Wallet Logo

IQ Wallet - Crypto Wallet

latest release: 1.2 ( 13th October 2021 ) last analysed  10th November 2021 Obfuscated
4.9 ★★★★★
312 ratings
10 thousand
1st October 2021

Jump to verdict 

Do your own research!

Try out searching for "lost bitcoins", "stole my money" or "scammers" together with the wallet's name, even if you think the wallet is generally trustworthy. For all the bigger wallets you will find accusations. Make sure you understand why they were made and if you are comfortable with the provider's reaction.

If you find something we should include, you can create an issue or edit this analysis yourself and create a merge request for your changes.

The Analysis 

⚠️ Update and Warning: 2021-11-09

In an attempt to look into the code, we found that it was pretty much obfuscated. As a ReactNative app it uses minification which results in extractable code like this from index.android.bundle:

var __BUNDLE_START_TIME__=this.nativePerformanceNow?nativePerformanceNow():Date.now(),__DEV__=false,process=this.process||{},__METRO_GLOBAL_PREFIX__='';process.env=process.env||{};process.env.NODE_ENV=process.env.NODE_ENV||"production";
!(function(r){"use strict";r.__r=o,r[__METRO_GLOBAL_PREFIX__+"__d"]=function(r,i,n){if(null!=e[i])return;var o={dependencyMap:n,factory:r,hasError:!1,importedAll:t,importedDefault:t,isInitialized:!1,publicModule:{exports:{}}};e[i]=o},r.__c=n,r.__registerSegment=function(r,t,i){s[r]=t,i&&i.forEach(function(t){e[t]||v.has(t)||v.set(t,r)})};var e=n(),t={},i={}.hasOwnProperty;function n(){return e=Object.create(null)}function o(r){var t=r,i=e[t];return i&&i.isInitialized?i.publicModule.exports:d(t,i)}function l(r){var i=r;if(e[i]&&e[i].importedDefault!==t)return e[i].importedDefault;var n=o(i),l=n&&n.__esModule?n.default:n;return e[i].importedDefault=l}function u(r){var n=r;if(e[n]&&e[n].importedAll!==t)return e[n].importedAll;var l,u=o(n);if(u&&u.__esModule)l=u;else{if(l={},u)for(var a in u)i.call(u,a)&&(l[a]=u[a]);l.default=u}return e[n].importedAll=l}o.importDefault=l,o.importAll=u;var a=!1;function d(e,t){if(!a&&r.ErrorUtils){var i;a=!0;try{i=h(e,t)}catch(e){r.ErrorUtils.reportFatalError(e)}return a=!1,i}return h(e,t)}var f=16,c=65535;function p(r){return{segmentId:r>>>f,localId:r&c}}o.unpackModuleId=p,o.packModuleId=function(r){return(r.segmentId<<f)+r.localId};var s=[],v=new Map;function h(t,i){if(!i&&s.length>0){var n,a=null!==(n=v.get(t))&&void 0!==n?n:0,d=s[a];null!=d&&(d(t),i=e[t],v.delete(t))}var f=r.nativeRequire;if(!i&&f){var c=p(t),h=c.segmentId;f(c.localId,h),i=e[t]}if(!i)throw Error('Requiring unknown module "'+t+'".');if(i.hasError)throw _(t,i.error);i.isInitialized=!0;var m=i,g=m.factory,I=m.dependencyMap;try{var M=i.publicModule;return M.id=t,g(r,o,l,u,M,M.exports,I),i.factory=void 0,i.dependencyMap=void 0,M.exports}catch(r){throw i.hasError=!0,i.error=r,i.isInitialized=!1,i.publicModule.exports=void 0,r}}function _(r,e){return Error('Requiring module "'+r+'", which threw an exception: '+e)}})('undefined'!=typeof globalThis?globalThis:'undefined'!=typeof global?global:'undefined'!=typeof window?window:this);
!(function(n){var e=(function(){function n(n,e){return n}function e(n){var e={};return n.forEach(function(n,r){e[n]=!0}),e}function r(n,r,u){if(n.formatValueCalls++,n.formatValueCalls>200)return"[TOO BIG formatValueCalls "+n.formatValueCalls+" exceeded limit of 200]";var f=t(n,r);if(f)return f;var c=Object.keys(r),s=e(c);if(d(r)&&(c.indexOf('message')>=0||c.indexOf('description')>=0))return o(r);if(0===c.length){if(v(r)){var g=r.name?': '+r.name:'';return n.stylize('[Function'+g+']','special')}if(p(r))return n.stylize(RegExp.prototype.toString.call(r),'regexp');if(y(r))return n.stylize(Date.prototype.toString.call(r),'date');if(d(r))return o(r)}var h,b,m='',j=!1,O=['{','}'];(h=r,Array.isArray(h)&&(j=!0,O=['[',']']),v(r))&&(m=' [Function'+(r.name?': '+r.name:'')+']');return p(r)&&(m=' '+RegExp.prototype.toString.call(r)),y(r)&&(m=' '+Date.prototype.toUTCString.call(r)),d(r)&&(m=' '+o(r)),0!