Exodus

Is Exodus safe?

For holding your own keys, mostly yes. Exodus has run as a desktop and mobile wallet since 2016 without a loss we could trace to its own code, it generates a standard 12-word secret key on your device, and the company behind it files audited accounts with the SEC. We score it 74/100, a B. The catches are that nobody outside Exodus can inspect the app, and that it does little to stop you signing something harmful.

Exodus Movement, Inc. is listed on NYSE American under EXOD and reported about 1.4 million monthly active users in mid-2026. It is going through changes: in May 2026 it took over the card companies Baanx and Monavate through UK receivers, and in July it cut about 25% of its staff to focus on payments. Neither touches how your keys are stored, but it is worth knowing who you rely on for updates.

Where Exodus keeps your keys

When you create a wallet, your device generates the 12-word secret key and Exodus encrypts the keys locally with your password. The company says it has no access to them, and its annual report states that private key data is not retained by Exodus. Lose the device and the 12 words are your way back; Exodus support cannot help.

On mobile you can add a second backup: the secret key is encrypted and stored as a file in iCloud or Google Drive, and only a passkeyPasskeyA way to sign in without a password. Your device holds a key tied to one website or app and unlocks it with your fingerprint, face or PIN.More in the glossary from your passkey manager can decrypt it. That is a reasonable design, but it makes your Apple or Google account part of your wallet security. Wallets created before February 2019 may also have an old email backup link; Exodus explains how to handle it in its help centre.

The 12 words work in other wallets, so leaving is easy, and Exodus documents what to do if it shuts down. Because keys sit on an internet-connected phone or computer, our rubric caps this factor at 84. It scores 78, close to Coinbase Wallet at 76.

The better option for savings is to connect a hardware walletHardware walletA small dedicated device that stores crypto private keys offline and signs transactions inside the device, so the keys never touch your computer.More in the glossary. Exodus supports Trezor devices on desktop and mobile, including the Safe 7 over Bluetooth, and Ledger on mobile. Keys then stay on the device and you approve each transaction on its screen.

Is Exodus open source?

No, and this is the biggest weakness. WalletScrutiny asked Exodus about its source code and was told the wallet "is and stays closed source", so the apps on Android and iOS cannot be verified. Exodus publishes some building blocks on GitHub and runs a HackerOne bug bounty with rewards from $100 to $100,000 for its desktop wallet and websites. We found no published third-party audit of the wallet itself. Transparency scores 50, below Phantom (55) and Coinbase Wallet (60), and well above Atomic Wallet, another closed-source desktop and mobile wallet whose 2023 losses were never explained.

The bounty page is unusually frank. It lists known issues Exodus will not pay for again, among them incomplete redaction of recovery phrases in error messages and browser address-bar spoofing, which it says it plans to patch. Publishing that is better than hiding it, but those are not small items for a wallet.

Fake Exodus apps and phishing

Most Exodus users who lose money meet a copy, not the real app. In February 2024 an app calling itself Exodus, from a publisher named "Movement Exod", appeared in Canonical's Snap Store. One user who restored his wallet in it lost about 9 BTC, then worth roughly $490,000, according to Linux Magazine. The fake came from outside Exodus's channels, so it does not count against the security record, and Canonical later added manual reviews.

Exodus's help centre lists the official download links and explains how to check desktop installers against PGP-signed release hashes. Fake support agents asking for the 12 words remain the most common trap.

Does Exodus protect you from drainers?

Partly. Mobile warns you before sending to an address flagged for malicious activity, and both apps can detect when a scam has changed the owner or permissions of an address (a known trick on Solana) and then lock the wallet and push you to move funds. Exodus also dropped WalletConnect, so it connects to fewer dApps than browser wallets do, which narrows the attack surface. We found no documentation of transaction simulation or approval checks of the kind MetaMask and Phantom show by default, so scam protection scores 65.

How to use Exodus safely

1. Download only from exodus.com/download or the official App Store and Google Play listings, and check desktop installers against the signed hashes.
2. Write the 12 words on paper or metal. Use the passkeyPasskeyA way to sign in without a password. Your device holds a key tied to one website or app and unlocks it with your fingerprint, face or PIN.More in the glossary backup as a second copy, not the only one.
3. Never type the 12 words into a website, form or chat. Exodus support never asks for them.
4. Keep larger amounts on a Trezor or Ledger connected to Exodus.
5. Treat any request to "approve" or "change permissions" with suspicion, since the app will not simulate it for you.

How we scored it

Security record (88) and company record (85) are Exodus's strongest factors: about ten years without a loss traced to its own software, run by a company that reports to the SEC and collects little data in its app. Transparency (50) is the weakest, because the code is closed and no audit is published, and scam protection (65) trails wallets that simulate transactions.