Multi-Chain Crypto Vault • LP & DeFi Portfolio Manager
Formerly Key Manager — now ColdStack
A portable, self-contained Windows application that does what no browser extension, no cloud service, and no third-party platform will let you do: own your keys, watch your vaults, read your LP positions across 12+ chains, and write back to Hyperliquid — all from one encrypted offline-by-default vault. Built by Kris Racette with the same military-grade encryption standards trusted by exchanges and governments.
No installation • No Python • No telemetry • Offline by default
Vault Initialisation — Create your master password
Account Management — Organise by investor or wallet
BIP39 Derivation Engine — Derive addresses from mnemonics
Address Management — Multi-chain support
Private Key Vault — Encrypted, masked by default
Portfolio View — Full vault overview
ColdStack (formerly Key Manager) is a secure, portable Windows application developed by Kris Racette and released under the Executive Mind banner. It started as a hardened crypto key vault — wallet addresses, 24-word mnemonics, private keys, all encrypted with AES-256-GCM authenticated encryption and Argon2id key derivation. It has since grown into something larger: a multi-chain DeFi portfolio manager that combines encrypted key storage with on-chain read and write operations across Hyperliquid, HyperEVM, and 12+ chains via the Krystal aggregator.
No installation required. No Python dependencies. Just copy the self-contained coldstack.exe to a USB drive or any folder and run it. Your encrypted vault is co-located in the same directory, so it travels with you. Everything stays local — no telemetry, no background polling, no data ever leaves your computer without your explicit action. The Go Online toggle is OFF by default and only enables read-only balance and price fetches; the embedded Hyperliquid writer is opt-in per operation with a confirmation dialog. This is the security-first philosophy that defines every Executive Mind product.
The current release tracks every meaningful position across the chains you actually use: native and ERC-20 balances across 15+ chains (Ethereum, Arbitrum, Base, BSC, Polygon, Optimism, HyperEVM, BTC, SOL, SUI, DASH), Hyperliquid L1 vault positions (TVL, APR, deposit age, unrealized P&L), LP positions across HyperEVM and 12 chains via the Krystal aggregator (with live uncollected fees read directly from the Project X PositionManager), and a read-write Hyperliquid adapter that wraps and unwraps HYPE, opens and closes LP positions, and compounds fees — all signed through the embedded key-manager agent on localhost:8842 so private keys never leave the encrypted vault.
Your master password is never stored. It exists only in memory during your active session. Auto-lock clears sensitive data, and every write operation — collect fees, open LP, close LP, compound — requires explicit GUI confirmation. Writer signs via an internal headless agent, never holds private keys directly.
The encrypted vault lives next to coldstack.exe in the same folder. Put both on a USB drive, and your encrypted data — keys, mnemonics, saved vaults, saved pools, custom RPC endpoints — goes wherever you go. No registry entries. No system dependencies. No ~/.key_manager/ hidden directories.
Encrypted storage, on-chain reads, and on-chain writes — all from one offline-by-default vault. Every release ships new capabilities; the page below mirrors the latest build.
Military-grade authenticated encryption. Your data is protected with the same standard used by governments and financial institutions worldwide. Every vault file is tamper-evident — any modification invalidates the authentication tag.
Winner of the Password Hashing Competition. 64MB memory, 3 iterations, 4 lanes — resistant to GPU/ASIC brute-force and side-channel attacks. Your password becomes an encryption key in ~1 second: fast enough for you, too slow for attackers.
5-minute inactivity timeout automatically locks the vault. A "Do not autolock" checkbox in the status bar keeps you in for long sessions. Show/hide password eye toggle on the login screen. Reveal-sensitive-data operations require password re-entry every time.
Self-contained ~45MB coldstack.exe. No installation. No Python runtime needed. Copy to a USB drive and your vault — keys, saved pools, saved vaults, custom RPC config — goes where you go. Works on any Windows 10/11 machine.
Bulk-import addresses from CSV or Excel files. Supports 20+ predefined chains plus custom labels. Format guide built into the app. Review the import summary before committing — addresses added, skipped, errors.
Mnemonics and private keys are hidden by default. Reveal on demand with password re-entry. Auto-hide after 5 minutes of inactivity. The vault never displays a sensitive value unless you explicitly ask for it.
