Wallet Logo

Blockchain Plus Wallet v2

latest release: 1.1.1 ( 23rd April 2021 ) last analysed  2nd July 2021 Obfuscated Not functioning anymore
3.8 ★★★★★
60 ratings
1 thousand
2nd April 2021

Jump to verdict 

Do your own research!

Try out searching for "lost bitcoins", "stole my money" or "scammers" together with the wallet's name, even if you think the wallet is generally trustworthy. For all the bigger wallets you will find accusations. Make sure you understand why they were made and if you are comfortable with the provider's reaction.

If you find something we should include, you can create an issue or edit this analysis yourself and create a merge request for your changes.

The Analysis 

This app claims to be a server-less and self-custodial Bitcoin wallet. We were asked about funds disappearing on our Wallet Support chat and had a look:

There is no website.

The app is in the category “games/casino”.

The app has no way of creating a new wallet but straight asks for an “introduction or restore code” which probably is something in the original Blockchain.com Wallet: Buy BTC and entering it leaks it to the provider of this “wallet”.

It turns out this wallet is not only weird with tons of negative feedback, it’s also closed source and upon closer inspection the binary is obfuscated:

For example it’s really hard to guess what happens in this class:

public class b extends a {
    /* renamed from: c  reason: collision with root package name */
    static boolean f305c = false;

    /* renamed from: a  reason: collision with root package name */
    private final h f306a;

    /* renamed from: b  reason: collision with root package name */
    private final c f307b;

    public static class a<D> extends m<D> implements a.AbstractC0019a<D> {
        private final int j;
        private final Bundle k;
        private final a.h.b.a<D> l;
        private h m;
        private C0018b<D> n;
        private a.h.b.a<D> o;

        /* access modifiers changed from: package-private */
        public a.h.b.a<D> a(boolean z) {
            if (b.f305c) {
                Log.v("LoaderManager", "  Destroying: " + this);
            }
            this.l.a();
            throw null;
        }

With this many red flag this app is not only not verifiable but also better avoided.

Verdict Explained

The binary contains active obfuscation!

As part of our Methodology, we ask:

Is the decompiled binary legible? If not, we tag it Obfuscated!

When compiling source code to binary, usually a lot of meta information is retained. A variable storing a masterseed would usually still be called masterseed, so an auditor could inspect what happens to the masterseed. Does it get sent to some server? But obfuscation would rename it for example to _t12, making it harder to find what the product is doing with the masterseed.

In benign cases, code symbols are replaced by short strings to make the binary smaller but for the sake of transparency this should not be done for non-reproducible Bitcoin wallets. (Reproducible wallets could obfuscate the binary for size improvements as the reproducibility would assure the link between code and binary.)

Especially in the public source cases, obfuscation is a red flag. If the code is public, why obfuscate it?

As obfuscation is such a red flag when looking for transparency, we do also sometimes inspect the binaries of closed source apps.

As looking for code obfuscation is a more involved task, we do not inspect many apps but if we see other red flags, we might test this to then put the product into this red-flag category.

But we also ask:

Is the product still supported by the still existing provider? If not, we tag it Defunct!

Discontinued products or worse, products of providers that are not active anymore, are problematic, especially if they were not formerly reproducible and well audited to be self-custodial following open standards. If the provider hasn’t answered inquiries for a year but their server is still running or similar circumstances might get this verdict, too.