==c.length||j&&0!=r.length?u<0?p(r)?n.stylize(RegExp.prototype.toString.call(r),'regexp'):n.stylize('[Object]','special'):(n.seen.push(r),b=j?i(n,r,u,s,c):c.map(function(e){return l(n,r,u,s,e,j)}),n.seen.pop(),a(b,m,O)):O[0]+m+O[1]}function t(n,e){if(s(e))return n.stylize('undefined','undefined');if('string'==typeof e){var r="'"+JSON.stringify(e).replace(/^"|"$/g,'').replace(/'/g,"\\'").replace(/\\"/g,'"')+"'";return n.stylize(r,'string')}return c(e)?n.stylize(''+e,'number'):u(e)?n.stylize(''+e,'boolean'):f(e)?n.stylize('null','null'):void 0}function o(n){return'['+Error.prototype.toString.call(n)+']'}function i(n,e,r,t,o){for(var i=[],a=0,u=e.length;a<u;++a)b(e,String(a))?i.push(l(n,e,r,t,String(a),!0)):i.push('');return o.forEach(function(o){o.match(/^\d+$/)||i.push(l(n,e,r,t,o,!0))}),i}function l(n,e,t,o,i,l){var a,u,c;if((c=Object.getOwnPropertyDescriptor(e,i)||{value:e[i]}).get?u=c.set?n.stylize('[Getter/Setter]','special'):n.stylize('[Getter]','special'):c.set&&(u=n.stylize('[Setter]','special')),b(o,i)||(a='['+i+']'),u||(n.seen.indexOf(c.value)<0?(u=f(t)?r(n,c.value,null):r(n,c.value,t-1)).indexOf('\n')>-1&&(u=l?u.split('\n').map(function(n){return'  '+n}).join('\n').substr(2):'\n'+u.split('\n').map(function(n){return'   '+n}).join('\n')):u=n.stylize('[Circular]','special')),s(a)){if(l&&i.match(/^\d+$/))return u;(a=JSON.stringify(''+i)).match(/^"([a-zA-Z_][a-zA-Z_0-9]*)"$/)?(a=a.substr(1,a.length-2),a=n.stylize(a,'name')):(a=a.replace(/'/g,"\\'").replace(/\\"/g,'"').replace(/(^"|"$)/g,"'"),a=n.stylize(a,'string'))}return a+': '+u}function a(n,e,r){return n.reduce(function(n,e){return 0,e.indexOf('\n')>=0&&0,n+e.replace(/\u001b\[\d\d?m/g,'').length+1},0)>60?r[0]+(''===e?'':e+'\n ')+' '+n.join(',\n  ')+' '+r[1]:r[0]+e+' '+n.join(', ')+' '+r[1]}function u(n){return'boolean'==typeof n}function f(n){return null===n}function c(n){return'number'==typeof n}function s(n){return void 0===n}function p(n){return g(n)&&'[object RegExp]'===h(n)}function g(n){return'object'==typeof n&&null!==n}function y(n){return g(n)&&'[object Date]'===h(n)}function d(n){return g(n)&&('[object Error]'===h(n)||n instanceof Error)}function v(n){return'function'==typeof n}function h(n){return Object.prototype.toString.call(n)}function b(n,e){return Object.prototype.hasOwnProperty.call(n,e)}return function(e,t){return r({seen:[],formatValueCalls:0,stylize:n},e,t.depth)}})(),r='(index)',t={trace:0,info:1,warn:2,error:3},o=[];o[t.trace]='debug',o[t.info]='log',o[t.warn]='warning',o[t.error]='error';var i=1;function l(r){return function(){var l;l=1===arguments.length&&'string'==typeof arguments[0]?arguments[0]:Array.prototype.map.call(arguments,function(n){return e(n,{depth:10})}).join(', ');var a=arguments[0],u=r;'string'==typeof a&&'Warning: '===a.slice(0,9)&&u>=t.error&&(u=t.warn),n.__inspectorLog&&n.__inspectorLog(o[u],l,[].slice.call(arguments),i),s.length&&(l=p('',l)),n.nativeLoggingHook(l,u)}}function a(n,e){return Array.apply(null,Array(e)).map(function(){return n})}var u="\u2502",f="\u2510",c="\u2518",s=[];function p(n,e){return s.join('')+n+' '+(e||'')}if(n.nativeLoggingHook){n.console;n.console={error:l(t.error),info:l(t.info),log:l(t.info),warn:l(t.warn),trace:l(t.trace),debug:l(t.trace),table:function(e){if(!Array.isArray(e)){var o=e;for(var i in e=[],o)if(o.hasOwnProperty(i)){var l=o[i];l[r]=i,e.push(l)}}if(0!==e.length){var u=Object.keys(e[0]).sort(),f=[],c=[];u.forEach(function(n,r){c[r]=n.length;for(var t=0;t<e.length;t++){var o=(e[t][n]||'?').toString();f[t]=f[t]||[],f[t][r]=o,c[r]=Math.max(c[r],o.length)}});for(var s=y(c.map(function(n){return a('-',n).join('')}),'-'),p=[y(u),s],g=0;g<e.length;g++)p.push(y(f[g]));n.nativeLoggingHook('\n'+p.join('\n'),t.info)}else n.nativeLoggingHook('',t.info);function y(n,e){var r=n.map(function(n,e){return n+a(' ',c[e]-n.length).join('')});return e=e||' ',r.join(e+'|'+e)}},group:function(e){n.nativeLoggingHook(p(f,e),t.info),s.push(u)},groupEnd:function(){s.pop(),n.nativeLoggingHook(p(c),t.info)},groupCollapsed:function(e){n.nativeLoggingHook(p(c,e),t.info),s.push(u)},assert:function(e,r){e||n.nativeLoggingHook('Assertion failed: '+r,t.error)}},Object.defineProperty(console,'_isPolyfilled',{value:!0,enumerable:!1})}else if(!n.console){function g(){}var y=n.print||g;n.console={debug:y,error:y,info:y,log:y,trace:y,warn:y,assert:function(n,e){n||y('Assertion failed: '+e)},clear:g,dir:g,dirxml:g,group:g,groupCollapsed:g,groupEnd:g,profile:g,profileEnd:g,table:g},Object.defineProperty(console,'_isPolyfilled',{value:!0,enumerable:!1})}})('undefined'!