Derive addresses and private keys directly from 24-word mnemonics. Supports EVM, BTC (Taproot / SegWit / Legacy), SOL, DASH, and SUI with standard HD wallet paths (BIP-32 / BIP-44). No browser, no external tool — derivation happens locally inside the encrypted vault. Verified against Ian Coleman's BIP39 reference test vectors.
Private keys are derived per-chain from your mnemonic, not stored as static entries. View individual chain keys or the master key. Each key is encrypted at rest, masked by default, and tagged with its derivation path and source.
An embedded HTTP signing server (port 8842, localhost-only) lets AI agents and scripts sign transactions without ever holding your private keys. Sends sign_tx or broadcast_tx, gets back signed hex. Binds to 127.0.0.1 — no external network access. The exact same agent powers the Hyperliquid writer inside the GUI.
Offline by default. When you enable it, ColdStack fetches wallet balances via public RPC endpoints and live crypto prices via CoinGecko. Your keys never leave the vault. Online/Offline indicator in the status bar makes the state visible at all times.
Check balances inline on each address card. Supports 15+ chains: EVM (ETH, ARB, BASE, BSC, POLY, OPT), BTC, SOL, SUI, DASH, ZEC, XRP, ADA, ATOM, SCRT, RUNE, and HyperEVM (HYPE). Per-card Check Balance button — offline-aware, no background polling.
Fetches ERC-20 token balances on HyperEVM (chain ID 999) — USDC, WHYPE, and UBTC confirmed via Circle developer docs and on-chain resolution. The combined "Hyperliquid (HL1 & HyperEVM)" chain option queries HyperEVM gas + ERC-20 + Hyperliquid L1 spot in a single pass.
Live crypto prices via CoinGecko's free API. 60-second in-memory cache. No API key required. Choose USD, AUD, CAD, EUR, or CHF as your default currency. Fiat equivalent shown alongside native balance. Stablecoin → fiat conversion uses live CoinGecko USDC price, not a 1:1 USD assumption.
Standard / Advanced mode toggle. Standard users get the locked-down defaults; Advanced users get a full RPC endpoint editor across 17 chains with per-chain fallback URLs. rpc_endpoints.json lives next to the EXE for portability — public URLs only, never API keys.
Helius, Infura, Alchemy, Quicknode keys stored encrypted inside the vault — never written to rpc_endpoints.json. The JSON file holds public URLs with "auth": "helius" references; the gateway injects the key at runtime from the vault. Cleared on lock.
Read-only Hyperliquid vault positions via the /info API. Each vault card shows name, address, TVL, APR, vault age, deposit age, deposited, current value, and unrealized P&L. Save / Delete buttons persist full snapshots inside the encrypted vault — saved vaults render instantly on reopen without a network refresh.
Aggregates concentrated-liquidity LP positions from HyperEVM (Project X WHYPE/UBTC pools) and Hyperliquid L1. Each card shows pair, range, value, PnL, token holdings, and a strategy suggestion (Hold / Rebalance / Withdraw). Uncollected fees are read via a static collect() eth_call on the Project X PositionManager — values match the Project X UI tooltip within expected drift. Spot positions and closed LP positions (liquidity = 0) are filtered out automatically.
The Krystal Cloud adapter reads LP positions across 12 chains and 28 DEX protocols — Ethereum, Arbitrum, Optimism, Base, Polygon, BNB, Avalanche, and more. Runs in parallel with the native HyperEVM scan; results are merged and deduplicated. HyperEVM (chain 999) is intentionally excluded from the Krystal path so the native adapter keeps accurate fee reads. API key stored encrypted inside the vault.
Wrap / unwrap HYPE, approve tokens, open, increase, decrease, collect, and close LP positions on HyperEVM. Every write operation requires an explicit GUI confirmation dialog. The writer signs through the embedded key-manager agent on localhost:8842 — it is a tool, not an autonomous agent. No bots. No auto-rebalancing. The strategy engine suggests; you decide.
Collect uncollected fees from any Project X HyperEVM position with one click — tested and confirmed working end-to-end on mainnet. Compound Fees snapshots balances, batches the multi-transaction flow, and tracks nonces correctly across receipts. Each operation is signed through the headless agent and confirmed in the GUI before broadcast.
Save interesting LP positions and Hyperliquid vaults to your encrypted vault. They render instantly on next open — no waiting for a full wallet rescan. Public identifiers only, no private keys, stored alongside your other encrypted data. Saved-pools counter updates in real time as you add or remove.
