Cake Wallet +10 −0 (10 positive, 0 negative reviews)
Wallet
Websitecakewallet.com
1 more domain
- Additional addressgithub.com/cake-tech/cake_wallet
Directory
Wallets
Bitcoin wallet software with privacy features: coin control, CoinJoin and Tor.
Check your wallet version against known vulnerabilities. Sources are linked. “No known issue” doesn’t mean safe.
Entries
Monerujo +1 −0 (1 positive, 0 negative reviews)
Wallet
Websitewww.monerujo.io
2 more domains
- Additional addressgithub.com/m2049r/xmrwallet
- Domain aliasmonerujo.io
No known vulnerable versionsLatest: 4.1.7
Wasabi Wallet +1 −0 (1 positive, 0 negative reviews)
Bitcoin, CoinJoin
Safe: 2.8.2 or newerLatest: 2.8.4
4 known issues
- WVE-002: macOS clipboard paste corrupted complex passwords (loss of access to funds) fixed in 1.1.7
- WVE-005: blind Schnorr nonce reuse allowed hard-to-attribute CoinJoin DoS fixed in 1.1.12
- WabiSabi coordinator credential-issuer tagging (deanonymization by malicious coordinator) fixed in 2.3.0.0
- Coinjoin clients did not verify other participants' inputs (coordinator-fabricated coins) fixed in 2.8.2
Copay
Bitcoin, Multisig
Websitecopay.io
Safe: 5.2.0 or newerLatest: 12.0.5
1 known issue
- Malicious event-stream dependency stole wallet keys fixed in 5.2.0
Edge +0 −0 (0 positive, 0 negative reviews)
Wallet
Websiteedge.app
1 more domain
- Additional addressgithub.com/EdgeApp/edge-react-gui
Safe: 3.3.1 or newerLatest: 4.51.3
1 known issue
- Private keys logged to disk and uploaded via 'Upload Logs' fixed in 3.3.1
Electrum
Bitcoin, Lightning
Websiteelectrum.org
Safe: 4.8.2 or newerLatest: 4.8.2
10 known issues
- OpenAlias DNSSEC verification was broken (payments to DNS names not trustworthy) fixed in 2.4
- JSON-RPC vulnerability: websites could run wallet commands (theft from wallets without a password) fixed in 3.0.5
- Malicious servers could show fake “update” error messages (phishing for malware installs) fixed in 3.3.3
- BIP70 payment requests could make Electrum open arbitrary local files fixed in 4.2.2
- Android: Lightning payment proof not checked, so a channel peer could steal a payment fixed in 4.4.0
- Lightning: a partial multi-part payment could be accepted fixed in 4.4.6
- External plugin authorization bypass (local code execution) fixed in 4.7.2
- Nostr Wallet Connect plugin: daily spending limit bypass fixed in 4.7.2
- SPV proof check accepted duplicated Merkle branches (CVE-2012-2459) fixed in 4.8.0
- Security fixes without published details (4.8.1 and 4.8.2 security updates) fixed in 4.8.2
Feather Wallet +0 −0 (0 positive, 0 negative reviews)
Wallet
Websitefeatherwallet.org
1 more domain
- Additional addressgithub.com/feather-wallet/feather
Monero CLI +0 −0 (0 positive, 0 negative reviews)
Node
Websitewww.getmonero.org/downloads/
2 more domains
- Additional addressgithub.com/monero-project/monero
- Domain aliasgetmonero.org
Safe: 0.18.4.2 or newerLatest: 0.18.5.3
13 known issues
- Key image torsion bug allowing undetectable double-spends (CryptoNote) fixed in 0.10.2
- Multiple counting bug: wallet over-reports incoming amounts fixed in 0.12.3.0
- Burning bug: wallet did not warn about burnt outputs to reused stealth address fixed in 0.12.4.0
- Epee Levin deserialization remote code execution (TALOS-2018-0637)
- Compromised CLI binaries served from getmonero.org
- Decoy selection bugs reduce sender privacy fixed in 0.17.2.3
- get_output_distribution DoS on restricted RPC fixed in 0.17.3.0
- Multisig wallet creation and signing vulnerabilities fixed in 0.18.0.0
- 10-block-old decoy selection off-by-one bug fixed in 0.18.2.2
- HTTP server lacks response limits (remote RPC crash) fixed in 0.18.4.0
- Remote P2P crash vulnerability in daemon fixed in 0.18.4.0
- --anonymous-inbound data leak fixed in 0.18.4.0
- find_and_save_rings() leaks outgoing TXIDs to remote node fixed in 0.18.4.2
Monero GUI +0 −0 (0 positive, 0 negative reviews)
Wallet
Websitewww.getmonero.org/downloads/
2 more domains
- Additional addressgithub.com/monero-project/monero-gui
- Domain aliasgetmonero.org
Safe: 0.18.4.2 or newerLatest: 0.18.5.3
5 known issues
- Embedded RPATH includes '.' allowing library hijack (Linux) fixed in 0.17.1.0
- Decoy selection bugs reduce sender privacy fixed in 0.17.2.3
- 10-block-old decoy selection off-by-one bug fixed in 0.18.2.2
- Bundled daemon network vulnerabilities (P2P crash, RPC crash) fixed in 0.18.4.0
- find_and_save_rings() leaks outgoing TXIDs to remote node fixed in 0.18.4.2
Monero.com by Cake Wallet +0 −0 (0 positive, 0 negative reviews)
Wallet
Websitemonero.com
1 more domain
- Additional addressgithub.com/cake-tech/cake_wallet
No known vulnerable versionsLatest: 6.4.6
Sparrow Wallet +0 −0 (0 positive, 0 negative reviews)
Bitcoin, Wallet, Coin control
No known vulnerable versionsLatest: 2.5.5
Stack Wallet +0 −0 (0 positive, 0 negative reviews)
Wallet
Websitestackwallet.com
1 more domain
- Additional addressgithub.com/cypherstack/stack_wallet
No known vulnerable versionsLatest: 2.7.1
No matching entries. Reset filters or broaden the pair / fee / coin constraints.
