WalletScrutiny

Know your wallet like you made it!

Our goal is to improve the security of Bitcoin wallets by examining products for transparency and potential attacks.

Public Key

npub1j9kttlc86w63emmldd4h74rekyqpksqup6p9trhp5gjsf374qlyszvuswx

NIP-05 Address

_@WalletScrutiny.com

NIP-57 Address

walletscrutiny@btcpay.nz

Profile Code

nprofile1qqsfzm94lura8dguaalkk6ml23umzqqmgqwqaqj43ms6yfgycl2s0jgpz4mhxue69uhkummnw3ezummcw3ezuer9wchsz8nhwden5te0dehhxarj94c82c3wwajkcmr0wfjx2u3wdejhgtc0n0u5e

Publishing to

nostr.oxtr.dev

nostr-pub.wellorder.net

Author Public Key

npub1j9kttlc86w63emmldd4h74rekyqpksqup6p9trhp5gjsf374qlyszvuswx

Show more details

Last Notes

2024-09-19 19:33:36

We have long been working on testing desktop wallets but it's really tricky as there is just so many binaries floating around for what claims to be the same product. Even Bitcoin Core is showing 8 download options depending on your operating system or distribution channel preference:
https://image.nostr.build/092675397042174186e3e764292629b3adb749ec409656972a229800b81f35ca.png
With snapcraft obviously being tricky:
https://image.nostr.build/772aa649432c3d57171f65eecabc4c87f0d031fa8edbf359c7a68c8df7e5ddb8.png
Either way, for desktop wallets, most of the time people have download links and want to verify those downloads, so Chris is working on a binary checker. It's still only a draft merge request and clearly needs a design but what it will enable is actually pretty cool:
https://a.nostr.build/DMmxAOaKtPYpb3M7.webm
WalletScrutiny calculates the hash of the file dropped onto it and if it's an apk, it also determines the appId which allows finding the right product. If the hash is known, the verdict is immediately displayed. If not, the page invites the user to upload the file for analysis.
The attestations for artifacts will live on nostr as signed events and nostr will also be used to advertise the existance of new binaries for reviewers.

2024-07-03 02:25:31

Some fan art ✨ 🎶 🎶
Which one do you like best?
https://audio.nostr.build/79aad81cea8141b3fe4ec5d08319735be46420e04f45910453cf3a035ea706e4.mp3
https://audio.nostr.build/1392672adb8cb2f5752cc3241c2d38811ace25b8f5e498801a54918db243a235.mp3
https://audio.nostr.build/569718137b9d20b8c91cbc086179e7b7aab39d6c5e824294fe7324aa092584c2.mp3
https://audio.nostr.build/ec043e98cc163270ca4a66c3b3c46fe5da0695e7cb3a814e76678724a4d49e51.mp3
https://audio.nostr.build/d76cf4c1a3f59f5645a92c1a5126220468939f6ec3001ea9704718d056981541.mp3
https://audio.nostr.build/c09400bb09c8f4b894b88ff078ce28a0c15578c30b508a552f5b3c08dc4a9d41.mp3
https://audio.nostr.build/640d0512152b5edea6458e9196c108ebf32a864694ece156a1c85d36042dfb49.mp3
https://audio.nostr.build/42ddfde0e3ba5bd055d98f79fce2c7de757a4c774cddde5da1d91caf6c72e945.mp3

2024-04-09 20:59:56

- reply

Well, not on nostr. At least that's Fiatjaf's marketing. Did he merge the shadowban nips?

2024-04-09 20:05:17

- reply

Apparently the Coinkite account is not so talkative ...
Pinging @npub1az9…m8y8

2024-04-09 19:23:06

Hi @npub1wu4…3vw0
We were asked to attest to the reproducibility of your Q1 wallet and while the shop looks like it's maybe not released, we think it's just out of stock? May we ask for a release date?
https://github.com/Coldcard/firmware/blob/master/stm32/repro-build.sh appears to not support compiling the firmware for the Q1, right? We found for example 2024-04-02T1416-v1.1.0Q-q1-coldcard.dfu at https://coldcard.com/downloads/ yet the script appears to assume the download always to contain "mk".
Where can we find the documentation to reproducibly build the Q1 firmware?

