kerckhoffs’ principle says that security should not be based on the secrecy of the mechanism, but on its public robustness. The visible countdown on the iPhone, in the first BitVault product, serves precisely this purpose: the attacker must not trust the victim’s word, he must see for himself that the system blocks the transaction. At that point, the most likely outcome is that he is satisfied with the decoy wallet, which is a useful distraction strategy precisely to save time and lives. The upshot is that BitVault not only promises non-custodial, but introduces real physical and technical deterrence together. And in Bitcoin this is crucial, because telling a user that his asset is safe while in reality he can lose everything in an instant, by hack or by coercion, is a contradiction the ecosystem can no longer afford
BitVault is positioned as an additional layer compatible with hardware wallets like Jade Plus and Keystore, not as a replacement. What is the philosophy behind this choice? Are you aiming to become a universal security layer on top of any air-gapped wallet?
Absolutely, but very cautiously. In the first release BitVault cannot and should not rely on the phone’s mobile keys as if they were enough on their own, because on large amounts I would never trust a private key generated and stored on a smartphone. Even with the best protections, such as lockdown mode, the mobile phone is still a much more fragile environment than a hardware wallet with a display and visual confirmation of the destination address. This is why the iPhone app, in our first implementation, is not the keeper of the funds but the coordinator of the system: it connects to the hardware wallets, organises the flow and lets the actual signing take place there. We chose Jade Plus and Keystore because they are open source, Bitcoin only, air-gapped via QR and with direct verification on the display. They are the two most solid options for those who want a really serious setup. Jade we do not recommend the old version, while Jade Plus has a much better room. The logic is simple: BitVault is not meant to replace existing security, but to sit on top of it, as an additional layer that makes the case more resistant to coercion, mistakes and physical pressure. And the beauty is that this architecture can become universal, because our SDK in Rust is designed to integrate easily into different contexts, from wallets to B2B services.
Your enterprise tier includes self-hosted HSMs, API access and white label options. Who is the ideal institutional client for BitVault today? Are you already working with companies, family offices or funds that manage Bitcoin in treasury?
Yes, and that’s the point: when funds become important, security also has to rise. The ideal client for us is a family office, a financial advisor, a para-banking structure or in any case an entity that already manages Bitcoin professionally and needs to offer it to clients with a higher level of protection. For them, the simple Umbrel is not enough, because they need something more robust, like an HSM, AWS Nitro or other secure enclaves, depending on the size of the operation. In fact, we are already talking to Swiss family offices, even with operations in Italy, and the interesting thing is that they immediately understood the value of the proposal. Their incentive is clear: if I can offer a security service instead of just recommending an ETF, I can also monetise it, create a fee, build a stronger relationship with the client. And this, paradoxically, aligns the incentives of the traditional world with those of the self-custodian. Instead of incentivising centralised custody, we push them to promote personal custody but in a professional way. This is the first time I’ve seen a technology that makes it convenient for an intermediary to actually work for Bitcoin and not against its original logic.
The choice of the .sv domain is an homage to El Salvador. How much did this symbolic geography influence the project and how do you see the relationship with the Bitcoin ecosystem revolving around the country of Bukele?
The .sv domain is a homage, first of all. To Bukele, to the community and to a country that has done more for the adoption of Bitcoin in a few years than many others. El Salvador and Lugano, for me, are two beacons: one in America and one in Europe. They are two places that have given a strong, very concrete message that Bitcoin is not just theory, but can also be real infrastructure, economic policy, culture. Our motto, ‘beyond keys protect humans’, takes shape there too, because in certain contexts the problem of physical security is not theoretical, it is real. And if a solution like BitVault can help a person better guard their funds in a more sensitive environment, then the connection with El Salvador is not just symbolic, it is consistent with the mission. We have no other structural ties with the country, but the call is important: it is a way of saying that security is not an accessory of Bitcoin, it is part of its adoption.
Francesco Madonna has not simply designed a wallet, but has tried to rewrite the relationship between security, fear and ownership in the world of Bitcoin, taking self-custody to a level where deterrence is no longer just digital but also psychological and physical. If the market really understands the scope of this insight, BitVault could become one of those products that don’t just solve a problem: they change the very way the problem is perceived. And at that point, for those who try to attack a holder, the bill will no longer be just economic, but also strategic.
