CryptoWallet.si Security Assessment with Claude.ai Review Executive Summary
This article summarizes a security-focused assessment of the open source cryptocurrency wallet CryptoWallet.si (CryptoWallet.si App), combining publicly available project information with a review of key cryptographic implementation details. The wallet is positioned as an Electrum-based, non-custodial mobile wallet supporting multiple cryptocurrencies while emphasizing user sovereignty, privacy, and open source transparency.
The reviewed implementation demonstrates several positive security characteristics, particularly around entropy generation, mnemonic handling, and standards compliance.
Project Overview
CryptoWallet.si is described as:
Open source and publicly auditable. Non-custodial, meaning private keys remain under user control. Built on Electrum architecture and SPV (Simplified Payment Verification) principles. Compatible with BIP-39 recovery phrases. Focused on privacy, with claims of no tracking, analytics, or data collection.
According to the project documentation, private keys never leave the user's device, while Electrum servers are used only for blockchain communication and transaction broadcasting.
Claude.ai Security Assessment Findings
- Secure Randomness Initialization
One of the most important aspects of wallet security is the quality of random number generation used during wallet creation.
Finding: The implementation installs LinuxSecureRandom early in the application lifecycle, before any key generation operations occur.
Security Impact
This is a positive implementation detail because:
Cryptographic keys depend entirely on high-quality entropy. Early initialization reduces the risk of weak randomness sources being used accidentally. Private keys derived from insufficient entropy can become predictable and vulnerable to theft. Assessment
✅ Good security practice observed
The wallet appears to correctly prioritize secure entropy sources before wallet generation activities begin.
- Strong Mnemonic Entropy Levels
During assessment, mnemonic generation was found to use entropy sizes of:
192 bits 256 bits
These values exceed the minimum entropy requirements commonly associated with the BIP-39 standard.
Security Impact
Higher entropy directly increases resistance against brute-force attacks.
For comparison:
Entropy Typical Mnemonic Length128-bit 12 words 192-bit 18 words 256-bit 24 words
A 192-bit or 256-bit seed phrase provides an exceptionally large search space, far beyond practical attack capabilities with current technology.
Assessment
✅ Very strong entropy configuration
The wallet generates recovery phrases with entropy levels that meet or exceed industry best practices.
- BIP-39 Standard Compliance
The review confirms that mnemonic processing follows the BIP-39 specification.
Verified Areas Correct mnemonic generation process. Standard BIP-39 checksum handling. Proper seed derivation from mnemonic phrases. Interoperability with other BIP-39 compatible wallets. Security Impact
Standards compliance is important because it:
Reduces implementation mistakes. Improves wallet recovery portability. Enables independent verification by security researchers. Assessment
✅ Correct implementation observed
The wallet's mnemonic functionality aligns with established BIP-39 standards.
- Correct scrypt Key Derivation
The assessment also verified the use of scrypt key derivation following correct implementation practices.
Why This Matters
scrypt is designed to:
Slow down password cracking attempts. Increase computational cost for attackers. Provide resistance against large-scale brute-force attacks.
When combined with a strong user password, scrypt significantly increases the effort required to recover encrypted wallet data.
Assessment
✅ Proper key derivation implementation
The reviewed implementation matches expected cryptographic behavior and follows recognized security practices.
Architectural Security Strengths
Beyond the cryptographic review, several architectural strengths were identified from the project's public documentation:
Non-Custodial Design
Users retain sole control of wallet keys and recovery phrases. The project explicitly states that it does not store user funds, recovery seeds, or private keys.
Open Source Transparency
The source code is publicly available for community review, enabling independent audits and reducing reliance on blind trust.
Electrum-Based Architecture
The wallet leverages the widely adopted Electrum model, where private keys remain local while blockchain data is retrieved from Electrum servers.
Privacy-Oriented Approach
The project states that it performs no analytics tracking and collects no user data.
Overall Conclusion
Based on the reviewed findings, CryptoWallet.si demonstrates a solid security foundation in several critical areas:
✅ Secure randomness initialization via LinuxSecureRandom ✅ Strong mnemonic entropy (192-bit and 256-bit) ✅ Correct BIP-39 implementation ✅ Proper scrypt-based key derivation ✅ Non-custodial architecture ✅ Open source transparency ✅ Private keys remain on the user's device
From a cryptographic and wallet-generation perspective, the reviewed components align with established cryptocurrency wallet security practices. While no software security assessment can guarantee the absence of vulnerabilities, the examined implementation details indicate careful attention to key generation, recovery phrase security, and standards compliance.
Assessment Result: Positive security posture for the reviewed cryptographic components, with implementations matching recognized industry standards and best practices.