Crypto wallets

01Where wallets go on this phone

The phone has two spaces: the everyday profile, which always runs and gets notifications, and the protected space, which runs only while it is on screen and loses its key within seconds of you leaving. See Set up your phone for how they work.

On the phone

• Google Play: install it only in the space that needs it. Rabby needs it; Unstoppable, Nunchuk and Trezor Suite don't.
• Camera: grant it to the app scanning a QR code, "Only this time".
• No accessibility services, automation apps or screen overlays in the space that holds a wallet. Use a keyboard with the Network permission off.
• dApp links open in Vanadium, the GrapheneOS browser.
• USB-C "Charging-only when locked" (the default) still lets a Trezor or BitBox talk to the phone while it is unlocked.
• No cloud backup of the space holding a hot wallet. Never copy a seed to the clipboard.

02Four roles, four seeds

Four separate jobs, each with its own seed: a hot multi-chain wallet for dApps, Bitcoin cold storage, EVM cold storage with a Safe, and TRON for TRC-20 USDT. The picks favour audited, open or source-available code, an APK you can verify, and a path that doesn't depend on Google Play.

Whatever you pick, the OS is part of the trust base: a compromised OS build defeats every choice on this page. That is one reason a separate signer phone should run stock GrapheneOS (section 11).

03Hot wallet

No single fully open wallet gives both many unrelated accounts and the widest dApp support, so the hot role is two apps, both in the protected space. Keep only amounts you could lose.

Rabby Mobile

Why

The best pre-sign simulation and risk warnings on mobile. Automatic chain switching. Works wherever a dApp offers "MetaMask" through WalletConnect, and with the Rabby extension on a computer for the same accounts. Several seeds, many accounts per seed. EVM only.

Source

RabbyHub/rabby-mobile is public but has no license file. Least Authority audited the mobile app itself in 2024 and 2025 (2025 report).

Distribution

Google Play only. No APK on GitHub, not on F-Droid or IzzyOnDroid, no WalletScrutiny entry.

Hardware

Ledger over Bluetooth. Other signers are reported but not confirmed on Android; test with a small amount.

Weak spots

2022 swap-contract bug (repaid), a 2024 fake iOS app. Simulation calls DeBank's servers, so DeBank sees your addresses.

Verdict

Use it for dApps, with balances you could lose. Install Google Play in the protected space, then Rabby from Play.

Unstoppable Wallet

Why

Native, MIT-licensed, needs no Google Play. BTC, EVM chains, Solana, TON, Zcash and TRON in one app. Several wallets, BIP39 passphrases, custom RPC. The open counterweight to Rabby and the best hot wallet for small TRON amounts.

Source

unstoppable-wallet-android, v0.53.0 (26 Oct 2026).

Reproducible

WalletScrutiny reproduced 0.51.0–0.51.2 and 0.52.1. 0.52.0 and 0.53.0 failed to build from source ("ftbfs"), and 0.52.2 has mixed results. A failed build means unverified, not malicious.

Distribution

GitHub releases ship a github APK and a google_play APK. Use the github APK. TRON is in every build, but WalletConnect is only built in when its module is present, so F-Droid builds can ship without it.

Weak spots

Narrower dApp support than Rabby. No hardware-wallet support.

Also considered

• Ambire: GPL-3.0, APK on GitHub. A smart-account wallet and a good open alternative to Rabby if you want to install from GitHub.
• MetaMask Mobile: the widest compatibility (EVM, Solana, BTC, TRON). Inspection-only license, not reproducible on WalletScrutiny, Play only, weaker signing warnings. Only if a dApp refuses everything else.
• Uniswap Wallet: GPL-3.0 (source), but Play only and EVM-centric. You don't need it to use Uniswap: open the site in Vanadium and connect Rabby with WalletConnect.
• Phantom: the usual Solana wallet. Closed app ("nosource" on WalletScrutiny; only SDKs are at github.com/phantom), Play only, and fake Phantom apps are a constant phishing theme. If you trade on Solana, give it its own seed and a small balance. Unstoppable covers plain SOL holding.
• Trust Wallet: closed app ("nosource"); only Wallet Core is open. A weak-RNG bug in its extension in 2023 and a backdoored extension release in late 2025. Skip it.
• Rainbow (GPL-3.0, Play only), Zerion (closed), Cake Wallet (rated custodial by WalletScrutiny because of its optional Lightning balance), Atomic and Guarda (closed).

Connecting to dApps

• On the phone: open the site in Vanadium and choose WalletConnect; the link hands off to Rabby. Rabby's built-in browser also works for sites that expect MetaMask.
• On a computer: the Rabby extension with the same seed, or scan the site's WalletConnect QR code with Rabby Mobile or Unstoppable (github build).
• With a hardware signer: the Rabby extension on a computer supports Trezor, Ledger, Keystone, OneKey and GridPlus. That is the place for dApp signing with cold keys.