=typeof globalThis?globalThis:'undefined'!=typeof global?global:'undefined'!=typeof window?window:this);
!(function(n){var r=0,t=function(n,r){throw n},l={setGlobalHandler:function(n){t=n},getGlobalHandler:function(){return t},reportError:function(n){t&&t(n,!1)},reportFatalError:function(n){t&&t(n,!0)},applyWithGuard:function(n,t,u,o,e){try{return r++,n.apply(t,u)}catch(n){l.reportError(n)}finally{r--}return null},applyWithGuardIfNeeded:function(n,r,t){return l.inGuard()?n.apply(r,t):(l.applyWithGuard(n,r,t),null)},inGuard:function(){return!!r},guard:function(n,r,t){var u;if('function'!=typeof n)return console.warn('A function must be passed to ErrorUtils.guard, got ',n),null;var o=null!=(u=null!=r?r:n.name)?u:'<generated guard>';return function(){for(var r=arguments.length,u=new Array(r),e=0;e<r;e++)u[e]=arguments[e];return l.applyWithGuard(n,null!=t?t:this,u,null,o)}}};n.ErrorUtils=l})('undefined'!=typeof globalThis?globalThis:'undefined'!=typeof global?global:'undefined'!=typeof window?window:this);
'undefined'!=typeof globalThis?globalThis:'undefined'!=typeof global?global:'undefined'!=typeof window&&window,(function(){'use strict';var e=Object.prototype.hasOwnProperty;'function'!=typeof Object.entries&&(Object.entries=function(n){if(null==n)throw new TypeError('Object.entries called on non-object');var o=[];for(var t in n)e.call(n,t)&&o.push([t,n[t]]);return o}),'function'!=typeof Object.values&&(Object.values=function(n){if(null==n)throw new TypeError('Object.values called on non-object');var o=[];for(var t in n)e.call(n,t)&&o.push(n[t]);return o})})();
__d(function(g,r,i,a,m,e,d){var n=r(d[0]),t=r(d[1])(r(d[2]));n.AppRegistry.registerComponent(r(d[3]).name,function(){return t.default})},0,[1,3,386,1112]);
__d(function(g,r,i,a,m,e,d){'use strict';m.exports={get AccessibilityInfo(){return r(d[0])},get ActivityIndicator(){return r(d[1])},get Button(){return r(d[2])},get DatePickerIOS(){return r(d[3])('DatePickerIOS-merged',"DatePickerIOS has been merged with DatePickerAndroid and will be removed in a future release. It can now be installed and imported from '@react-native-community/datetimepicker' instead of 'react-native'. See https://github.com/react-native-datetimepicker/datetimepicker"),r(d[4])},get DrawerLayoutAndroid(){return r(d[5])},get FlatList(){return r(d[6])},get Image(){return r(d[7])},get ImageBackground(){return r(d[8])},get InputAccessoryView(){return r(d[9])},get KeyboardAvoidingView(){return r(d[10])},get MaskedViewIOS(){return r(d[3])('maskedviewios-moved',"MaskedViewIOS has been extracted from react-native core and will be removed in a future release. It can now be installed and imported from '@react-native-masked-view/masked-view' instead of 'react-native'. See https://github.com/react-native-masked-view/react-native-masked-view"),r(d[11])},get Modal(){return r(d[12])},get Picker(){return r(d[3])('picker-moved',"Picker has been extracted from react-native core and will be removed in a future release. It can now be installed and imported from '@react-native-picker/picker' instead of 'react-native'. See https://github.com/react-native-picker/react-native-picker"),r(d[13])},get PickerIOS(){return r(d[3])('pickerios-moved',"PickerIOS has been extracted from react-native core and will be removed in a future release. It can now be installed and imported from '@react-native-picker/picker' instead of 'react-native'. See