User-initiated update check via a single GitHub API call. Offline by default — only fires when you click the button. Runs in a background thread so the GUI stays responsive. No auto-updates, no background polling, no telemetry. The page you're reading always points to releases/latest — whatever is shipping now is what's on the page.
Redesigned address cards showing coin + chain + derivation on one line, with balances appearing only when fetched. Notes only when present. EVM chain progress display updates in real time as each chain is queried. Designed for high-density portfolio views without sacrificing readability.
Every online feature respects the Go Online toggle. LP tab and HL1 Vaults tab disable refresh and show an offline banner when networking is off. Balance fetches and price feeds only fire when explicitly enabled. The writer is unreachable when the vault is locked.
Every new field is additive. Old vaults open in the latest build without migration. New vaults get the current schema version. Backward compatibility is the rule — your data is never invalidated by an upgrade.
Organized by account and chain. 20+ predefined chains including BTC, EVM, SOL, ZEC, XMR, and more. Plus any custom chain you want to track.
Store recovery phrases encrypted. Derive addresses and keys directly from them using the BIP39 engine. Hidden by default. Reveal only when needed with password confirmation.
Multiple chain-specific keys per account. Labeled and organized. Protected with the same encryption as everything else. Derivation metadata stored alongside.
AES-256-GCM authenticated encryption ensures both confidentiality and integrity. Every vault file is tamper-evident — any modification invalidates the authentication tag.
Argon2id with 64MB memory cost, 3 iterations, and 4 parallel lanes. Resistant to GPU cracking, ASIC attacks, and side-channel timing analysis. Your password is transformed into an encryption key through a process that takes ~1 second — fast enough for you, too slow for attackers.
No password is ever written to disk. It exists only in volatile memory during your session. Auto-lock after 5 minutes of inactivity clears all sensitive data. Reveal-sensitive-data operations require password re-entry every time. The headless signing agent binds to 127.0.0.1 only — no external network access to the signing service.
Offline by default. The only network request is the user-initiated Check for Updates feature, which queries the GitHub releases API only when you click the button. No background polling. No analytics. No auto-updates. Your data never leaves your computer. BIP39 derivation also runs entirely locally — no external libraries call out to the network.
Go Online is OFF by default — zero network requests unless you explicitly enable it. Only public addresses are queried — private keys and mnemonics NEVER leave the vault. Prices cached in-memory only (60s TTL), never written to disk. Online mode and currency settings stored in the encrypted vault alongside your other data.
The Hyperliquid writer never holds private keys. All signing goes through the embedded key-manager agent on localhost:8842. Every write operation — wrap, approve, open, increase, decrease, collect, close, rebalance — requires an explicit GUI confirmation dialog. No auto-trading, no bots, no autonomous rebalancing. The strategy engine suggests; you decide.
Plus live reads for: Hyperliquid L1 (perpetuals, spot, vault positions) and HyperEVM (chain ID 999 — gas, ERC-20 tokens USDC/WHYPE/UBTC, and concentrated-liquidity LP positions). LP position aggregation also covers 12 chains and 28 DEX protocols through the optional Krystal Cloud adapter.
Freeware. Open source. No installation. Always the latest release on GitHub — download, run, own your keys.
Download Latest Release →Built by Kris Racette • Released as freeware • Source available on GitHub
Kris Racette (also known as Kristopher Racette and Kristopher Marc Racette) is the Founder of Executive Mind and the creator of ColdStack (formerly Key Manager). With 18+ years of accounting experience and a Master of Commerce from the University of New South Wales, Kris brings a unique perspective to security tooling — one that bridges financial rigor with technical implementation.
ColdStack was built to solve a real problem: securely storing cryptocurrency wallet information without relying on cloud services, browser extensions, or third-party apps that could be compromised — and then extended into a multi-chain DeFi portfolio manager that reads on-chain state and writes back to Hyperliquid without ever surrendering custody of the keys. Every design decision prioritizes security, portability, and user control.
The source code is available for audit and contribution on GitHub. Executive Mind believes in open-source security — when the code is public, the security claims are verifiable. The same vault powers Executive Mind's own agentic signing infrastructure: AI agents request signed transactions through the headless agent on localhost:8842, never touching the keys themselves.