Wednesday 5 February 2020

PSA: Bitcoin.com's Wallet new releases do not currently have any publicly available source-code. Be very careful; do not trust them with funds you care about without this transparency


TL;DR: Bitcoin.com used to publicly release and track changes of their wallet's source code. Currently it is NOT true anymore for the most recent versions (5.x/6.x). Please be careful, trusting a closed-source/non-public source wallet is VERY risky for your funds.This wallet is mainly an altcoin focused wallet nowadays, it has multiple other flaws and serious unresolved security issues.But since it is still possible to store actual Bitcoin funds on it and it appears in the first results of a search for Bitcoin wallets (due to its name) on various App stores I've figured this post could be useful to new/unaware users.This wallet is supposedly (hard to tell without source code) still a fork of Bitpay's CoPay wallet which is under MIT License. If this is the case authors have no obligation to publicly release the source code, but up until the last couple versions it was public and tracked on this GitHub repository.Without any justification the new releases are now happening on a new GitHub belonging to apparently "bitcoin.jp", without any tracked source code in the repository and with only binaries available for download.There are compressed files named "Source code" along the releases, which are empty (only containing a meaningless README file in them). Those files could easily be there to deceive people into thinking everything is like before and that the source code is still available but it clearly is not the case.You should never use a close source wallet as it generally implies that nobody was able to independently review and audit it. Without this ability, you have no guarantee that this application is not going to leak and/or purposefully steal your private keys/seed/funds. When a wallet goes from a public open-source model to a closed source/non-public source like this wallet it is even more suspicious.I've seen Roger Ver being asked about it multiple times on r/btc and he only directed users to the new GitHub, without further comments when people pointed out there was no source code there.So please, be careful, and do NOT blindly trust this company with your funds. There are plenty of wallets that are actually open-source (with publicly available source code). via /r/Bitcoin http://bit.ly/31pPesg

No comments :

Post a Comment