https://github.com/react-native-picker/react-native-picker"),r(d[14])},get Pressable(){return r(d[15]).default},get ProgressBarAndroid(){return r(d[3])('progress-bar-android-moved',"ProgressBarAndroid has been extracted from react-native core and will be removed in a future release. It can now be installed and imported from '@react-native-community/progress-bar-android' instead of 'react-native'. See https://github.com/react-native-progress-view/progress-bar-android"),r(d[16])},get ProgressViewIOS(){return r(d[3])('progress-view-ios-moved',"ProgressViewIOS has been extracted from react-native core and will be removed in a future release. It can now be installed and imported from '@react-native-community/progress-view' instead of 'react-native'. See https://github.com/react-native-progress-view/progress-view"),r(d[17])},get RefreshControl(){return r(d[18])},get SafeAreaView(){return r(d[19])},get ScrollView(){return r(d[20])},get SectionList(){return r(d[21])},get SegmentedControlIOS(){return r(d[3])('segmented-control-ios-moved',"SegmentedControlIOS has been extracted from react-native core and will be removed in a future release. It can now be installed and imported from '@react-native-community/segmented-control' instead of 'react-native'. See https://github.com/react-native-segmented-control/segmented-control"),r(d[22])},get Slider(){return r(d[3])('slider-moved',"Slider has been extracted from react-native core and will be removed in a future release. It can now be installed and imported from '@react-native-community/slider' instead of 'react-native'. See https://github.com/callstack/react-native-slider"),r(d[23])},get StatusBar(){return r(d[24])},get Switch(){return r(d[25])},get Text(){return r(d[26])},get TextInput(){return r(d[27])},get Touchable(){return r(d[28])},get TouchableHighlight(){return r(d[29])},get TouchableNativeFeedback(){return r(d[30])},get TouchableOpacity(){return r(d[31])},get TouchableWithoutFeedback(){return r(d[32])},get View(){return r(d[33])},get VirtualizedList(){return r(d[34])},get VirtualizedSectionList(){return r(d[35])},get ActionSheetIOS(){return r(d[36])},get Alert(){return r(d[37])},get Animated(){return r(d[38])},get Appearance(){return r(d[39])},get AppRegistry(){return r(d[40])},get AppState(){return r(d[41])},get AsyncStorage(){return r(d[3])('async-storage-moved',"AsyncStorage has been extracted from react-native core and will be removed in a future release. It can now be installed and imported from '@react-native-async-storage/async-storage' instead of 'react-native'. See https://github.com/react-native-async-storage/async-storage"),r(d[42])},get BackHandler(){return r(d[43])},get Clipboard(){return r(d[3])('clipboard-moved',"Clipboard has been extracted from react-native core and will be removed in a future release. It can now be installed and imported from '@react-native-community/clipboard' instead of 'react-native'. See https://github.com/react-native-clipboard/clipboard"),r(d[44])},get DatePickerAndroid(){return r(d[3])('DatePickerAndroid-merged',"DatePickerAndroid has been merged with DatePickerIOS and will be removed in a future release. It can now be installed and imported from '@react-native-community/datetimepicker' instead of 'react-native'. See https://github.com/react-native-datetimepicker/datetimepicker"),r(d[45])},get DeviceInfo(){return r(d[46])},get DevSettings(){return r(d[47])},get Dimensions(){return r(d[48])},get Easing(){return r(d[49])},get findNodeHandle(){return r(d[50]).findNodeHandle},get I18nManager(){return r(d[51])},get ImagePickerIOS(){return r(d[3])('imagePickerIOS-moved',"ImagePickerIOS has been extracted from react-native core and will be removed in a future release. Please upgrade to use either '@react-native-community/react-native-image-picker' or 'expo-image-picker'. If you cannot upgrade to a different library, please install the deprecated '@react-native-community/image-picker-ios' package. See https://github.com/rnc-archive/react-native-image-picker-ios"),r(d[52])},get