04Bitcoin cold storage

Recent incidents argue against trusting any one maker's seed generation or supply chain. For long-term holdings, use a 2-of-3 multisig across three makers. For single-sig, use one open-firmware signer with a dice-generated seed and a passphrase.

Nunchuk and Sparrow

Nunchuk

The strongest Android result in this survey: four consecutive releases (2.9.0–2.9.3) reproduced by WalletScrutiny. Native app with multisig, Miniscript and taproot, and PSBT over QR, NFC and USB. Guest mode needs no account. APK on GitHub. The free self-custody plan is enough; paid plans add a Nunchuk-held key, which is a different custody model.

Sparrow

Desktop app, Apache-2.0. Build the multisig here, back up the output descriptor, then import it into Nunchuk as watch-only.

Server

If you run a Bitcoin node, point both at your own Electrum server (Fulcrum or electrs). That closes off the malicious-server attack class described under incidents.

Signers

Firmware verdicts are WalletScrutiny's, October 2026.

05EVM cold storage and Safe

For many separate EVM accounts holding real money: one Safe 2-of-3 per purpose (savings, DeFi positions), with owners on hardware from different makers. A Safe is deployed per chain: a mainnet Safe doesn't protect funds sent to the same address on Base or Arbitrum.

Owner 1

Trezor Safe 5: open, reproducible firmware (2.13.0), clear signing, USB-C. Many accounts and passphrase wallets for separation.

Owner 2

A different maker. Keystone 3 Pro signs over QR, decodes EIP-712 and Safe calldata, and its firmware 3.2.0 is reproducible. But Keystone found a breach on 20 Oct 2026 and said on 26 Oct that the attacker took buyer records and the WebAuth key behind its online genuineness check; it is destroying 18,835 unsold units that carry that key. Keystone says units delivered before 20 Oct 2026 are genuine and their check still holds. For a unit delivered on or after 20 Oct, or bought from a reseller, the check proves nothing: treat it as possibly counterfeit and ask Keystone support before use. Alternatives: a Ledger, a second Trezor, or a GridPlus Lattice1 (large screen, closed firmware, computer only).

Owner 3

A recovery owner: a seed on metal in a third place, or a signer app on a spare phone (section 11). Fine for simple transfers; weak at showing arbitrary calldata.

Front-end

Sign on a computer: the Rabby extension with the hardware signer, or a self-hosted Safe UI from safe-wallet-monorepo (GPL-3.0). On Android, Safe{Mobile} is Play only and supports only a Ledger over Bluetooth as a hardware signer. A Ledger owner can co-sign from the protected space; Trezor and Keystone owners sign on a computer.

06TRON and TRC-20

Trezor Suite and a Trezor Safe 3 or 5

Why

The only option here with open, reproducible firmware and native TRX and TRC-20 on the device. Trezor firmware 2.11.0 added TRON, TRC-20 and Stake 2.0 (changelog).

Android

The "Trezor Suite" APK is on the trezor-suite GitHub releases (the @mobile tags). Connects over USB-C. Its license is source-available (Trezor Reference Source License), not open source.

Limits

Sending and receiving work on the phone. TRX staking needs the desktop app. Trezor Model One and TRC-10 tokens aren't supported.

With a Ledger

TronLink with a Ledger over Bluetooth is officially documented (TronLink guide). The Ledger TRON app is MIT; the device OS is closed. TronLink is Play only and needs Google Play in the same space.

Hot

Unstoppable for paying and receiving small amounts. TronLink only if you need TRON dApps, with its own seed; only its core module is open source.

Alternatives

Keystone 3 Pro through Keystone Nexus (Play only; subject to the breach note above). OneKey: good hardware, weaker vendor-trust story.

07A Ledger you already own

In October 2026 Ledger confirmed that units sold through a reseller carried a hidden implant that read the recovery words during setup. Check yours:

1. Where was it bought? From CryptoBilis: treat it as compromised. From any other reseller, marketplace or airport shop: you can't rule it out, so treat it as suspect. Ledger says every confirmed case involves units sold through one reseller, and that its own direct sales are unaffected.
2. The Genuine check in Ledger Live is not enough. The implant leaves the secure element intact, so tampered units pass. A pass only rules out a fake chip.
3. Where did the seed come from? If the device arrived with a filled-in recovery card, a PIN already set or an opened seal, it is a scam device. The seed must have been generated on the device and never typed anywhere else.
4. Look on-chain: check every address of that seed for unexpected outgoing transactions, approvals or TRON permission changes.
5. If in any doubt, rotate. Generate a new seed on a device bought directly from its maker, move the funds, and retire the old seed everywhere.

