Wallet Logo

HyperPay Mobile wallet

latest release: 4.0.18 last analysed  2nd December 2020
Obfuscated
3.6 ★★★★★
847 ratings
10thousand

Published:

Our last analysis is based on data found in their Google Play description and their website.
details below 

Help spread awareness for build reproducibility

Please help us spread the word, asking HyperPay Mobile wallet to support reproducible builds via their Twitter!

Do your own research!

Try out searching for "lost bitcoins", "stole my money" or "scammers" together with the wallet's name, even if you think the wallet is generally trustworthy. For all the bigger wallets you will find accusations. Make sure you understand why they were made and if you are comfortable with the provider's reaction.

The Analysis

Is HyperPay Wallet Safe?
Yes, of course. HyperPay wallet supports both on-chain & off-chain and both are absolutely safe.

Ok?

Our security system for off-chain wallet is robust with 24/7 abnormal data monitoring, orchestrated code quality and vulnerability scanning in CI/CD cycle system. Our security team is safeguarding your assets 24/7.

That sounds like a custodial offering if a security team is safeguarding your assets.

Our on-chain wallet is protected by routine coding check and vetting. You control your own Mnemonic and private key. We provide you with the safest infrastructure, you shoulld take care of your own Mnemonic and private key.
Attention: you will lose your wallet assets and never find them back if you forget your mnemonic words. Be sure to write them on the paper and keep in a safe place.

This is a rather explicit claim of being non-custodial.

We find no way to verify the claims made and moreover notice in their Audit report these items:

Open-source intelligence collection -> Collection of personnel and organization structure -> Passed

We read this as the team not being on public record which also means that should they disappear, you won’t know who did it. They have a team page though. It’s Jacob, Gary, Sebastian and Nick. No last names.

Open-source intelligence collection -> GitHub source code leakage detection -> Passed

We read this as this wallet absolutely not being open source. Public audits are not welcome here.

Mobile App audit -> Disable code decompilation -> Passed

We take this as a confirmation that the app is obfuscated and thus file it as not verifiable.

Verdict Explained

Obfuscated
The app's binary contains active obfuscation which makes it significantly harder to analyze what it is doing.

This verdict means that the app could not be decompiled. In benign cases code symbols are replaced by short strings to make the app smaller but for the sake of transparency this should not be done for non-reproducible Bitcoin wallets. (Reproducible wallets could obfuscate the app for size improvements as the reproducibility would assure the auditability.)

The app cannot be independently verified. If the provider puts your funds at risk on purpose or by accident, you will probably not know about the issue before people start losing money. If the provider is more criminally inclined he might have collected all the backups of all the wallets, ready to be emptied at the press of a button. The app might have a formidable track record but out of distress or change in management turns out to be evil from some point on, with nobody outside ever knowing before it is too late.