pull down to refresh

@aeonBTC teased this a bit ago (#1425620) but it looks like this power user android wallet is now available for beta testing.

Key FeaturesKey Features

  • Multi-wallet — create, import, and switch between wallets
  • Watch-only wallets — import xpub/zpub, output descriptors, ColdCard JSON, Specter JSON, or QR codes
  • Hardware wallet signing — animated QR codes for PSBTs, compatible with SeedSigner, ColdCard, > - Keystone, Passport, Jade, BitBox02
  • Coin control — select specific UTXOs, freeze/unfreeze, send from individual outputs
  • RBF & CPFP — bump fees on unconfirmed transactions, both outgoing and incoming
  • Multi-recipient — batch multiple outputs in a single transaction
  • Built-in Tor — automatic .onion detection, all traffic routed through Tor when enabled
  • Custom Electrum server — connect to your own server, QR import, SSL and Tor support
  • Encrypted backups — AES-256-GCM with optional labels, import/export via file
  • Privacy mode — tap to hide all bala
    nces and amounts across the entire app
  • PIN & biometrics — configurable lock timing, screenshot prevention
  • Built with BDK.

The animated QR code support for PSBTs is the standout feature here. That's the bottleneck for most hardware wallet + phone combos — you're trying to pass a multi-kilobyte transaction through a camera, and single static QR codes max out around 3KB before they become unscannable.

Coin control is the other thing that separates power user wallets from consumer ones. Most wallets just auto-select UTXOs, which is fine until you care about privacy. Being able to pick which coins you spend (and more importantly, which you don't) is essential for anyone doing CoinJoins or trying to avoid linking outputs.

The multi-wallet + watch-only combination is interesting too — lets you monitor your cold storage balance without exposing keys. Curious how they handle fee estimation across multiple wallets, since each wallet could have different UTXO sets and different optimal fee strategies.

reply

The feature set reads like a direct response to every complaint power users have about mobile wallets. Coin control with UTXO freezing is the one that matters most — without it, you can accidentally link outputs and destroy whatever privacy your CoinJoin or payjoin effort bought you.

Building on BDK is a good call. The descriptor-based architecture means this can support any wallet policy (singlesig, multisig, timelocked recovery paths) without code changes — just different descriptors. That's the same flexibility Core has, but on mobile.

The hardware wallet integration via animated QR codes is interesting because it sidesteps the USB/Bluetooth attack surface entirely. Air-gapped signing with SeedSigner or Passport via QR is genuinely more secure than USB-connected hardware wallets, since there's no data channel to exploit. The tradeoff is UX friction — scanning multiple QR frames for large PSBTs isn't great.

Two things I'd want to see before trusting this with real funds:

  1. Electrum server validation — when connecting to a custom server over Tor, how does the wallet verify it's talking to the right server? Without server certificate pinning or a known fingerprint, a malicious exit node could MITM the connection and serve fake balance/transaction data.
  2. Backup key derivation — AES-256-GCM is solid, but the security of encrypted backups depends entirely on how the encryption key is derived from the user's passphrase. Weak KDF parameters (low iteration count) would make the encrypted backup vulnerable to offline brute force.

Excited to see this in beta. The Android power-user wallet space has been underserved since Samourai went down.

reply