Apps Seed-Theft
Wallets to Delete
Apple App Store audit, September 2026. Not Google Play Yet.
BlueWallet CTO @overtorment cataloged 904 apps marketed as non-custodial wallets, inspected 494 binaries, and flagged 45. He looked for seed/private-key exfiltration and weak entropy.
Listings said “keys stay on your device.” In many builds the seed is posted to a server, written to Firebase, generated on the backend, or wrapped with a key the developer already knows.
- Is this the Play Store list?
No. This audit is iOS. Play Store has had separate fake-wallet waves. Same rule: no real wallet needs your full seed typed into a store app. - Can I keep the app if I emptied it?
Delete it. The binary already had a path to send secrets. - Does a high rating mean safe?
No. Fake reviews and AI-written clones were part of the finding. - Google Play is not cleaner. Fake wallets and seed-phishing apps show up there too. This page will get a Play Store delete list when a source-quality audit is published.
- Same rule in the meantime: no real wallet needs your full seed typed into a store app.
Absence from this list does not mean an app is safe. Presence means delete it and move funds off that seed.
Source: kek.lol research · @overtorment thread
If you used one of these
- Uninstall the app.
- Treat that seed as leaked.
- Send coins to a new seed made on hardware. Do not type the old phrase into another phone app.
- For savings, use multisig on separate devices. A phone should not be the only signer.
Critical Delete now
| App | Coins | Why |
|---|---|---|
| Aura: Bitcoin Wallet | BTC | POSTs mnemonic, WIF, vault phrases to a third party. |
| BirrOS | BTC + alts | Uploads mnemonic; recover API can return it in plaintext. |
| Bitcoin Wallet : BTC,ETH,USD | Multi | Register/send POSTs mnemonic and signer keys. |
| Cold Wallet: Crypto Wallet App | TON | Auto-uploads mnemonic when backend says it is unsaved. |
| DexSpace | — | Import POSTs mnemonic. Generate flow is server-custodial. |
| DIAM Wallet | ETH + | Swipe-to-sign POSTs the live private key. |
| Dibix | BTC + | Restore/create attach mnemonic to APIs. Hardcoded decrypt key. |
| GoldBit wallet | BTC + | Writes seed and keys into Firestore. |
| Grey Wallet | Multi | Can POST phrases and keys when the server turns collection on. |
| Helios: Tron wallet | TRX | OCRs photo library for seed pictures and uploads them. |
| Hive – DeFi Commerce Wallet | BTC + | Wallet created server-side. Listing claims no access. |
| Kraster Wallet | Multi | Signup POSTs mnemonic and PIN. |
| Locksy Wallet | ETH + | Uploads recovery phrase to Firestore with weak XOR. |
| Noctar Wallet | BTC + | Server issues the phrase; create/import send phrase or PIN. |
| Prosper Wallet 2026 | ATOM | Enrollment POSTs mnemonic; login can return it. |
| R0AR Wallet | ETH + | POSTs remapped seed/key to a Heroku API. |
| Solidum Wallet | TRX + | POSTs encrypted mnemonic/key backup to Appwrite. |
| Swiss Bitcoin Pay | BTC | Login posted the 12 words. Devs later said fixed — still rotate the seed. |
| TRIBE Wallet | ETH + | Auto-backs private key to a third-party keystore. |
| Uin Wallet | ETH + | Hardcoded AES key wraps the BIP39 seed into an API token. |
| VeraBit : Bitcoin Wallet | BTC | POSTs mnemonic and WIF to third-party backends. |
| XRPH Wallet | XRP | Hidden seed POST. Entropy is Math.random. |
| Ybit: Crypto & DeFi Wallet | Multi | Create/import POSTs raw mnemonic or key to Firebase. |
High Treat as unsafe
| App | Coins | Why |
|---|---|---|
| FINTOKEN | Multi | Hidden WebView can see the plaintext key. Hardcoded AES password. |
| Flash Wallet | Multi | Shard uploads can reconstruct the seed. |
| HIHODL | SOL + | Operator-decryptable seed backup. |
| Mitilena Wallet | BTC | Email path sends a spend key. Listing denies server storage. |
| Perpex | HYPE | Registers agent private key with their API. |
| Pulse Wallet | Multi | Profile can download a private-key backup. MPC shares on their API. |
| Ramper Wallet | LINK | Social signup uploads key shares / wrapped key. |
| Freedom Pay Wallet | SOL + | “Secure backup” gives same-domain services spend power. |
| Gaya: AI Crypto Wallet | SOL + | Social “MPC” sends both ciphertext halves to the server. |
| ONEpocket | — | Social recovery POSTs PIN-wrapped mnemonic shares. |
| Yieldz Wallet | BTC | Keyshare wrapped with an operator-known KDF and uploaded. |
| Blockchain0x Wallet | USDC | Server-made backup codes become the recovery secret. |
| SoftNote | BTC + | Spend keys server-held. Unsigned JS after review. |
| TapDano | — | Server issues the vault key and later receives it back. |
| AoWallet & Arweave Wallet | AR | Unsigned live JS updates. Weak PIN wrap of the mnemonic. |
| Orbit+ Wallet | — | Create uses Math.random for seed entropy. |
| HOT — Crypto Wallet | Multi | Unsigned wallet JS plus an injectable path to Keychain. |
| Mesiger Crypto Wallet | — | Unsigned hot-patch JS. Mnemonic in localStorage / iCloud. |
What to use instead
- Do not pick a wallet from App Store search or ads.
- Generate keys on hardware from different vendors.
- Use 2-of-3 (or similar) multisig. Phone app = coordinator only.
- Never screenshot a seed. One flagged app scanned the camera roll for that.
- Prefer long-lived open-source Bitcoin wallets. Download from the project site.
