What exactly happens during a swap that never asks for a private key signature

07 September 2026

The swap builds and broadcasts a transaction on the blockchain, but the private key never leaves the hardware device. The device signs the transaction locally, and the signed transaction is then sent to the network by the exchanger's software.

Here is the step-by-step sequence, stripped of any magic.

Step one: The watch-only wallet constructs the raw transaction. You use a watch-only wallet - a wallet that can see your balances and addresses but holds no keys. This wallet queries the blockchain for your unspent outputs and builds a transaction that sends those outputs to the exchanger's deposit address. The transaction is incomplete: it lacks a digital signature.

Step two: The raw transaction is transferred to the hardware device. The watch-only wallet sends the unsigned transaction data to the hardware device over USB, Bluetooth, or a QR code. The hardware device receives only the data needed to sign: the inputs, outputs, amounts, and a hash of the transaction. It does not receive your seed phrase, your private keys, or any other sensitive material.

Step three: The hardware device signs locally. The device prompts you to confirm the transaction details on its screen. You verify the destination address and the amount. If you approve, the device uses its private key (stored in secure hardware) to compute a signature. The signature is a cryptographic proof that the transaction is authorized. The private key never leaves the device.

Step four: The signed transaction returns to the watch-only wallet. The hardware device sends the signature back to the watch-only wallet. The wallet inserts the signature into the raw transaction, completing it. The transaction is now valid and can be broadcast.

Step five: The watch-only wallet sends the signed transaction to the exchanger. The watch-only wallet transmits the fully signed transaction to the exchanger's API. The exchanger does not need your private key, your seed phrase, or any access to your hardware device. It receives only the signed transaction bytes.

Step six: The exchanger broadcasts and swaps. The exchanger sends the signed transaction to the blockchain network. Once the transaction has enough confirmations, the exchanger sends the swapped asset to your destination address. That destination address is one you control, and you can access it with the same hardware device or a different one.

What the exchanger never sees: - Your private key. - Your seed phrase. - Any derivation path or master key material. - The fact that a hardware device was involved at all. The signed transaction looks identical to one signed by a software wallet.

What you must still do: - Connect the hardware device to some computer or phone to sign. That device can be offline, but the watch-only wallet needs to send the raw transaction to it. - Verify the destination address on the hardware device's screen. A compromised computer could show you one address in the wallet but send a different address to the device. The screen is your only trust point. - Keep the hardware device firmware updated. Vulnerabilities have been found in older firmware that could leak keys.

Why this matters for the set you are reading: This entire process is explained in more detail in the hub page, "Swapping from a hardware wallet without exposing the seed." The hub covers the broader context: why you would do this, what risks remain, and how to set up the watch-only wallet. The key point is that the hardware device never exposes its seed. The swap is executed without the seed ever leaving the device's secure element.

What can go wrong: - The watch-only wallet could be malicious and build a transaction that sends your funds to a wrong address. You catch this at step three by verifying the destination on the hardware screen. - The exchanger could fail to send the swapped asset after your transaction confirms. That is a counterparty risk, not a key-exposure risk. - A power failure or disconnection during signing could leave the transaction unsigned. You simply rebuild the raw transaction and try again.

The swap works because the hardware device signs only what you approve. The exchanger never asks for a signature because it never sees the keys. The signature is created locally, on your device, and only the final signed transaction leaves your control.

Back to on-chain data