BEARER
Zara's college fund
For your child
Start her college fund the day she's born.
Add Bitcoin on every birthday, from any wallet, grandma's too. While it's sealed, anyone can check nothing has been taken out. When she's ready, hand her the vault.
NEAR Chain SignaturesNative BTC, ETH on Base and SOL
Send Bitcoin like a gift. Pass the vault, not the coins.
Put real Bitcoin in a sealed vault and hand it to someone, as a link or to their account. Nothing moves on Bitcoin, and they can check that nobody signed a withdrawal before it reached them. Only they can open it.
Under the hood: a NEAR NFT that controls native Bitcoin, Base and Solana addresses through NEAR Chain Signatures. No bridge, no custodian key; a locked, open-source contract.
One vault, three native addresses, derived by NEAR Chain Signatures.
- Bitcoin testnet4
- Base Sepolia
- Solana devnet
01 · seal
Fill it from any wallet. It stays sealed.
Every vault comes with its own Bitcoin, Base and Solana addresses. Send coins from anywhere. While the seal is intact, nobody can even ask for a withdrawal signature.
- Native BTC, ETH on Base and SOL. Nothing wrapped.
- Balances observed, each with its source and time.
- 0 signatures ever requested, enforced by the contract.
BEARER
Theo's birthday
No. 0042
- +0.00041 tBTC
Bitcoin
tb1q 8v4z wq7m … 9pdl
- +0.0042 ETH
Base
0x71C7 656E … 9A2f
- +0.032 SOL
Solana
7xKX tg2C … gAsU
Unopened · 0 signatures ever requested
02 · transfer
Hand it over in one NEAR transaction. Nothing moves on Bitcoin, Base or Solana.
Send a sealed vault to any NEAR account. The new holder gets control of all three addresses and everything at them. The coins stay exactly where they are.
- Ownership changes on NEAR. The addresses stay the same.
- The custody log on the back gains a line for every holder.
- The sender can't withdraw or take it back.
A
alice.testnet
Sender
B
bob.testnet
Recipient
BEARER
Theo's birthday
No. 0042
At mainnet prices
$58.40 est.
Back of the vault · custody
- Pay to alice.testnetcreated the vault
- Pay to bob.testnettransferred · still sealed
Transferred to bob.testnet. Nothing moved on Bitcoin, Base or Solana.
03 · reject
The old owner can't get back in. The contract says no.
Once alice.testnet hands the vault to bob.testnet, every attempt from alice.testnet is refused, on every chain. There's no signature to have kept: none was ever requested.
- ERR_NOT_OWNER for withdrawing and for breaking the seal.
- Each refusal is a sandbox test in the repository.
- No admin key, no upgrade path, no override.
alice.testnet
former owner
No. 0042
owner bob.testnet
example · refused on testnet too, in the attack lab
$ alice.testnet → withdraw_btc(vault 42)
✓ rejected: ERR_NOT_OWNER
You no longer hold this vault. Only bob.testnet can withdraw from it.
test: alice_cannot_withdraw_after_transfer (T1)
$ alice.testnet → break_seal(vault 42)
✓ rejected: ERR_NOT_OWNER
test: alice_cannot_break_seal_after_transfer (T1)
$ alice.testnet → sign(any payload)
✓ rejected: MethodNotFound
test: no_privileged_methods (T11)
04 · open
Break the seal to withdraw. It can't be undone.
Only the current holder can break the seal. It goes in the same NEAR transaction as their first withdrawal, then NEAR's MPC network signs a transaction the contract built itself.
- Press and hold. Letting go early does nothing.
- Withdraw now or later, as often as you like.
- An opened vault can never change hands again.
Try it · nothing is sent
No. 0042Press and hold the seal to break it
On a real vault this goes in the same NEAR transaction as the first withdrawal, after a screen that says exactly what can't be undone.
05 · verify
Check before you accept. Anyone can. No wallet needed.
Every vault has a public page that answers who can withdraw, what's inside and what you're trusting, with evidence you can check yourself.
- Seal state and signatures ever requested, from the contract.
- Code hash matches a build anyone can reproduce.
- Balances observed, each with its source and time.
Can someone who held it before take what's inside?
Checked nowNo. No withdrawal can have been signed for it, and only its holder can break the seal.
Held now by bob.testnet.
Unopened
No signature has ever been requested for this vault.
You're trusting
Beyond these checks: NEAR's MPC network, where a threshold of operators must agree, and the NEAR testnet RPCs this page reads. Live checks read the chain now; rules are the locked contract's code, covered by tests; balances are observed from public data.
Who can withdraw?
Can Can't
Before the transfer
alice.testnet
owner
Canbreaks the seal first
bob.testnet
not yet
Can'tdoesn't hold it
After the transfer
alice.testnet
former owner
Can'tERR_NOT_OWNER
bob.testnet
owner
Canbreaks the seal first
a kept signature
alice's
Can'tnone exists · 0 ever requested
Each bar is a rule the contract enforces, with a sandbox test. No numbers here are measured.
Uses
Anything you'd put in an envelope. And hand to someone.
Attack lab
Try to cheat. The contract refuses.
A former owner withdrawing, an opened vault changing hands, a withdrawal from a sealed vault, a raw signature request: each was sent to the locked contract as a real transaction, and each was refused. Check them yourself; your browser reads the answers from NEAR.
See every attack and its testAttack lab
Sent to bearer.testnet as real transactions on 9 Nov. Check one: your browser reads the contract's answer from NEAR.
Former owner tries to withdraw
withdraw_evm(vault 1) · expects ERR_NOT_OWNER
Former owner tries to break the seal
break_seal(vault 4) · expects ERR_NOT_OWNER
Transfer an opened vault
nft_transfer(vault 1, opened) · expects ERR_VAULT_OPENED
Withdraw without breaking the seal
withdraw_evm(vault 4, sealed) · expects ERR_VAULT_SEALED
Ask the contract to sign arbitrary bytes
sign(32 bytes) · expects MethodNotFound
Results appear here.
Real transactions, read from an archival node
What you're trusting
No bridge. No custodian key. Here's what's left.
NEAR's MPC network
A threshold of independent operators must agree before any signature exists. Only the Bearer contract can ask for one, and only for a vault's current owner after the seal is broken.
The Bearer contract
Open source and locked: no full-access keys and no upgrade method, so nobody can change its rules. Its code hash matches a build you can reproduce.
Public chain data
Balances come from public explorers and RPCs, labelled with source and time. The contract never relies on them.
Testnet prototype, not audited. Once opened, a vault can't change hands, and Bearer doesn't escrow payments between people.
Read the full trust model