WalletScrutiny / WalletScrutiny is on Nostr

Know your wallet like you made it!

Our goal is to improve the security of Bitcoin wallets by examining products for transparency and potential attacks.

Last Notes

2026-08-17 10:17:10 UTC

- reply

"Coldcard being open source didn't prevent keys from being stolen" fails on the premise. Coldcard has not been Open Source since 2020. OSI defines the term. MIT plus Commons Clause is not Open Source. Coinkite dropped GPLv3 deliberately, to stop commercial forks, and their own marketing retreated to "verifiable" after much fighting.
You know well, the March 2021 commit that purged the last GPL code replaced battle-tested Trezor crypto libraries with a novel in-house library. Seed generation changed in that same commit. Escaping FOSS obligations and introducing the flaw were the same act.
And who found it, five years later? Not Coinkite. Outsiders reading public source, quite possibly with LLM assistance. That cuts both ways and it's the part that should get Casa listening. Models are getting good at finding bugs in binaries, too. Black hats already analyze your closed source app. Publishing source doesn't hand them anything they can't increasingly get themselves. It's the white hats, who won't touch proprietary code for legal and practical reasons, that closed source locks out. Security through obscurity now selects for the adversary.

2026-06-29 16:16:20 UTC

- reply

There must be people who now run bip110 with no clue about the consequences cause it was a one click install side by side with other full nodes.

2026-06-29 11:20:12 UTC

BIP110 is heading towards "mandatory signalling" around August 7th with so far 3‰ miner support. How should we deal with this?
Bitcoin isn't a democracy. My node, my rules. To say "miners decide" misses how bitcoin works.
So ... at what point should we warn users about transactions executing on two blockchains? Bip110 users will see "0 confirmations" on their transactions long after they confirmed on the Core side.
But do Core users also need a warning? When and how? Clearly if bip110 would get close to 20% mining support, things would get dicey but now ...

2026-04-30 13:05:21 UTC

We went eagerly to work to analyze this fancy new version of the Bitkey. Sadly our verdict is "no source" as the firmware *cannot be built from the source provided* as one *closed source dependency* is not included in their source code.
In theory they could remedy this in a firmware update.
#nevent1q…s9wd

2026-04-28 07:41:14 UTC

- reply

The text contradicts the video ;) 100% more is twice as much than before, right? Anyway, lack of a screen was the deal breaker for us on the initial Bitkey, putting it into the verdict "no interface to approve transactions". With a screen that should not be the case anymore.
https://walletscrutiny.com/hardware/blockhww/

2026-03-03 20:11:50 UTC

Feature filters are live now!
For example, here are all the lightning wallets we are listing:
https://walletscrutiny.com/?query-string=f:ln

2026-02-28 19:51:35 UTC

Playing with new features is fun. This one required to review 1300 products for a list of 27 features which LLMs can do in an hour citing sources. How do you like it? Should we put it live?
https://video.nostr.build/7eeb513ebf322a31144e212a927ce3570bd8c6bfd497d551df65fe8513471e67.mp4
https://image.nostr.build/d6ed43627cb640d296e0ec68f46f038e46f6cb602c9785574fb73dd693c9dcd3.png

2026-02-27 00:42:22 UTC

#nevent1q…p2j2
We will also ask for those juicy tokens although our repo is abysmally starred. We use GitLab after all ...
If you want to support us, star our GitHub mirror anyway, please!
https://github.com/WalletScrutiny/WalletScrutinyCom

2025-12-13 19:36:53 UTC

https://files.nostr.info/e49c77eb6801d69b0499b7b9fa5de05a502ec1d05b72a28c84e99196564743e7.png
WalletScrutiny turned 6!
We've come a long way over the years. In the beginning, we only looked into Android wallets - 40 of them - and now we've grown to more than 6000 products across many platforms. Your favorite hardware wallet? We got you covered. Desktop? Probably, too. And desktop is a lot of work as here we found many open source and reproducible products!