If it checks out:

• Update the firmware in Ledger Live and confirm that Ledger Recover is not enabled.
• Turn blind signing off in the Ethereum app. Compare full addresses on the device screen.
• Turn Bluetooth off on the device when you don't need it. Ledger Live can also connect over a USB-C cable.
• Ledger's customer data has leaked before. Expect targeted phishing by email, text or post. Ledger never asks for the recovery words, and a "replacement" device in the post is always a trap.
• Best role: a warm signer for dApps through Rabby or TronLink over Bluetooth, or one owner of a Safe. Not the only key for long-term Bitcoin, because its firmware is closed.

08Installing and verifying wallets

For installing apps in general, see Install apps. For wallets, rank the channels by how much you have to trust someone other than the developer and yourself.

Pin the signing certificate

Before the first install, read the certificate fingerprint on a computer:

apksigner verify --print-certs --verbose Nunchuk-2.9.3.apk | grep -i 'SHA-256'
# compare with the project's published fingerprint, the WalletScrutiny page,
# and AppVerifier on the phone (share the APK to AppVerifier)

Write each fingerprint down once. From then on Android pins the key: an update signed by anyone else fails to install.

Obtainium checks the certificate before installing only from 1.6.16 (#2922), and only against a fingerprint you enter. Enter it when you add each wallet, and check the first install anyway:

1. Verify Obtainium's own APK with apksigner against the fingerprint on its releases page.
2. Install AppVerifier from Accrescent. Don't use it to verify Accrescent itself.
3. For every new wallet, share the downloaded APK to AppVerifier before tapping install. Updates are then pinned by Android.
4. Use GitHub, GitLab or Codeberg release assets only. Leave "allow insecure HTTP" off.

09Build and verify from source

There are two different goals.

• Reproduce (recommended): build the release tag in the project's Docker recipe and check that your build matches the developer's APK byte for byte. Then install the developer's APK and keep their updates. Your build is the proof; you never install it. Works today for Nunchuk and Electrum.
• Self-sign: sign your build with your own key and install it. The developer's updates then can't replace it without an uninstall, which deletes the wallet's data, so you rebuild every release yourself. Reasonable for MIT, GPL or Apache apps (Unstoppable, Nunchuk, BitBoxApp, AirGap). Not for MetaMask or Trezor Suite, whose licenses restrict it. Pointless for Rabby: no license, no reference build.

Reproduce everything that holds keys. Self-sign only if upstream releases stop reproducing.

1. Get the tag, not the branch. git checkout <release-tag>, then git verify-tag <tag> where the project signs tags (Electrum, Sparrow and Trezor do).
2. Use the project's reproducible-build recipe exactly, on an x86-64 Linux machine with Docker:

   # Nunchuk: see reproducible-builds/README.md in nunchuk-android
   git checkout android.<VERSION>
   docker build --platform linux/amd64 -t nunchuk-android -f reproducible-builds/Dockerfile .
   # then run the build step the README shows and compare with the split APKs from the phone
   
   # Electrum: see contrib/android/Readme.md
   ELECBUILD_COMMIT=HEAD ./contrib/android/build.sh qml all release-unsigned
   python3 contrib/android/apkdiff.py dist/<built>.apk Electrum-<ver>.apk
   
   # Any app WalletScrutiny covers: test.sh / testAAB.sh in its repository
   ./test.sh -a /path/upstream.apk
   ./testAAB.sh -d /path/split_apks_from_device/

   For Unstoppable, F-Droid's build metadata doubles as a recipe.
3. Compare with the release:

   pipx install apksigcopier
   apksigcopier compare upstream.apk --unsigned rebuilt-unsigned.apk && echo REPRODUCIBLE
   # if not:
   diffoscope --html diff.html upstream.apk rebuilt-unsigned.apk

   Differences should be in signature blocks only. Differences in classes*.dex, lib/*.so or JavaScript bundles mean stop.
4. Audit dependencies of JavaScript and Flutter wallets: install with --frozen-lockfile --ignore-scripts, run osv-scanner on the lockfile, and list packages with install scripts. For Gradle, check that gradle/verification-metadata.xml exists and is enforced.
5. Cross-check WalletScrutiny for the exact version and the exact APK you install (the GitHub build, not the Play one), not the app page. Verdicts are per build (how they work).

