Wallet Logo

Blockchain Wallet

latest release: 21 last analysed  30th November 2020
Obfuscated
4.8 ★★★★★
1269 ratings
50thousand

Published:

Our last analysis is based on data found in their Google Play description .
details below 

Do your own research!

Try out searching for "lost bitcoins", "stole my money" or "scammers" together with the wallet's name, even if you think the wallet is generally trustworthy. For all the bigger wallets you will find accusations. Make sure you understand why they were made and if you are comfortable with the provider's reaction.

The Analysis

This app is … a game … turned into a tool to collect your blockchain.com wallet credentials?

We decompiled the app and found no single mention of “bitcoin” or “wallet” but we found “Level0” to “Level6”, “globalgamemanagers”, some obfuscated classes in the “unity3d/player” folder and assume the form where it asks you for your credentials is being loaded from a remote server upon app start as none of the elements of the main screen can be found in the source code.

Some obfuscated code example:

public final class l {
    private static boolean a = false;
    private boolean b = (!h.c);
    private boolean c = false;
    private boolean d = false;
    private boolean e = true;

    l() {
    }

    static void a() {
        a = true;
    }

    static void b() {
        a = false;
    }

    static boolean c() {
        return a;
    }

    public final void a(boolean z) {
        this.c = z;
    }

    public final void b(boolean z) {
        this.e = z;
    }

That’s typical minification. Lengthy, self-explanatory names get converted into short symbols.

In summary: Do not share your blockchain.com credentials with this app! You will lose your funds! This app is 100% for sure not related to blockchain.com.

Verdict Explained

Obfuscated
The app on Google Play contains active obfuscation which makes it significantly harder to analyze what it is doing.

This verdict means that the app on Google Play could not be decompiled. In benign cases code symbols are replaced by short strings to make the app smaller but for the sake of transparency this should not be done for non-reproducible Bitcoin wallets. (Reproducible wallets could obfuscate the app for size improvements as the reproducibility would assure the auditability.)

The app cannot be independently verified. If the provider puts your funds at risk on purpose or by accident, you will probably not know about the issue before people start losing money. If the provider is more criminally inclined he might have collected all the backups of all the wallets, ready to be emptied at the press of a button. The app might have a formidable track record but out of distress or change in management turns out to be evil from some point on, with nobody outside ever knowing before it is too late.