Simple

Is Simple safe?

Simple is easy to use and has no known security incident, but it asks for more trust than most wallets we score. It is a mobile wallet from Simple Europe UAB, a Lithuanian company, built on 2-of-2 MPCMPC walletA crypto wallet that splits the private key into several shares held in different places, so no single device or company holds the whole key.More in the glossary: one key share on your phone, the other on Simple's servers, with no seed phraseSeed phraseA list of 12 to 24 words that can restore a crypto wallet and all its funds. Anyone who has it controls the wallet.More in the glossary. The code is closed, nothing about it has been audited in public, and the recovery system relies on your email account. We score it 54/100, a D, with low confidence because so little can be checked.

That score is not a finding that Simple is unsafe. It reflects that the main protections other wallets offer, open code, published audits, a bug bounty and a standard seed you can take anywhere, are missing or only partly in place.

How does Simple's MPC wallet work?

According to Simple's terms, your private key is never created in one piece. A "Private Key Share #1" is managed by Simple and a "Private Key Share #2" lives on your device, and transactions are signed jointly without the full key ever being assembled. That has real advantages: a thief who steals your phone, or a hacker who breaches Simple's servers, gets only half of what is needed. And there is no 12-word phrase for scammers to talk you out of.

The trade-off is dependence. As long as you use Simple, every transaction needs Simple's server to co-sign. Simple cannot spend your funds on its own, so it is not custodial in the legal sense, but you cannot spend them without Simple either. Our rubric puts that model in the 50–69 band for key management, provided a documented export path exists, and we score it 55.

Can you leave Simple and keep your crypto?

Yes, in the app, though Simple's own documents disagree on the details. A help article published in September 2026 describes a self-service export under Settings, Security, Export private keys. You confirm with your PIN and possibly an email code and face check, then reveal separate keys for EVM networks (which also cover TRON, XRP and Litecoin), Solana and Stellar, Bitcoin, and TON. The article says your Simple wallet keeps working afterwards.

Simple's terms, effective 21 August 2026, are stricter. They say Simple "may" provide an export mechanism and that a completed export closes your account permanently. They also say that if Simple ends the agreement, you would have to rely on your backup or "other means" to reach your funds, even though the backup only holds your own share. We would like to see the terms match the help article and promise that export stays available, including if the company winds down.

Your recovery code lives in your email

Recovery replaces the seed phraseSeed phraseA list of 12 to 24 words that can restore a crypto wallet and all its funds. Anyone who has it controls the wallet.More in the glossary. When you create a wallet, Simple generates a 16-character recovery code, stores it in your phone's secure storage and in iCloud Keychain on iPhone, offers a backup to a private Google Drive folder, and emails it to you as text and a QR code. The terms also describe an optional Face Check, which compares your face with an earlier enrolment, and Support Recovery by email, which Simple says is not guaranteed to work.

The email copy is convenient and is the weak point. Sign-in also starts with your email address and a one-time code, so someone who takes over your inbox may get much of the way into your wallet. Treat your email account as part of your wallet's security.

Scam protection, transparency and privacy

We found no description of transaction simulation, malicious-address warnings or approval checks in Simple's terms or help centre, so scam protection scores 45. Simple's narrower design, focused on sending, receiving, swaps through partners such as Changelly and a card, involves fewer risky contract signatures than a browser wallet like MetaMask, but that is not a defence against a poisoned address or a fake support agent.

Transparency is the weakest factor at 25. There is no public source code, no published audit and no bug bounty we could find. The security page, last updated in May 2022 and written for the old custodial service, says measures are tested and audited "regularly" without naming an auditor.

On privacy, the App Store label says Simple may use location data to track you across apps and websites owned by other companies, which is unusual for a wallet. Simple's custodial arm, Stored Assets Ltd in Bulgaria, stopped custodial services on 30 June 2026 and is in withdrawal-only mode. We mention it as history; it is not part of this score. The IBAN account and Mastercard in the app now come from Unlimit EU Limited, an electronic moneyE-moneyMoney held as a stored balance with a payment firm rather than as a bank deposit. It is safeguarded, not covered by deposit insurance.More in the glossary institution licensed by the Central Bank of Cyprus (licence 115.1.3.7). Euros in that account are e-money safeguardedSafeguardingThe legal duty of payment and e-money firms to keep customer money separate from their own, so it can be returned if the firm fails.More in the glossary under Cypriot rules, not covered by deposit insuranceDeposit insuranceA government-backed scheme that repays bank customers up to a set limit if their bank fails, such as the FDIC in the US or the FSCS in the UK.More in the glossary, and sit outside your self-custodySelf-custodyHolding crypto in a wallet where you alone control the private keys, rather than leaving it with an exchange or another company.More in the glossary wallet.

How to stay safe with Simple

1. Secure your email first: unique password, two-factor authenticationTwo-factor authenticationSigning in with a second proof of identity on top of your password, such as a code from an app, a security key or a passkey.More in the glossary or a passkeyPasskeyA way to sign in without a password. Your device holds a key tied to one website or app and unlocks it with your fingerprint, face or PIN.More in the glossary. It holds your recovery code.
2. Complete Simple's security checklist, including the Google Drive backup and verifying the recovery code from the email.
3. Learn where the private key export is, and if you ever need to leave, export while the service is running. Never screenshot a key.
4. Simple support will never ask for a key or code. Anyone who does is impersonating them.
5. For larger savings, use a hardware wallet such as Ledger, where you hold the only key.

How we scored it

Security record (78) is Simple's strongest factor, since no losses have been reported, but with under 3 years of wide use it could not score above 80. Transparency (25) is the weakest, with closed code, no audit and no bounty, and key management (55) reflects a vendor-held key share with an export path that the terms describe less firmly than the help centre does.