InteractionManager(){return r(d[53])},get Keyboard(){return r(d[54])},get LayoutAnimation(){return r(d[55])},get Linking(){return r(d[56])},get LogBox(){return r(d[57])},get NativeDialogManagerAndroid(){return r(d[58]).default},get NativeEventEmitter(){return r(d[59]).default},get Networking(){return r(d[60])},get PanResponder(){return r(d[61])},get PermissionsAndroid(){return r(d[62])},get PixelRatio(){return r(d[63])},get PushNotificationIOS(){return r(d[3])('pushNotificationIOS-moved',"PushNotificationIOS has been extracted from react-native core and will be removed in a future release. It can now be installed and imported from '@react-native-community/push-notification-ios' instead of 'react-native'. See https://github.com/react-native-push-notification-ios/push-notification-ios"),r(d[64])},get Settings(){return r(d[65])},get Share(){return r(d[66])},get StatusBarIOS(){return r(d[3])('StatusBarIOS-merged','StatusBarIOS has been merged with StatusBar and will be removed in a future release. Use StatusBar for mutating the status bar'),r(d[67])},get StyleSheet(){return r(d[68])},get Systrace(){return r(d[69])},get ToastAndroid(){return r(d[70])},get TurboModuleRegistry(){return r(d[71])},get UIManager(){return r(d[72])},get unstable_batchedUpdates(){return r(d[50]).unstable_batchedUpdates},get useColorScheme(){return r(d[73]).default},get useWindowDimensions(){return r(d[74]).default},get UTFSequence(){return r(d[75])},get Vibration(){return r(d[76])},get YellowBox(){return r(d[77])},get DeviceEventEmitter(){return r(d[78]).default},get DynamicColorIOS(){return r(d[79]).DynamicColorIOS},get NativeAppEventEmitter(){return r(d[80])},get NativeModules(){return r(d[81])},get Platform(){return r(d[82])},get PlatformColor(){return r(d[83]).PlatformColor},get processColor(){return r(d[84])},get requireNativeComponent(){return r(d[85])},get unstable_RootTagContext(){return r(d[86]).RootTagContext},get unstable_enableLogBox(){return function(){return console.warn('LogBox is enabled by default so there is no need to call unstable_enableLogBox() anymore. This is a no op and will be removed in the next version.')}},get ColorPropType(){return r(d[87])},get EdgeInsetsPropType(){return r(d[88])},get PointPropType(){return r(d[89])},get ViewPropTypes(){return r(d[90])}}},1,[2,46,184,204,205,206,212,272,281,282,284,285,287,293,298,299,50,302,263,303,215,305,307,308,207,310,191,313,193,316,185,317,314,178,214,306,326,119,318,328,330,345,348,335,351,353,355,356,175,238,70,291,358,225,251,252,360,363,120,101,100,364,366,174,368,370,371,373,183,36,374,26,21,376,379,380,381,383,4,384,129,27,65,145,142,53,290,163,203,385,277]);
__d(function(g,r,i,a,m,e,d){'use strict';var n=r(d[0])(r(d[1])),t=r(d[0])(r(d[2])),s=r(d[0])(r(d[3])),o=new Map,c={isBoldTextEnabled:function(){return Promise.resolve(!1)},isGrayscaleEnabled:function(){return Promise.resolve(!1)},isInvertColorsEnabled:function(){return Promise.resolve(!1)},isReduceMotionEnabled:function(){return new Promise(function(n,t){s.default?s.default.isReduceMotionEnabled(n):t(!1)})},isReduceTransparencyEnabled:function(){return Promise.resolve(!1)},isScreenReaderEnabled:function(){return new Promise(function(n,t){s.default?s.default.isTouchExplorationEnabled(n):t(!1)})},get fetch(){return console.warn('AccessibilityInfo.fetch is deprecated, call AccessibilityInfo.isScreenReaderEnabled instead'),this.isScreenReaderEnabled},addEventListener:function(t,s){var c;'change'===t||'screenReaderChanged'===t?c=n.default.addListener("touchExplorationDidChange",s):'reduceMotionChanged'===t&&(c=n.default.addListener("reduceMotionDidChange",s)),o.set(s,c)},removeEventListener:function(n,t){var s=o.get(t);s&&(s.remove(),o.delete(t))},setAccessibilityFocus:function(n){t.default.sendAccessibilityEvent(n,t.default.getConstants().AccessibilityEventTypes.typeViewFocused)},announceForAccessibility:function(n){s.default&&s.default.announceForAccessibility(n)}};m.exports=c},2,[3,4,21,45]);
...

