Skip to content
SafetyScorer

Safety scores

Crypto wallets

A self-custody wallet takes the exchange out of the picture, but the risk moves to your keys and to the wallet's own code. In June 2023 attackers drained more than $100 million from Atomic Wallet users, by Elliptic's estimate. We score wallets on losses caused by their own code, releases or servers (30%), how keys are stored, backed up and recovered, with top marks only for keys on a hardware device (30%), open source and audits (20%), defences against drainers and phishing (15%), and the company's data and legal record (5%). We do not judge any coin as an investment.

All rated crypto wallets

  1. #1 of 23

    BitBox02

    The BitBox02 from Switzerland's Shift Crypto keeps keys on the device, publishes its firmware under Apache 2.0 and mixes five sources of randomness into every seed. No funds have been lost to it since 2019. In 2026 it fixed three severe firmware bugs, and attackers used its newsletter account to send phishing.

    Score 83, grade B

  2. #2 of 23

    Keystone

    The Keystone 3 Pro signs transactions offline through QR codes, keeps keys behind three secure elements and publishes its firmware under the MIT licence. We found no loss traced to it. The gaps are a smaller, less-tested user base, an audit limited to Zcash code and a closed chip library.

    Score 83, grade B

  3. #3 of 23

    Trezor

    A Trezor device is one of the most transparent places to keep crypto keys, with fully open-source firmware and no remote hack on record. The company's weak spot is customer data, with four leaks or abused channels since 2024, including 81,000 shipping addresses in 2026.

    Score 83, grade B

  4. #4 of 23

    MetaMask

    MetaMask has a clean record for a hot wallet used by tens of millions of people, and it now warns about malicious transactions by default. Its weak points are a restrictive source licence with no recent public audit of the core wallet, and a September 2026 infrastructure incident that is still under investigation.

    Score 81, grade B

  5. #5 of 23

    Rabby Wallet

    Rabby is an open-source EVM wallet from the DeBank team that simulates each transaction and flags risky requests before you sign. Its 2022 swap-contract exploit cost users about $200,000, which Rabby repaid. Keys sit on an internet-connected computer or phone, so pair it with a hardware wallet for savings.

    Score 81, grade B

  6. #6 of 23

    BlueWallet

    BlueWallet is a free, MIT-licensed Bitcoin wallet for iPhone, Android and Mac that keeps keys on your device and adds multisig vaults and hardware-wallet signing. Its record is clean; what it lacks is a public audit, a paid bug bounty and an independently verified build.

    Score 79, grade B

  7. #7 of 23

    Rainbow

    Rainbow is an open-source (GPL-3.0) Ethereum and EVM wallet for phones and browsers that simulates transactions and flags malicious sites. We found no loss traced to its own code since 2019. It publishes no audits and runs no public bug bounty, and keys sit on an internet-connected device.

    Score 79, grade B

  8. #8 of 23

    Ledger

    A Ledger device is one of the safest places to keep crypto keys, and no device has been remotely hacked. The company around it has a weaker record, with a hijacked software library in 2023 and leaks of customers' home addresses in 2020 and 2026.

    Score 78, grade B

  9. #9 of 23

    Tangem

    Tangem is an NFC card hardware wallet that generates and keeps keys in a secure chip, backed up on two or three cards instead of a seed phrase. It loses points because the card has no screen, the firmware is closed and a 2024 app bug logged the keys of some seed-phrase users.

    Score 78, grade B

  10. #10 of 23

    Coinbase Wallet

    Coinbase Wallet, the self-custody app that spent 14 months as the Base App, has a clean record and a well-documented passkey smart wallet. It loses points for a closed-source app and an App Store label that admits tracking for advertising.

    Score 77, grade B

  11. #11 of 23

    Phantom

    Phantom has a clean record for a hot wallet and some of the better scam warnings around, built partly on its purchase of Blowfish. Its weak spot is transparency, with closed-source apps and a last public audit from June 2024.

