Atomic Wallet

Is Atomic Wallet safe?

Not on its record. In June 2023 more than $100 million was drained from Atomic Wallet users, by Elliptic's estimate, and more than three years later Atomic has neither explained how it happened nor repaid anyone. The app is closed source and obfuscated, so no one outside the company can check whether the problem is gone. We score it 36/100, an F.

Atomic is easy to use, supports more than 1,000 assets and now adds staking, perpetual futures and prediction markets. None of that changes the core question for a wallet: can you trust the software holding your keys? With an unexplained mass theft and no way to inspect the code, we cannot say yes.

What happened in the June 2023 theft?

On Saturday 3 June 2023 Atomic's support team started getting reports of unauthorised transfers. Atomic halted app downloads and updates, changed server access and brought in Chainalysis and Crystal to trace the money.

Elliptic's tracing grew the estimate from about $35 million to over $100 million. It tracked more than 5,000 wallets believed compromised, with an average loss of about $2,800, at least 164 addresses losing more than $100,000 and at least ten losing more than $1 million. Elliptic attributed the theft to North Korea's Lazarus Group "with a high level of confidence", citing laundering steps and services such as the Sinbad mixer that matched earlier Lazarus hacks, and said over $1 million had been frozen.

Atomic said fewer than 0.1% of its users were affected. That may be true and still mean thousands of people, many of whom lost savings.

Why the cause still matters

Atomic's statement, last updated in September 2023, named four probable causes: malware on users' devices, a breach of its infrastructure, malicious code injected into the app, or a man-in-the-middle attack. It said none had been confirmed. We found no post-mortem since.

That is the main reason for a security record score of 20. Our rubric puts wallets below 50 when large losses were not made whole or the cause was never explained; Atomic meets both. Compare Trust Wallet, which also had a malicious-release incident but published what happened and began repaying victims. Without a cause, users cannot know whether the weakness was fixed, and key management drops to 65 even though the wallet uses a normal 12-word phrase with local AES encryption.

Lawsuits and repayment

Victims have tried the courts. A class action filed in Colorado in June 2023 against Atomic Protocol Systems OÜ, the software firm Evercode Infinite and individuals was dismissed in September 2024 because the court found it had no jurisdiction over them. That was a ruling about where to sue, not about whether Atomic was at fault. A second case, filed in federal court in California in June 2025, was still open when we checked.

Atomic's current terms, updated in December 2025, do not name the company behind the app. They choose the law of Panama with arbitration there, waive class actions and cap any damages at $50. The App Store still lists Atomic Protocol Systems OÜ, an Estonian company, as the developer. For a wallet that has already lost users' money, an operator that is hard to identify and hard to sue is a real weakness, and company record scores 35.

Can you check Atomic's code?

No. Atomic has a GitHub account, but WalletScrutiny found none of its repositories matched the wallet and described the app as closed source with obfuscated JavaScript. We found no public third-party audit and no bug bounty. Transparency scores 15, below even Simple, and it is what makes the unexplained 2023 theft so hard to put behind it.

If you use Atomic Wallet

1. Keep only small amounts in it. For savings, use a hardware walletHardware walletA small dedicated device that stores crypto private keys offline and signs transactions inside the device, so the keys never touch your computer.More in the glossary with open firmware.
2. If you move, create a brand-new recovery phraseSeed phraseA list of 12 to 24 words that can restore a crypto wallet and all its funds. Anyone who has it controls the wallet.More in the glossary in the new wallet and send the funds across. Importing your Atomic phrase elsewhere does not protect you if the phrase itself was exposed.
3. Keep the app updated only from atomicwallet.io or the official store listings.
4. Ignore anyone offering to recover 2023 losses for a fee. Atomic itself warned about impersonators.
5. Check approvals you have given through its Web3 wallet, since we found no built-in warnings.

How we scored it

Security record (20) and transparency (15) are the weakest factors: a theft of over $100 million with no published cause or repayment, and code nobody outside can inspect. Key management (65) is the strongest, because the wallet uses a standard exportable backup phrase, but it stays below other software wallets until the 2023 cause is explained.