Where your keys live, and who can reach them

Your keys are made on your phone

When you create a wallet, OB Wallet makes your recovery phrase on the phone. Every address in the app, on EVM chains, Bitcoin, Tron, Solana and TON, comes from that one phrase.

There is no copy on our servers. There is no account to hold one: no email, no phone number, no sign-up.

Encrypted under a key the phone keeps in hardware

The recovery phrase is never stored as plain text. It is encrypted with XChaCha20-Poly1305 under a key that lives in Android Keystore: in the StrongBox security chip where the phone has one, otherwise in the phone's trusted execution environment. That key cannot be copied out of the hardware.

That key is tied to your phone's screen lock: Android releases it only after you prove it is you, so a stolen phone is a brick rather than a wallet. A memory-hard function (Argon2) stands between a guessed passphrase and the vault, so trying passwords one after another is not worth running. Someone who copies the phone's files gets only encrypted data.

Transactions are signed on the device

Keys are derived and transactions are signed in a small core written in Rust, on the phone. The key goes from the hardware to that core and nowhere else: it never passes through the app's screens, and the core wipes it from memory as soon as it is done.

The core is licensed Apache-2.0 and will be published so anyone can audit it. Until it is, this page describes it; it is not yet proof you can check.

Guards against the common scams

Look-alike addresses: scammers plant addresses that start and end like the ones you pay. On the confirmation screen, OB Wallet warns you when the address starts and ends like a saved contact or an address you have paid, but the middle is different. You can check any Tron or Ethereum address on the web too, at /check.

The app blocks screenshots and screen recording, so your recovery phrase does not end up in a photo library or a cloud backup by accident.

What we cannot do

We hold no keys and no funds, so we cannot freeze your money, close your wallet or stop a transfer. For the same reason we cannot recover a lost recovery phrase. Write it down and keep it somewhere safe: with the phrase you can restore the wallet on a new phone; without it, nobody can.

Card purchases are carried out by licensed payment providers under their own terms; the crypto they sell goes straight to your own address.

Report a security flaw

Email ob@obolium.com with the subject "Security disclosure". Please say what you found, how to reproduce it and which app version you used, and give us reasonable time to fix it before you publish. Our contact details are also at /.well-known/security.txt.