nexus wallet new
Create a new wallet with a random keypair.
Example
nexus wallet new my-wallet
Output
→ Creating new wallet...
Name: my-wallet
Network: regtest
Secret Key: 1234567890abcdef...
Public Key: 02abcdef1234567890...
Address: bcrt1p...
✓ Wallet created!
Saved to ~/.nexus/wallets/my-wallet.json
The secret key is displayed only once. Store it securely!
nexus wallet list
List all saved wallets.
Output
→ Wallets:
my-wallet
test-wallet
production-wallet
nexus wallet balance
Get the balance for an address.
nexus wallet balance <ADDRESS>
Example
nexus wallet balance bcrt1p...
Output
→ Balance for bcrt1p...
Balance: 100000 sats
nexus wallet deposit-address
Get the vault deposit address for a wallet.
nexus wallet deposit-address <NAME> --protocol-key <HEX>
Options
| Option | Required | Description |
|---|
--protocol-key <HEX> | Yes | Protocol public key (from node info) |
Example
# First, get the protocol key
nexus query node-info
# Then derive vault address
nexus wallet deposit-address my-wallet \
--protocol-key 1234567890abcdef...
Output
→ Deriving Vault Address...
User Vault Address: bcrt1p...
The vault address is a Taproot address with two spending paths:
- Protocol Path: L1 balance always matches L2 balance (1:1 backing)
- Escape Path: User can spend after timelock (for recovery)
Wallets are stored as JSON in ~/.nexus/wallets/:
{
"name": "my-wallet",
"secret_key": "1234567890abcdef1234567890abcdef1234567890abcdef1234567890abcdef",
"public_key": "02abcdef1234567890abcdef1234567890abcdef1234567890abcdef1234567890ab",
"address": "bcrt1pabcdef1234567890abcdef1234567890abcdef1234567890abcdef12345"
}
Fields
| Field | Description |
|---|
name | Wallet identifier |
secret_key | 32-byte private key (hex) |
public_key | 33-byte compressed public key (hex) |
address | Bitcoin P2TR address |
The CLI supports multiple address formats:
| Format | Example | Description |
|---|
| Wallet name | my-wallet | Loads from ~/.nexus/wallets/ |
| P2TR address | bcrt1p... | Bitcoin Taproot address |
| Hex pubkey | 0x1234... | Raw public key bytes |
Using Addresses
# Using wallet name
nexus contract call --from my-wallet ...
# Using Bitcoin address
nexus contract call --from bcrt1p... ...
# Using hex pubkey
nexus contract call --from 0x1234... ...
Security Best Practices
Never share your secret key! Anyone with access to your secret key can spend your funds.
Recommendations
- Backup wallet files - Store copies in secure locations
- Use strong permissions -
chmod 600 ~/.nexus/wallets/*.json
- Separate wallets - Use different wallets for development and production
- Hardware wallets - For mainnet, consider hardware wallet integration
File Permissions
# Secure wallet directory
chmod 700 ~/.nexus/wallets
chmod 600 ~/.nexus/wallets/*.json
Network-Specific Addresses
Addresses are network-specific:
| Network | Prefix | Example |
|---|
| Mainnet | bc1p | bc1p... |
| Testnet | tb1p | tb1p... |
| Regtest | bcrt1p | bcrt1p... |
Wallets created with --network regtest will have bcrt1p addresses.