Hardware wallets
Trezor One
Hardware wallet
Websitetrezor.io
Safe: 1.14.1 or newerLatest: 1.14.1
22 known issues
- Malicious ScriptSig in signed transaction fixed in 1.3.1
- Malicious change in mixed (multisig) transactions fixed in 1.3.1
- Private key extraction via power analysis (oscilloscope) fixed in 1.3.3
- Secret leak via SRAM residue fixed in 1.5.2
- STM32F205 bootloader write-protection issue fixed in 1.6.1
- Buffer overflow in USB message processing fixed in 1.6.2
- Stack overflow (race condition) in recovery fixed in 1.6.2
- MPU circumvention via SYSCFG registers fixed in 1.6.3
- Buffer overflow in bech32_decode / cash_decode fixed in 1.7.1
- Information leak via U2F (Yubico reference struct) fixed in 1.7.2
- Side-channel analysis of PIN comparison fixed in 1.8.0
- SRAM dump via glitching the firmware update fixed in 1.8.0
- Secret leak via USB descriptors (fault injection) fixed in 1.8.0
- OLED display power side channel fixed in 1.8.2
- BIP-143 two-Segwit-transaction large fee attack fixed in 1.9.1
- Missing path isolation check fixed in 1.9.2
- Insufficient protobuf field size check (Stellar) fixed in 1.10.3
- Broken stack-smashing protection (faulty stack canary) fixed in 1.9.4
- Soft-lock bypass fixed in 1.11.1
- Key extraction in CoSi collective signing fixed in 1.11.2
- Non-constant-time BIP-39 processing after unlock
- Standard Recovery padding weakness with 12/18-word seeds fixed in 1.14.1
Trezor Model T / Safe 3 / Safe 5
Hardware wallet
Websitetrezor.io
Safe: 2.12.5 or newerLatest: 2.12.5
21 known issues
- Malicious change in mixed (multisig) transactions (2019) fixed in 2.1.8
- Monero unlock_time not shown on device fixed in 2.3.0
- OP_RETURN output treated as change fixed in 2.3.0
- Malicious change in mixed transactions (2020, multisig TOCTOU) fixed in 2.3.0
- Insufficient protobuf field size check (prevhash) fixed in 2.3.0
- Inconsistent sanitization of transaction inputs fixed in 2.3.0
- BIP-143 two-Segwit-transaction large fee attack fixed in 2.3.1
- Broken stack-smashing protection (faulty stack canary) fixed in 2.3.5
- Coin loss via replacement transactions with multisig/external inputs fixed in 2.5.1
- Missing confirmation in ECDHSessionKey (Safe 3) fixed in 2.6.4
- Non-constant-time BIP-39 processing after unlock fixed in 2.10.0
- Bug in multisig verification (malicious fee bump) fixed in 2.11.0
- Ethereum calldata confirmation-binding flaw fixed in 2.11.0
- EIP-712 domain spoofing via double-fetch fixed in 2.12.0
- Solana ALT recipient confirmation mismatch fixed in 2.12.0
- Solana account type misclassification fixed in 2.12.0
- Lock bypass with SD-protect-only configuration fixed in 2.12.1
- Missing output confirmation in Bitcoin replacement (RBF) transactions fixed in 2.12.2
- Unverifiable external inputs not rejected in CoinJoin signing fixed in 2.12.2
- Solana token-transfer recipient spoofing via lookup table fixed in 2.12.2
- 2.12.5 security fixes: Ethereum transfers in swaps/staking, hidden Solana stake lockup, Stellar signing details fixed in 2.12.5
BitBox02
Hardware wallet
Websitebitbox.swiss
Safe: 9.26.5 or newerLatest: 9.27.1
9 known issues
- SegWit double-signing excessive-fee attack (Saleem Rashid / BIP-143) fixed in 8.0.0
- Fee attack variant: previous-output index not checked fixed in 9.15.0
- BitBox02 Nova secure-chip config: unlock-attempt limit bypass (Kozlik) fixed in 9.25.0
- USB request buffer out-of-bounds write (firmware + bootloader) fixed in 9.26.2
- Self-transfer display text manipulation fixed in 9.26.3
