A native macOS guard to defend crypto wallets from malware

Hacker News

I’m Fer, a Mac user who learned the hard way that “normal” AV doesn’t catch modern wallet-stealer families (AMOS / Poseidon / Banshee / Atomic, etc.). So I built ShieldKey: a Swift/Rust, always-local layer that covers the specific attack surface of crypto wallets on macOS. What ShieldKey does today * Process-level wallet cage via EndpointSecurity + Sandbox: blocks anything touching wallet paths (~/Library/Application Support/…, browser Local Storage, USB HID for Ledger/Trezor) unless it’s on an allow list * Network Extension blocks known phishing domains before the browser even loads them * Clipboard / window-title watcher for seed patterns (base58 / hex) * 1 800 macOS stealer hashes in a compact YARA+SHA table (mmap, ~20 µs lookup) * One-click “wallet lock”: chmod browser-wallet storage to 000 and auto-eject HW wallets * 100 % offline; UI is SwiftUI, engine is a 4 MB static Rust daemon Why bother when objective-see or commercial AV exist? - Objective-see is awesome but pops LOTS of alerts—ShieldKey ships wallet-specific heuristics so users get one actionable alert, not 200. - Commercial AVs flagged <10 % of the macOS stealer hashes we collected since Jan 2024 (VirusTotal data). They also don’t understand Ledger HID traffic or MetaMask’s plaintext vault. Architecture - shieldd (daemon): Rust, Tokio, subscribes to EndpointSecurity, FSEvents, HID, NetExt - shieldctl (CLI): sends YAML → gRPC to daemon, emits JSON for UI - ShieldKey.app: SwiftUI menu-bar wrapper - Rules pack compiled into a single kcdb file (mmap B-Tree, O(log n)) Limitations - No in-browser JS detection; if you paste a seed, JS phishing can still grab it - No rule revocation yet - whole pack must update - Only tested on Monterey through Sonoma Roadmap - Signed rule updates over Tor (opt-in) - Hardware-wallet micro-firewall (USB endpoint filter) - Transparency log for notarized releases - Public repo once code is hardened Try it / tear it apart Get DMG : https://getshieldkey.com brew tap coming this week. shieldctl --dry-run shows every ES event. Looking for feedback: missed attack surfaces, EndpointSecurity edge cases, UI nits. If you’ve got macOS stealer samples I don’t detect, send hashes (or encrypted zips) to bugs@getshieldkey.com.

Visit product View on Hacker NewsMay 28, 2025

Share card

Actual performance

1points

1comments

Did not reach leaderboard

Launch Intel predictions

Analyze your own launch →

Product HuntOn track for Day 1 leaderboard · Strong signals: mac, macos, user · Missing: agents, agent, cursor

65%65% predicted probability of success on Product Hunt, based on ML models trained on real launch data.

best fitHighest predicted score across all platforms for this description.

Indie HackersFits the IH revenue-focused audience · Missing: supports, reddit linkedin, podcasting

63%63% predicted probability of success on Indie Hackers, based on ML models trained on real launch data.

Hacker NewsMay not resonate with HN audience · Strong signals: exist, 000, io · Missing: https docs, excited, just released

50%50% predicted probability of success on Hacker News, based on ML models trained on real launch data.

nativeThis product was originally launched on this platform.

AppSumoMay struggle as an AppSumo deal · Strong signals: users · Missing: plus, platform, intuitive

38%38% predicted probability of success on AppSumo, based on ML models trained on real launch data.

TrustMRRLess likely to generate early MRR · Strong signals: users, way · Missing: mobile apps, ios, personal

33%33% predicted probability of success on TrustMRR, based on ML models trained on real launch data.

Acquire.comPre-revenue stage for this audience · Missing: arr, mrr, revenue

14%14% predicted probability of success on Acquire.com, based on ML models trained on real launch data.

BetaListMay not resonate with beta-testers · Strong signals: crypto · Missing: web3, chat, cryptocurrency

0%0% predicted probability of success on BetaList, based on ML models trained on real launch data.

Correct prediction on native model

Similar products

Image2JXL – a native macOS JPEG XL converter33%Launch Intel prediction score: how likely this product is to succeed on its source platform, based on its name, tagline, and description.

Image2JXL – a native macOS JPEG XL converter

Hacker News3

A native macOS client for Apache Kafka51%Launch Intel prediction score: how likely this product is to succeed on its source platform, based on its name, tagline, and description.

A native macOS client for Apache Kafka

Hacker News197

Brewer X, a native macOS client for Homebrew62%Launch Intel prediction score: how likely this product is to succeed on its source platform, based on its name, tagline, and description.

Brewer X, a native macOS client for Homebrew

Hacker News40

I made a native macOS Twitch client54%Launch Intel prediction score: how likely this product is to succeed on its source platform, based on its name, tagline, and description.

I made a native macOS Twitch client

Hacker News2

Droppable - a native macOS alternative to WeTransfer53%Launch Intel prediction score: how likely this product is to succeed on its source platform, based on its name, tagline, and description.

Droppable - a native macOS alternative to WeTransfer

Hacker News1

Bitbar plugin (native MacOS toolbar) for OpenFaaS functions35%Launch Intel prediction score: how likely this product is to succeed on its source platform, based on its name, tagline, and description.

Bitbar plugin (native MacOS toolbar) for OpenFaaS functions

Hacker News7

Packara – Native macOS GUI for signing, notarizing, and stapling DMGs41%Launch Intel prediction score: how likely this product is to succeed on its source platform, based on its name, tagline, and description.

Packara – Native macOS GUI for signing, notarizing, and stapling DMGs

Hacker News5

Coinbook – track your crypto holdings across exchanges and wallets31%Launch Intel prediction score: how likely this product is to succeed on its source platform, based on its name, tagline, and description.

Coinbook – track your crypto holdings across exchanges and wallets

Hacker News2

Machato — A native macOS client for ChatGPT39%Launch Intel prediction score: how likely this product is to succeed on its source platform, based on its name, tagline, and description.

Machato — A native macOS client for ChatGPT

Hacker News68

HelloAI57%Launch Intel prediction score: how likely this product is to succeed on its source platform, based on its name, tagline, and description.

Native macOS chatGPT client.

Indie Hackerscommitment-side-project

Browse all products Analyze your launch