2024-03-25 18:05:56

Has anybody noticed that we now have "screen recordings" in our reproducibility tests? As another project is sharing "video proof" of reproducibility, we were asked to also do so but it felt kind of pointless to produce GBs of data for every reproducibility test. We did however start playing around with console recordings that are somewhat more optimized as they record the ASCII on the screen and not every pixel. Resulting files are much more manageable but for example, running the compile script for the Electrum for Android app resulted in 72MB of output. As we test a lot, this is a lot to add in a single day.
Does anybody care about screen recordings? Can we throw them at some nostr relay instead of our git repo, with some expiry date in three months, so that interested users can grab it while it's hot? Any other ideas?
Currently the tiniest ascii cast is the one for the Schildbach "Bitcoin Wallet": https://walletscrutiny.com/android/de.schildbach.wallet/

2024-02-08 16:52:17

It can be really frustrating to hunt after fake apps when not even the provider of the original seams to care ...
Here is our attempt at reporting a fraud at https://capital.com
https://image.nostr.build/a7daca6bd8eb4d4135b8a7b448ea0e941f788bec36951bece1262e2bc6c5c5bc.png
https://image.nostr.build/8412f75108b34a0214ebdc4d82d26e1f1668418e0ed77efff6e2a15a86bbc1ab.png
https://image.nostr.build/1509713b5cfd8c1372cded8c8461792d0752a24433f9cd15feaea89eb92beca9.png
https://image.nostr.build/3e4d4c4ccc09aeb79133534258617ea5acc77f0150e3d4287a839c9516e42d06.png
#nevent1q…xg72

2024-02-07 18:08:45

Does anybody know how
https://walletscrutiny.com/android/com.kapital.trade.crypto
relates to
https://walletscrutiny.com/android/com.capital.trading
The former has 500k users but looks like a fake app given the "typo" in the app ID and given that capitalCom links to the latter, only.

2023-10-15 00:36:47

- reply

We don't list web wallets so far. Mutiny appears to work for Android but is not on Google Play yet. https://play.google.com/store/search?q=mutiny%20wallet&c=apps
We analyze binaries that we pull from Google Play or the App Store.

2023-10-12 21:47:55

https://cdn.discordapp.com/attachments/1123708113980227747/1159839471794139257/image.png?ex=65327bae&is=652006ae&hm=55e8edc5a4ae9bba385f0ed8b48ac66c8f6314ca4790a8a7316bbebdbdec687f&
Join our Space! We will talk about Bitcoin Wallet security!
https://twitter.com/i/spaces/1ypJdkRQVZdGW?s=20

2023-10-08 15:41:20

Among the reproducible Android wallets, Zeus appears to be the first to have switched to Android App Bundles. We tested what we got from Google - the arm64-v8a version and found all bytes accounted for, giving it the verdict "reproducible" but with somewhat of a headache …
Android App Bundle or AAB in short allows Google to provide each user a tailored version of the product. For example in the case of this wallet, the older format contained binaries for arm64-v8a, armeabi-v7a, x86 and x86_64 CPUs. The new format only for "your" CPU.
https://void.cat/d/B44P1WNKFjQqSaYg6VTUng.webp
And that makes the app much smaller. In this case the zeus-universal.apk weighs 92MB while the zeus-arm64-v8a.apk only weighs 32MB.
With games where assets for bigger screens can be excluded for lower end devices, this can make even more of a difference.
But it also implies that Google gets the developer's signing key, theoretically enabling them to also tailor security aspects of your apps - on a case by case basis.
Google is pushing for AAB to trim MBs off all these apps but this comes at a cost:
* Security: Where before, only the developer could sign an update, now Google engineers can, too.
* Transparency: Where before, only one binary was circulating per version, now many circulate.
The full analysis of the latest Zeus wallet can be found here:
https://walletscrutiny.com/android/app.zeusln.zeus/