Additional Warning: We recommend exercising caution around a new app with suspicious and possibly bought 5* reviews.

App Description

Receive, send, store and exchange Bitcoin, Ethereum, Tron, BNB, Cardano, Tether and other cryptocurrencies. Сontrol and manage your crypto assets yourself, while our application makes this process as seamless and secure as possible.

SECURITY

With IQ Wallet, you have complete control over your virtual currency wallets private keys. Export your keys directly from the application. PIN code and biometric protection prevent unauthorized access to the application. Access your account with a mnemonic phrase supported by BIP39 recovery protocol.

Verdict

The app is clearly self-custodial with the ability to send and receive BTC. Its release was fairly recent so even if we were not able to test it, we would assume that the advertised features will later on work as intended. However, searching for appID ‘com.iqpandroidinterface’ on Github, yielded 0 results. If there is no source code that is publicly available then this app cannot be verified.

(dg, lw)

Verdict Explained

The binary contains active obfuscation!

As part of our Methodology, we ask:

Is the decompiled binary legible? If not, we tag it Obfuscated!

When compiling source code to binary, usually a lot of meta information is retained. A variable storing a masterseed would usually still be called masterseed, so an auditor could inspect what happens to the masterseed. Does it get sent to some server? But obfuscation would rename it for example to _t12, making it harder to find what the product is doing with the masterseed.

In benign cases, code symbols are replaced by short strings to make the binary smaller but for the sake of transparency this should not be done for non-reproducible Bitcoin wallets. (Reproducible wallets could obfuscate the binary for size improvements as the reproducibility would assure the link between code and binary.)

Especially in the public source cases, obfuscation is a red flag. If the code is public, why obfuscate it?

As obfuscation is such a red flag when looking for transparency, we do also sometimes inspect the binaries of closed source apps.

As looking for code obfuscation is a more involved task, we do not inspect many apps but if we see other red flags, we might test this to then put the product into this red-flag category.

The product cannot be independently verified. If the provider puts your funds at risk on purpose or by accident, you will probably not know about the issue before people start losing money. If the provider is more criminally inclined he might have collected all the backups of all the wallets, ready to be emptied at the press of a button. The product might have a formidable track record but out of distress or change in management turns out to be evil from some point on, with nobody outside ever knowing before it is too late.