BLUEWALLET CTO FLAGS 45 APP STORE CRYPTO WALLETS FOR CRITICAL OR HIGH-RISK SECURITY ISSUES
BlueWallet’s CTO analyzed 494 of 904 iOS apps marketed as non-custodial crypto wallets and flagged 45 for potential critical or high-risk security issues.
The research focused primarily on private-key exfiltration and weak entropy, with 23 apps classified as potentially critical and 22 as high risk.
Findings included apps allegedly uploading seed phrases or private keys to servers, generating wallets with weak randomness, storing keys server-side, using hardcoded encryption keys, and loading unsigned JavaScript capable of interacting with wallet secrets.
BlueWallet’s CTO cautioned that the analysis may contain false positives and that an app not appearing on the list should not be considered proof that it is secure.
His biggest takeaway is that App Store approval and reputation alone are not enough when trusting software with meaningful amounts of Bitcoin.
I was able to decompile and analyse 494 wallets on the AppStore.
I found 45 apps that raised red flags for me during my research.
I looked specifically for 2 things: private keys exfiltration and weak entropy.