How it works.
Stated plainly.

Source code, audits and distribution

The source code is not public, and there has been no third-party security audit. The App is not listed in an app store; it is distributed as an APK from this website, and there is no iOS version. What you can verify: each release’s APK SHA-256 is shown on the download page, and the signing certificate fingerprint never changes. Release builds are signed on our own computer; the signing key is never uploaded to the build server. In-app updates download over HTTPS and install only after the App checks the file’s SHA-256, package name, version number and that the signing certificate matches the installed App.

Recovery phrases and derivation paths

Recovery phrases follow BIP39 with an empty passphrase. New wallets have 12 words, in English or Simplified Chinese; import accepts English phrases of 12, 15, 18, 21 or 24 words and Chinese phrases. Addresses follow BIP44: Ethereum and BNB Smart Chain use m/44'/60'/0'/0/n (the same address on both), TRON uses m/44'/195'/0'/0/n, where n is the account number starting at 0 — the same layout as other common wallets. After you restore a phrase, the App checks account 2 onwards for balances and stops after two empty accounts in a row; a wallet can hold up to 20 accounts. The Simplified Chinese wordlist is the official BIP39 list; the App checks its SHA-256 on load, our test vectors match the reference implementation used by Trezor, and the welcome screen runs a derivation self-check.

How secrets are encrypted on the phone

Your phrase or private key is encrypted with a random 256-bit data key using AES-256-GCM, with a fresh random 12-byte nonce from SecureRandom for every encryption and a 128-bit authentication tag. The data key is wrapped by a key derived from your app password with PBKDF2-HMAC-SHA256 (120,000 iterations, random salt). If you turn on fingerprint unlock, a second wrap uses an Android Keystore key that requires strong biometric authentication for each use and is permanently invalidated when a new fingerprint is enrolled. The whole file is encrypted again with a non-exportable Android Keystore key bound to the phone. The file sits in a directory excluded from backups, and system backup is disabled. Hardware-backed key storage depends on the phone.

Signing, nodes and what our server sees

Transactions are built and signed on the phone with Trust Wallet Core 4.8.4 (open source, Apache-2.0). Balance queries and signed transactions go through our proxy on Cloudflare Workers to Alchemy (Ethereum), NodeReal (BNB Smart Chain) and TronGrid (TRON). The proxy and these providers see your IP address and public addresses; the proxy only forwards and rate-limits and does not store request content, except the TRON paid-order records described in the privacy policy. Fiat reference prices come from the public price APIs of OKX, KuCoin, Gate and Binance. Our server never receives your recovery phrase, private key or app password, and it cannot sign transfers from your address.

Paying fees in USDT on Ethereum and BNB Smart Chain

This does not use an ERC-2771 forwarder and does not ask for a token approval. Your address is delegated with EIP-7702 to Alchemy’s SemiModularAccount7702 contract (addresses below), and a single ERC-4337 operation through EntryPoint v0.7 carries both your transfer and the fee; Alchemy Gas Manager pays the gas. Both transfers succeed or fail together, so a failed transfer takes no fee. Before signing, the App checks the fee recipient, the fee cap, that the delegate is on its allow-list, the call data byte by byte, and recomputes the hash itself. The fee is shown on the confirmation screen before you sign; the option may be unavailable when network gas is unusually high. Quotes last 5 minutes on BNB Smart Chain and 1 minute on Ethereum. The delegation stays on your address afterwards; another wallet may show it as a smart account or change it.

Paying TRON fees in USDT

No smart contract and no approval are involved. The App signs two ordinary USDT transfers on the phone: the fee to our TRON fee address and your transfer. Our server checks both byte by byte, then, through GetBlock, activates your address if needed (a tiny TRX transfer) and delegates energy and bandwidth to it for about an hour; it broadcasts the fee first and your transfer only after the fee succeeds. The fee covers activation (if needed), energy, bandwidth and our service fee, and is shown before you sign; quotes last 2 minutes. The two transfers are separate, and the server decides when to broadcast them, so this is where you rely on us: if the fee is on chain and your transfer never succeeds, we refund the fee to the paying address after verification, as set out in the Terms.

Renting energy on TRON

For users who hold TRX. The App signs a TRX payment to our TRON fee address and your USDT transfer. Our server first rents energy from GetBlock and has it delegated to your address (at least 30,000 energy, for about an hour), then broadcasts your payment, and broadcasts your transfer only after the payment succeeds. If the payment does not succeed, your transfer is not sent and nothing is charged. The cost, including our service fee, is shown before you sign, and the option is offered only when it is cheaper than burning TRX for the same energy. Bandwidth is not included; your own TRX pays it under network rules, and the confirmation screen shows the estimate. The same refund rule applies if your payment is on chain and your transfer never succeeds.

What we measured on Mainnet

In October 2026 we tested all three TRON payment methods with real USDT on Mainnet from internal test addresses. A USDT transfer used 64,285 energy when the recipient already held USDT and 130,285 when it did not, plus 345 bandwidth per transfer. With USDT fee payment and with energy rental, no TRX was burned for energy. Typical charges at that time for a recipient that already holds USDT: energy rental about 2.07 TRX, compared with about 6.4–6.7 TRX when burning; USDT fee payment about 1.84 USDT, or about 2.75 USDT when the sender’s address still needed activation. A transfer paying its fee in USDT was also completed on each of BNB Smart Chain and Ethereum Mainnet. These are measurements, not fixed prices: quotes follow network conditions, the TRX price and provider prices. Amounts in our interface screenshots are illustrative. Individual test transactions are not listed.

What we have not done yet

No public source code. No third-party security audit. No app-store listing and no iOS version. No bug bounty programme; security reports go to [email protected]. We would rather state these plainly than let a feature list suggest otherwise. If any of them changes, this page will be updated with the date.

Addresses and fingerprints you can check

Related pages