2023-09-25 13:45:27

Do you know a thing or two about compiling stuff? Do you care about people not getting rug-pulled by their Bitcoin wallets? Please help us stay on top of all these wallets!
We now list more than 6000 products and also those with a top verdict - reproducible - are thankfully getting more and more but that also means more and more on-going work as we test reproducibility not only once but ideally with every new release and for every build artifact (Bitcoin only edition and the shitcoins-included edition and x86_64 and armeabi, ...)
The latest tests performed - and all found to be reproducible - were for these three:
* https://walletscrutiny.com/android/de.schildbach.wallet/
* https://walletscrutiny.com/android/com.mycelium.wallet/
* https://walletscrutiny.com/android/org.electrum.electrum/

2023-07-06 19:28:47

The re-design is finally live!
Great thanks to
* Spiral for sponsoring us
* the Bitcoin Design Community for awesome improvements that we have refined over 16(?) calls and who knows how much research between the calls
* @npub1vwu…zl6z who implemented the very challenging changes over 350 commits!
Check it out at https://walletscrutiny.com/
Please be gentil. We probably have missed many details. Bug reports and feature requests are as always welcome at https://gitlab.com/walletscrutiny/walletScrutinyCom/-/issues

2023-05-18 04:17:18

Will Ledger recover from "Ledger Recover" backlash? Probably. Most customers will not notice. Most that do, will not understand what's going on. It will blow over but some will level up and learn what was long common knowledge for experts.
#ledgerrecover
Many users claim to prefer Ledger hardware wallets as they use a so called "secure element" or SE. This chip is advertised to resist sophisticated physical attacks but part of the defense of these chips is legal in nature - talking about flaws or details is forbidden.
To use an SE, companies have to sign NDAs and are required to not share aspects of the chip. This also includes to not share the code they run on said chip.
If you can't verify, you have to trust. Trust the claims of the provider. And these claims were unequivocally clear:
https://void.cat/d/PLsKyxPtoxzuR2adcKDhhy.webp
Yesterday Ledger announced a new product, enabled with a firmware update that does just what prior was advertised as being impossible: Send your keys to trusted parties with https://www.ledger.com/recover.
While many take aim at the potentially insecure storage of keys with such third parties and criticize the KYC required for it, the main issue here is that of trust. If this is possible and undetectable, have they maybe already built in legal confiscation features?
If you believe in "Don't trust. Verify!" your only option is to use verifiable tools. We list those and follow up with them. Check how transparent your preferred Bitcoin wallet is at https://walletscrutiny.com/

2023-04-18 20:47:07

Those links used to be all with the universal 🌐 globe symbol. Now the most common brands are easier to spot ...
https://void.cat/d/8v2YLo2F5a8xvwgo4BZQMu.webp

2023-04-07 20:26:56

52 new verdicts were released today.
* 25 products were custodial
* 8 were closed source
* 8 were wallets but not for #Bitcoin
* 5 turned out to be no wallets at all
* 2 were vapor ware
* 1 did not support sending or receiving Bitcoin - only speculating on its value
* 1 was not released yet
* 1 was do-it-yourself
* 1 will need more investigations

2023-04-04 14:16:53

In the past ten days we published **64 new wallet reviews** and another **60 updates** to verdicts.
Most of the research was done by #[0] and verified by #[1]
https://walletscrutiny.com/

2023-03-23 18:18:20

Our stated mission is to look into Bitcoin Wallets and with bearer tokens like the [Opendime](https://walletscrutiny.com/bearer/opendime/) we already ventured into products that clearly are not wallets but they are meant to keep your private keys safe, so users want to know: Do they really keep you safe from loss?
Now we came across products that are marketed as "crypto vaults" but they are more akin to [password managers](https://en.wikipedia.org/wiki/Password_manager) like LastPass - a general store of important data. By being marketed to keep your important data safe, they clear are being used for Bitcoin, too. The crypto-themed one we are looking at right now has 100k installs on Google Play.
Should we look into those or is that mission creep?

2023-03-22 01:11:37

https://media.nostrgram.co/i/90/media_901873f45a146.jpg
From the start we wanted to look into desktop wallets but it's really hard. For example for Electrum there is 23 different ways of getting the binary and those are probably +20 different binaries.
* We do not have the resources to check them all with every release.
* We have no idea how to communicate our findings to the user.