2025-09-06 12:18:56 UTC

We’ve been busy but quiet these last months. @npub1qw6…4882 improved the site a lot by adding new features around #nostr based build verifications.
We hope other projects in the nostr ecosystem like @npub1wf4…dgh9 @npub10r8…t2p8 will see the value of these verifications and start integrating them. The more products that build on reproducibility, the more users can truly apply the principle of “Don’t trust - verify.” Binary transparency shouldn’t remain a niche feature - it needs to become the default.
If you run software that touches your private keys - be it nostr clients or bitcoin wallets - without binary transparency, only whoever built the binary really knows what code you’re running.
https://files.nostr.info/f541e0eac3777d04aa0df5a70e623ca784eac29e208f20828d8b084493c0a76b.png
@npub1r70…sf7d and @npub1vf6…t9ys checked the reproducibility of almost 300 binaries. The 304 verifications by @nprofile…54vv are all the old verifications we had migrated to nostr. And the backlog keeps growing as we cover more and more products with frequent updates.
Are we doing something valuable for the space? A @npub1spr…8s72 grant says yes, and community endorsements confirm it - but the project itself also needs scrutiny.
We recently introduced "verification endorsements":
https://files.nostr.info/1df1964ded1bec6109f672f5eaf0b5ca1f5e7bb9a6bdd193682d22aad3c05e0f.png
This is a simple contribution many could provide. If you read a verification and it looked plausible and complete and you trust the author, mark the verification as verified. If you ran the documented commands yourself on your hardware and got to similar results, please endorse the verification!
Even more importantly label verifications as invalid and leave a comment about what's missing when you find issues! Don't be shy!
Our goal is to document all steps such that all mildly technical users (you should be comfortable with a Linux shell) can reproduce our findings. If that's not the case, please provide your feedback and we will improve ✋.
And if you maintain one of the products we check, share your own verification as a template for others!

2025-09-06 10:28:38 UTC

- reply

That mention was missing a space in the end:
@nprofile…tygu

2024-07-10 01:28:24 UTC

- reply

The designs look repetitive but the chosen materials appear to not always be clearly advertised. Maybe educated guesses are good enough if people ask about any particular new device.

2024-07-09 19:38:30 UTC

Not all metal backups are made equally. If you use metal to not have to also worry about your bitcoins when your house is on fire, don't use this product:
https://jlopp.github.io/metal-bitcoin-storage-reviews/img/devices/ellipal_metal_hot.jpeg
But running these tests must have been great fun, right @npub17u5…t4tp?
If we add these backup solutions to our website, we would certainly heavily lean on Jameson Lopp's work as a hydrolic press and acids isn't what we had planned to play around with ourselves for now.
Jameson are you planning to test more products any soon? Adding "backup tools" to WalletScrutiny might get excessive if we don't draw lines like you did. If it's not at least claiming to be heat resistant, we won't bother to list it or else we end up listing a million different ways to print on paper.

2024-07-08 20:02:13 UTC

- reply

Stay safe! Hope it all turns out well.

2024-07-03 02:25:31 UTC

Some fan art ✨ 🎶 🎶
Which one do you like best?
https://audio.nostr.build/79aad81cea8141b3fe4ec5d08319735be46420e04f45910453cf3a035ea706e4.mp3
https://audio.nostr.build/1392672adb8cb2f5752cc3241c2d38811ace25b8f5e498801a54918db243a235.mp3
https://audio.nostr.build/569718137b9d20b8c91cbc086179e7b7aab39d6c5e824294fe7324aa092584c2.mp3
https://audio.nostr.build/ec043e98cc163270ca4a66c3b3c46fe5da0695e7cb3a814e76678724a4d49e51.mp3
https://audio.nostr.build/d76cf4c1a3f59f5645a92c1a5126220468939f6ec3001ea9704718d056981541.mp3
https://audio.nostr.build/c09400bb09c8f4b894b88ff078ce28a0c15578c30b508a552f5b3c08dc4a9d41.mp3
https://audio.nostr.build/640d0512152b5edea6458e9196c108ebf32a864694ece156a1c85d36042dfb49.mp3
https://audio.nostr.build/42ddfde0e3ba5bd055d98f79fce2c7de757a4c774cddde5da1d91caf6c72e945.mp3