Bitcoin.com Wallet

Is Bitcoin.com Wallet safe?

It is a working self-custodySelf-custodyHolding crypto in a wallet where you alone control the private keys, rather than leaving it with an exchange or another company.More in the glossary wallet with a clean record, but you have to take most of its security on trust. Keys are created on your phone, you can back them up with a standard recovery phraseSeed phraseA list of 12 to 24 words that can restore a crypto wallet and all its funds. Anyone who has it controls the wallet.More in the glossary, and we found no loss traced to the app since it launched in 2017. We score it 65/100, a C.

The reason is transparency. Bitcoin.com stopped publishing the wallet's code in 2020, and we found no published audit or bug bounty, so nobody outside the company can check how keys are generated, stored or backed up. The company says over 85 million wallets have been created with it; that is its own count, and it says nothing about safety.

How the keys and the cloud backup work

When you create a wallet, the app generates the keys on your device. Bitcoin.com's store listing says "not even Bitcoin.com can access them", and you can move your coins to another wallet at any time.

You then choose a backup. The classic one is a recovery phraseSeed phraseA list of 12 to 24 words that can restore a crypto wallet and all its funds. Anyone who has it controls the wallet.More in the glossary that you write down and can restore in other wallets. The alternative is an automatic cloud backup: a file in your Google Drive or iCloud, encrypted with a single password you choose. Lose the phone, reinstall the app, enter the password and the wallets come back.

That is convenient, and it moves the risk. Anyone who takes over your Google or Apple account can download the file and try passwords against it offline, so a short or reused password is the weak point. Bitcoin.com's own guide is vague here, describing the setup as "a mix of encryption and cloud services tied with custodial services to help retrieve things", without saying what those custodial services are. With closed code we cannot check what is in the file or how it is encrypted. Key security scores 74, against a ceiling of 84 for software wallets.

Is Bitcoin.com Wallet open source?

No, not since 2020. The early app grew out of open-source code and was published on GitHub under the MIT licence. On 12 April 2020 Bitcoin.com told WalletScrutiny the wallet was closed source "until further notice"; the public repository stops at version 5.4 and was last updated in June 2021, while the app is now on version 9.39. WalletScrutiny's verdict is "no source", meaning it cannot confirm the app is self-custodialSelf-custodyHolding crypto in a wallet where you alone control the private keys, rather than leaving it with an exchange or another company.More in the glossary as claimed.

We found no published third-party audit, no public bug bounty and no security contact file on bitcoin.com. Transparency scores 30, against 62 for Trust Wallet, which publishes its core library, and 68 for open-source BlueWallet.

What it does to stop scams

Not much beyond advice. The app connects to dApps on Ethereum, Avalanche, Polygon and BNB Smart Chain through WalletConnect, which is where approval drainersDrainerA malicious website or script that tricks a crypto user into signing a transaction or approval that lets attackers empty the wallet.More in the glossary do their damage, yet we found no mention of transaction simulation or warnings about malicious sites or poisoned addresses. The website's security tips are sound but basic: no support team will ask for your recovery phraseSeed phraseA list of 12 to 24 words that can restore a crypto wallet and all its funds. Anyone who has it controls the wallet.More in the glossary, ignore urgency and "wallet verification" requests, and download the app only from official stores. Scam protection scores 50.

Supporting both Bitcoin and Bitcoin Cash adds a mistake that other wallets do not invite. The two coins have similar names and separate networks, so check which one is selected before every send.

Who runs Bitcoin.com Wallet

The app, the website and its other services belong to Saint Bitts LLC, registered in Nevis in the Caribbean (company number L17015). It names a data protection contact but publishes little about its owners or finances. The App Store privacy label lists analytics, a user ID and a device ID collected but not linked to your identity. In-app purchases go through outside payment providers that may require ID; the self-custodySelf-custodyHolding crypto in a wallet where you alone control the private keys, rather than leaving it with an exchange or another company.More in the glossary wallet does not. We found no customer-data leak or enforcement action against the wallet, and company record scores 65.

How to stay safe with Bitcoin.com Wallet

1. Write the recovery phraseSeed phraseA list of 12 to 24 words that can restore a crypto wallet and all its funds. Anyone who has it controls the wallet.More in the glossary on paper or metal, even if you also use the cloud backup.
2. If you use the cloud backup, pick a long password you use nowhere else and protect your Google or Apple account with two-factor authenticationTwo-factor authenticationSigning in with a second proof of identity on top of your password, such as a code from an app, a security key or a passkey.More in the glossary.
3. Check the coin and network before sending, especially between BTC and BCH.
4. Connect only to dApps you know, and revoke token approvals you no longer need.
5. Keep large amounts on a hardware walletHardware walletA small dedicated device that stores crypto private keys offline and signs transactions inside the device, so the keys never touch your computer.More in the glossary rather than in any phone app.

How we scored it

The security record (88) is the strongest factor: no loss traced to the app in about nine years. Transparency (30) is the weakest, because closed code with no published audit means its key handling and cloud backup cannot be checked. That gap, plus thin scam protection, puts Bitcoin.com Wallet below Exodus (74), whose app is also closed source but which runs a paid bug bounty on HackerOne, and well below open-source BlueWallet (79).