    Score 76, grade B

  12. #12 of 23

    Exodus

    Exodus is a long-running desktop and mobile wallet from a US-listed company, with no loss traced to its own code and a standard 12-word secret key. It loses points because the app is closed source, no audit is published and it offers few defences against malicious signatures.

    Score 74, grade B

  13. #13 of 23

    SafePal

    SafePal's S1 signs transactions offline through QR codes and keeps keys behind an EAL6+ chip, and no theft has been traced to its devices. Against that, its firmware is only partly published and cannot be rebuilt, we found no public audit, and a 2026 breach exposed the home addresses of 39,798 customers.

    Score 72, grade B

  14. #14 of 23

    OKX Wallet

    OKX Wallet is the self-custody wallet of the OKX group, separate from the exchange account. Its drainer and address-poisoning defences are among the better ones, but the app and extension are closed source, and its built-in DEX was exploited in 2023 and paused in 2025 amid EU laundering scrutiny, which OKX disputed.

    Score 71, grade B

  15. #15 of 23

    Electrum

    Electrum is a Bitcoin-only desktop and Android wallet with open code, reproducible builds and excellent key options, including multisig and offline signing. Its record carries the 2018–2019 attack in which malicious servers used the client to push fake updates, costing users over 771 BTC that was never repaid.

    Score 69, grade C

  16. #16 of 23

    Trust Wallet

    The Trust Wallet mobile app has never been linked to a loss from its own code, but the browser extension has failed twice, most seriously in December 2025 when a malicious official release drained about $8.5 million. Trust Wallet promised to repay victims. The app itself is closed source.

    Score 68, grade C

  17. #17 of 23

    Zengo

    Zengo is a seedless mobile wallet built on 2-of-2 MPC, with one key share on your phone and one on Zengo's servers. It reports no hacked accounts since 2018 and has a tested plan for the company failing, but you cannot export a normal private key while Zengo runs, and its app audits are not public.

    Score 68, grade C

  18. #18 of 23

    Bitcoin.com Wallet

    Bitcoin.com Wallet keeps keys on your phone and lets you back up with a recovery phrase or a password-encrypted cloud file. We found no loss traced to the app since 2017, but its code has been closed since 2020 and we found no published audit or bug bounty.

    Score 65, grade C

  19. #19 of 23

    Coldcard

    Coldcard is a Bitcoin-only hardware wallet built for offline signing, with two secure elements and published source code. In July 2026 attackers drained well over 1,300 BTC from seeds that its firmware had generated with too little randomness since 2021, and victims have not been repaid.

    Score 65, grade C

  20. #20 of 23

    Binance Wallet

    Binance Wallet, formerly the Binance Web3 Wallet, is a seedless MPC wallet inside the Binance app. Binance holds one of three key shares and cannot move funds alone, and a private-key export exists, but the code is closed, nothing is audited in public and the wallet is tied to your verified Binance identity.

    Score 60, grade C

  21. #21 of 23

    Simple

    Simple (simple.app) is an easy, seedless wallet built on 2-of-2 MPC, in which Simple's server holds one key share and your phone the other. We found no losses, but almost nothing about its security can be checked from outside, and recovery leans heavily on your email account.

    Score 54, grade D

  22. #22 of 23

    Best Wallet

    Best Wallet is a heavily advertised seedless mobile wallet that says it runs on Fireblocks MPC technology. We found no reported losses, but very little can be checked from outside, the operator appears under three different company names, and regulators in the UK and Spain have warned that it is not authorised.

    Score 50, grade D

  23. #23 of 23

    Atomic Wallet

    Atomic Wallet is a self-custody app that lost users more than $100 million in a June 2023 theft, by Elliptic's estimate. More than three years on, the cause is unexplained, nobody has been repaid, and the closed, obfuscated code gives outsiders no way to check.

    Score 36, grade F