- Ethereum EIP-712 chain ID confirmation bypass fixed in 9.26.3
- Ethereum EIP-712 display line spoofing fixed in 9.26.3
- Memory corruption on uninitialized Multi devices (malicious host) fixed in 9.26.5
- Silent Payments output manipulation (funds lockable) fixed in 9.26.5
COLDCARD Mk1–Mk3
Hardware wallet
Websitecoldcard.com
Safe: 4.2.0 or newerLatest: 4.2.0
4 known issues
- Weak seed generation (RNG fell back to software PRNG) - Mk2/Mk3 fixed in 4.2.0
- Multisig wallet registration did not verify device is a cosigner (Mk2/Mk3) fixed in 3.2.1
- Multisig PSBT tampering by MitM (Mk2/Mk3) fixed in 3.0.6
- BIP-143 SegWit input amount replay (fee) attack (Mk2/Mk3) fixed in 3.1.4
COLDCARD Edge (X / QX)
Hardware wallet
Websitecoldcard.com
Blockstream Jade
Hardware wallet
Websiteblockstream.com/jade
Safe: 1.0.37 or newerLatest: 1.0.41
1 known issue
- register_descriptor RPC stack overflow (DARKNAVY) fixed in 1.0.37
KeepKey
Hardware wallet
Websitekeepkey.com
Safe: 7.7.0 or newerLatest: 7.14.1
12 known issues
- Format string bug exposes information via unsupported font characters
- STM32F2 write-protection flaw allowed unsigned code execution (bootloader hotpatch) fixed in 5.1.0
- USB receive buffer overflow/underflow in usb_rx_helper (VULN-1814) fixed in 5.5.0
- Integer overflow in USB packet handling (v6.0.0 release note) fixed in 6.0.0
- USB packet handling out-of-bounds write (.bss) reachable via WebUSB fixed in 6.2.2
- Recovery state-machine flaw allows partial reset of secrets (breaks U2F) fixed in 6.2.2
- Ethereum THORChain swap data stack buffer overflow fixed in 7.1.0
- Faulty stack canary from GCC bug (VULN-21013) fixed in 7.1.2
- Fault-injection bypass of firmware memory protections (VULN-21020) fixed in 7.1.7
- U2F confirmation could be auto-accepted by held button (VULN-22003) fixed in 7.3.2
- Bootloader supervisor-interface flaws allow malicious firmware to overwrite bootloader fixed in 7.3.2
- Ethereum contract confirmation global buffer overflow leaks memory / seed fixed in 7.7.0
Data sheet
| Name | Reviews | Live status | Website | Tor Site | Coins | Platform | Tags |
|---|---|---|---|---|---|---|---|
| Cake Wallet | +10 −0 (10 positive, 0 negative reviews) | Online |
| None |  XMR BTC LTC ETH | Mobile, Desktop | Wallet |
| Monerujo | +1 −0 (1 positive, 0 negative reviews) | Online |
| None | XMR | Mobile | Wallet |
| Wasabi Wallet | +1 −0 (1 positive, 0 negative reviews) | Online |
| None | BTC | Desktop | Bitcoin, CoinJoin |
| Chaincase | +0 −0 (0 positive, 0 negative reviews) | Online |
| None | BTC | Mobile | Bitcoin, Wallet, Mobile |
| Copay |
| None | BTC BCH | Desktop, Mobile | Bitcoin, Multisig | ||
| Edge | +0 −0 (0 positive, 0 negative reviews) | Online |
| None | XMRBTCETHLTCDOGE | Mobile | Wallet |
| Electrum |
| None | BTC | Desktop, Android | Bitcoin, Lightning | ||
| Feather Wallet | +0 −0 (0 positive, 0 negative reviews) | Online |
| None | XMR | Desktop | Wallet |
| Monero CLI | +0 −0 (0 positive, 0 negative reviews) | Online |
| None | XMR | CLI | Node |
| Monero GUI | +0 −0 (0 positive, 0 negative reviews) | Online |
| None | XMR | Desktop | Wallet |
| Monero.com by Cake Wallet | +0 −0 (0 positive, 0 negative reviews) | Online |
| None | XMR | Mobile | Wallet |
| Sparrow Wallet | +0 −0 (0 positive, 0 negative reviews) | Online |
| None | BTC | Desktop | Bitcoin, Wallet, Coin control |
| Stack Wallet | +0 −0 (0 positive, 0 negative reviews) | Online |
| None | XMRBTCBCHLTCDOGEFIROEPICNMCWOW | Mobile, Desktop | Wallet |