BlueWallet

Is BlueWallet safe?

For everyday bitcoin on your phone, yes. BlueWallet keeps your keys on the device, uses a standard recovery phraseSeed phraseA list of 12 to 24 words that can restore a crypto wallet and all its funds. Anyone who has it controls the wallet.More in the glossary you can restore in other wallets, and has no loss traced to its own code in about eight years. We score it 79/100, a B.

The weak part is proof rather than track record. The code is open source under the MIT licence, but nobody has published an audit, there is no paid bug bounty, and WalletScrutiny has not confirmed that the app you download matches the published code. BlueWallet is a strong hot walletHot walletA crypto wallet connected to the internet, such as an app or an exchange's online wallet. It is convenient, but more exposed to hacking.More in the glossary; it is not a vault.

Is BlueWallet custodial?

Not any more. From 2018 BlueWallet offered an easy Lightning wallet that ran on its own LndHub server, which meant BlueWallet held those balances. In February 2023 it said it would stop new deposits and close the service on 30 April 2023, and that it would "only support self-custodySelf-custodyHolding crypto in a wallet where you alone control the private keys, rather than leaving it with an exchange or another company.More in the glossary solutions" from then on, according to Bitcoin Magazine. On-chain wallets were not affected.

Since version 7.2.2 (November 2025) BlueWallet has offered a new Lightning wallet built on Arkade, an implementation of the Ark protocol, with Lightning payments handled through Boltz swaps. Your keys stay on the phone, and Arkade says users can always withdraw to the Bitcoin chain on their own, even if its operator goes offline. But the Arkade operator coordinates day-to-day transactions, and the system is new and little tested. You can also still connect a node you run yourself through LNDhub. BlueWallet's help pages call Lightning experimental and advise keeping amounts small; our score is for the on-chain wallet.

How BlueWallet stores your keys

The recovery phraseSeed phraseA list of 12 to 24 words that can restore a crypto wallet and all its funds. Anyone who has it controls the wallet.More in the glossary and keys are created on your phone and, in BlueWallet's words, "never leave your device". You can restore the phrase in any wallet that follows the common BIP39 standard, with or without a passphrase.

Two settings are worth turning on. "Password Protected" encrypts all wallet data on the phone with a password of your choice, on top of the phone's own encryption. With it on, you can add a second password that opens a decoy storage if someone forces you to unlock the app. Neither password can be recovered; your seed words are the real backup.

The stronger features are for larger sums. MultisigMultisigA crypto wallet that needs approval from several keys to move funds, for example any 2 of 3, rather than from a single key.More in the glossary vaults need several keys to spend, and watch-only wallets let you follow a hardware walletHardware walletA small dedicated device that stores crypto private keys offline and signs transactions inside the device, so the keys never touch your computer.More in the glossary such as a Coldcard while the signing happens on the device. Used that way, the private key never touches the phone. On its own, though, BlueWallet is a software wallet on an internet-connected phone, and our rubric caps that at 84 for key security. It scores 82, about level with Electrum.

Open source, but not verified

The full app has been on GitHub under the MIT licence since January 2018, and releases are frequent (version 8.0.2 shipped on 6 October 2026). That lets anyone read the code. It does not show that the store build is the same code: WalletScrutiny's current verdict is "source available", not reproducible, and Apple builds cannot be reproduced at all. Version 8.0.2 added tooling for reproducible Android builds; until an outside party confirms a match, we keep the score where it is.

We found no published security audit. BlueWallet's security policy is a single email address for reports, with no paid bounty, and we found no GitHub security advisory or CVE for the app. Transparency scores 68, below Electrum (78), whose Android build WalletScrutiny verifies.

Fake BlueWallet downloads

The main way people lose money with BlueWallet is a copy of it. On 1 June 2026 Malwarebytes reported a fake site, update-bluewallet[.]com, that downloaded a "BlueWallet Installer" script for Mac and told visitors to run it in Script Editor. The malware stole saved passwords and wallet files, faked a System Preferences password prompt and swapped copied bitcoin addresses for the attacker's. Malwarebytes said BlueWallet itself was not compromised, so this does not count against the security record.

BlueWallet has no warning for phishing sites or poisoned addresses. Being Bitcoin-only removes the token-approval tricks that empty Ethereum wallets, and coin control lets you choose exactly which coins you spend. Scam protection scores 65.

Privacy and the company behind it

There is no account and no ID check. The privacy policy says the company collects as little as possible and cannot read your encrypted storage; anonymous analytics and crash reports can be switched off in settings. The apps are published by Bluewallet Services, S. R. L., and the team describes itself as "a collective of developers and designers", with few other details. By default the app asks BlueWallet's own Electrum server about your addresses, so that server can link them to your IP address. Connecting your own node avoids that.

How to stay safe with BlueWallet

1. Install from the App Store, Google Play or bluewallet.io only. BlueWallet never asks you to run a script or an "update" from a website.
2. Turn on Password Protected and write the recovery phraseSeed phraseA list of 12 to 24 words that can restore a crypto wallet and all its funds. Anyone who has it controls the wallet.More in the glossary on paper or metal.
3. After pasting an address, compare the first and last characters with the original.
4. Keep savings on a hardware walletHardware walletA small dedicated device that stores crypto private keys offline and signs transactions inside the device, so the keys never touch your computer.More in the glossary and use BlueWallet as its watch-only companion, or set up a multisigMultisigA crypto wallet that needs approval from several keys to move funds, for example any 2 of 3, rather than from a single key.More in the glossary vault.
5. Connect your own node if you do not want BlueWallet's server to see your addresses.

How we scored it

The security record (90) is BlueWallet's strongest factor: no loss traced to its code, releases or servers since 2018. Key security (82) is close to the software-wallet ceiling. Transparency (68) is the weakest, because open code without an audit, bounty or verified build is hard to check. BlueWallet scores close to Trezor (83) on the overall number, but a hardware walletHardware walletA small dedicated device that stores crypto private keys offline and signs transactions inside the device, so the keys never touch your computer.More in the glossary is the safer place for savings because its keys never sit on a phone.