10Seeds and signing rules

• One seed per role, never mixed: hot, Bitcoin cold (three for a multisig), EVM cold, TRON.
• Generate cold seeds with dice, on the signer itself, using the device's own dice entry (at least 50 rolls of a fair die, unseen), or dice mixed with its random generator. Never convert rolls to words in an app or on a website. The 2026 Coldcard bug shows why.
• Back up on paper or metal, never photographed, never typed into an online device or a password manager. Add a BIP39 passphrase to cold seeds and store it separately. Rehearse a restore with a small amount: a wrong passphrase silently opens an empty wallet.
• Multisig beats Shamir for Bitcoin. Use SLIP-39 only on a Trezor, which implements it; never ad-hoc splitting tools. Keep the descriptor and the Safe owner list next to each key.
• Approvals: exact amounts, then revoke. Check them in Rabby's built-in view; "revoke" sites are heavily phished. Watch for Permit, Permit2, setApprovalForAll and EIP-7702 delegations.
• Address poisoning: never pay to an address from your history. Compare the full address on the hardware screen with a saved contact. The first and last four characters are exactly what attackers imitate.
• WalletConnect: only hot accounts ever scan a dApp's QR code. Disconnect sessions after use.
• Vendor data leaks mean phishing that knows your name and order. No real vendor ever asks for a seed.

11Spare phone as signer

A separate phone works well as the third key of a multisig or a backup signer, not as the main one: a phone has a far larger attack surface than a dedicated signer. Android's secure hardware can protect the wallet's encryption key, but the seed is still decrypted into ordinary app memory to sign.

Use stock GrapheneOS, signed by the GrapheneOS project, with the bootloader locked. A signer needs none of this OS's features, and stock GrapheneOS has less custom code and the upstream project's signing infrastructure behind it.

1. A separate phone, not a space on your daily phone.
2. No SIM or eSIM, Wi-Fi never set up, Bluetooth off.
3. Copy the signer APK from a verified build on a USB stick, install it, and turn its Network permission off at the install prompt. Remove the stick.
4. Then set the USB-C port to Off (Settings → Security & privacy → Exploit protection), before making any seed.
5. Signer app: AirGap Vault (MIT; 3.34.4 reproducible, 3.35.0 not) for BTC and ETH, or BlueWallet in offline mode (MIT; 8.0.0 reproducible) for Bitcoin only.
6. Generate the seed with dice. Export only the xpub or descriptor by QR. Check the first receive address on another signer before sending funds.
7. Set auto-reboot to its minimum. Grant Camera only while scanning.

12Encrypting recovery notes

A recovery file holds what surrounds the keys: Bitcoin descriptors, Safe addresses and owners per chain, xpubs, certificate fingerprints, and instructions for whoever has to recover. Never seed words or passphrases: those stay on paper or metal.

• age (or rage) is the default: small, open format, several independent implementations, scrypt for passphrases. Armored output (-a) can be printed.
• KeePassXC (with KeePassDX on Android, Network off) for many entries; pick KDBX4 with Argon2id in the database settings, and test opening it on every device you'd recover from.
• VeraCrypt for a container of many files; independently audited.
• Avoid ZIP, PDF and Office passwords and "locked" notes apps.

tar -czf - recovery/ | age -p -a -o recovery.tgz.age
# press Enter at the prompt and age generates a strong passphrase
age -d recovery.tgz.age | tar -tzf -   # test without writing plaintext to disk

One file, several keys. age can encrypt to several recipients, and any one of them opens it: for example two hardware keys kept in different places and a paper identity. Losing one costs nothing.

age-keygen -o paper-identity.txt   # print it, then delete the file
age -a -r age1…key1 -r age1…key2 -r age1…paper -o vault.age vault.tar

• Three copies, two kinds of media, one off-site. Keep the passphrase apart from the file.
• Decrypt one copy once a year on a different machine.
• Decrypt to a pipe or an encrypted volume, not to synced or indexed folders.

13Recent incidents

Only incidents with a public source are listed. Dates are of the incident or its first public disclosure.

14Sources

• WalletScrutiny and its verification spec
• GrapheneOS usage guide, GrapheneOS features
• AppVerifier
• Obtainium #2922 and 1.6.16
• Rabby Mobile source, Least Authority audit (2025)
• Unstoppable Wallet
• Uniswap Wallet source, Phantom on GitHub, Trust Wallet Core
• Nunchuk, Sparrow
• Safe wallet monorepo
• Trezor Suite, Trezor firmware changelog
• TronLink with Ledger
• AirGap Vault
• Electrum security advisories
• Coldcard vulnerability (Casa), Bitcoin Optech, 31 Jul 2026
• Ledger implant (BleepingComputer), Ledger implant (The Hacker News)
• Keystone breach (Decrypt), Keystone breach (The Hacker News)
• Bybit and Safe (BleepingComputer)