How we score crypto wallets

Losses caused by the wallet's own code, build, distribution or backend (key-generation bugs, malicious releases, supply-chain compromises), and whether victims were repaid. User-signed phishing does not count unless the vendor's own channels were used. 90+: no loss traced to the wallet in 5+ years of wide use. A wallet with under 3 years of wide use scores at most 80, because a short clean record proves little. 70–89: a limited incident, fully repaid, with a public post-mortem. 50–69: a large incident repaid, or a small one not repaid. Below 50: large losses not made whole, or the cause never explained.

How keys are created, stored, backed up and recovered, and whether you can leave without the vendor. 90+: only for keys that never leave a dedicated device (secure element or air-gapped), with a standard exportable seed and an optional passphrase or multisig. 70–84: software wallet on a phone or computer with a standard exportable seed and encrypted local storage; keys on an internet-connected device cannot score higher. 50–69: MPC or cloud-backup model where the vendor holds a share but a documented export path exists. Below 50: signing depends on the vendor with no assured exit, or seeds leave the device to third parties by default.

Open-source status, reproducible builds, recent public third-party audits, bug bounty. 90+: fully open source with reproducible builds, audits from the last 2 years and an active bounty. 70–89: open or source-available with audits and a bounty. 50–69: partly open, or audits claimed but not published. Below 50: closed source, no public audit, no bounty.

Defences against drainers and phishing: transaction simulation, malicious-site and address warnings, readable approvals and revocation, clear signing on hardware, address-poisoning filters. 90+: simulation and warnings on by default and clear signing. Below 50: blind signing by default and no warnings.

Customer-data leaks (especially home addresses of hardware buyers), tracking, enforcement actions and regulator warnings, whether the operator is identifiable. 90+: known company, minimal data, no leaks or enforcement. Below 50: anonymous operator, a leak of customers' physical details, or a major enforcement action.