AirWallet Lessons from other wallets
Mistakes other wallets shipped, and what AirWallet does about each one.
In October 2026 we checked AirWallet's code against the real failures of other wallets. We used:
- every issue, release note and written review of AirGap, the best-known air-gapped phone wallet
- about 105 incidents at other wallets
- published signing bugs in hardware and QR-code signers
The check found 3 real bugs in AirWallet, all fixed on October 14, 2026. Android could save over wallet data it had failed to open. Arbitrum sends used too little gas. The Zcash signer accepted any signature type on transparent coins. The rest of this page lists what other wallets got wrong and where AirWallet stands on each.
Saved data and versions
AirGap Vault users lost everything after an update, because old Samsung phones' key storage could drop its secrets (AirGap issues #96 and #100). Phantom on iOS and MetaMask Mobile had similar failures in 2024. Each app started empty when it could not read its data, and its first save destroyed the real data. AirWallet never saves over data it could not open. It offers Try again or Keep them aside and start fresh, and the unreadable data stays on the device. On Android, it never makes a new storage key over data sealed by a lost one.
AirGap called codes "incompatible or damaged" when the two apps were only different versions (wallet#157 and vault#233). AirWallet says what happened: the code was "made by a different version of AirWallet". It also shows its own build date and commit.
Some AirGap Vault users were locked out after changing their phone's unlock pattern, because the app's storage key was tied to the lock screen (#45). AirWallet's storage key is tied to neither the lock screen nor biometrics. Changing your fingerprints only turns fingerprint unlock off.
The most common complaint in AirGap's one-star reviews was a Vault that would not start on an old phone: 39 of 290 written reviews. AirWallet runs on a factory-reset Android 10 phone, and on Android 7 to 9 after one web-engine update. We measured these limits in real old builds of Chromium. If one coin cannot run on a phone, the others still do. See Platforms and compatibility.
Recovery words and keys
The one documented theft from an AirGap user began with a recovery phrase photographed on an everyday phone. In January 2025, an automated sweeper emptied the wallet. AirWallet's words screen tells you never to photograph them. On Android it blocks screenshots, and marks a copied phrase or key as sensitive (Android 13 and later). The everyday wallet also flags any send from a watched wallet that it did not make: "Not sent from this app".
In 2019, Coinomi users' recovery phrases went to a server through the browser's enhanced spellcheck. AirWallet's import box has spellcheck, autocomplete and autocorrect turned off, and it is cleared after use. On Android:
- the keyboard learns nothing typed in the app
- other apps' overlays are hidden (Android 12 and later)
- the screen's contents go only to real accessibility tools (Android 14 and later)
Bad randomness cost Coldcard users about 1,400 to 1,800 BTC in July 2026. "Ill Bloom" (2026) and Profanity (2022) were key losses of the same kind. AirWallet mixes 2 independent generators with anything you add, and your dice alone can make the words. See How keys are made.
"Dark Skippy" (2024) showed that a malicious signer can leak a whole seed through the random-looking part of just 2 signatures. AirWallet's signatures are deterministic, so you can make each one again on another machine and compare. Taproot signatures used random extra data until October 6, 2026. Monero's ring signatures are the one exception.
Signing
These are the attacks on the signer itself, and the rule that now stops each one.
| What went wrong elsewhere | What AirWallet's signer does |
|---|---|
| A SegWit signature covers only its own input's amount. In 2020, 2 requests that each lied about a different input could hide a huge fee (CVE-2020-14199). | Each SegWit coin must come with its whole previous transaction. For apps that do not send it, such as Sparrow, the signer remembers the amount each request claimed and refuses a later request that claims another. |
| Monero's wallet library, in cold signing, accepted any address the online side called change, until 2026. A Specter-DIY host could mark a receive address as change (September 2026). Sia users' coins were held for ransom at addresses far past the ones in use (2019). | Change is worked out from the signer's own keys. Monero change may go only to the signing wallet. A far-off Bitcoin address of your own gets a warning. A Zcash transparent change address past index 1,000 is refused. |
A 2026 audit found the Krux signer would sign SIGHASH_NONE, which leaves outputs unsigned. Keystone accepted Zcash outputs that no key could decrypt, so their recipient and amount were never shown (issue #2204, July 2026). | Our own Zcash signer had the first problem. It now signs transparent inputs only with SIGHASH_ALL, and it decrypts every shielded output, Sapling included, to show each recipient and amount. |
| AirGap's 2019 audit found 3 high-severity flaws where the screen did not match what was signed. At Bybit (February 2025, about $1.5 billion), signers saw a transfer but signed a Safe delegatecall that replaced the Safe's code. | The Ethereum signer builds the transaction from the fields it shows. A MetaMask or Rabby request must decode to exactly that transaction. A Safe delegatecall is refused unless it goes to Safe's official batch contracts. |
| An open AirGap issue (#317, October 2026) describes a request shown as Ethereum but signed for chain 56. | The review always names the network. A chain AirWallet does not know is shown by its number, and only a plain payment is signed there. |
| Solana's "sign message" signs any bytes, so a website could pass in a real transaction as a message. | The extension refuses a message if any start of it is a transaction, or if it is a sign-in for another domain. On Ethereum, eth_sign is refused. |
| At Drift (April 2026, about $285 million), attackers held pre-signed Solana transactions on durable nonces for a week, then sent them. | The signer signs durable-nonce transactions only on the wallet's own nonce account. A pending one can be called off, so a held copy can never land. |
See What the signer checks for every rule, coin by coin.
Sending
AirGap reported sends as failed that had gone out, so people sent again (wallet#13). One reviewer tried 10 times. AirWallet keeps a Bitcoin or Ethereum send's signed bytes until it is sent. When an error might hide a send that went out, it first looks the transaction up by its own ID. Send again sends the same bytes, so a payment can only land once.
AirGap users with stuck transactions waited months, and some typed their recovery phrase into another wallet to replace one (wallet#67, #74, #218 and #220). In AirWallet, a waiting Bitcoin or Ethereum payment has Speed it up in the wallet's Activity, and Ethereum also has Call it off. Watched wallets get both: the offline device signs the replacement like any send.
AirGap had repeated trouble sending on layer-2 networks such as Optimism (#161 and #199). Looking for the same problem here found one. AirWallet assumed a plain Ethereum send always takes 21,000 gas, but on Arbitrum part of the fee sits inside the gas. On October 14, 2026, a plain Arbitrum send measured 22,582 gas, and 21,000 was refused. Robinhood Chain works the same way. AirWallet now uses the network's own estimate for each transaction. On Base and Optimism, the Ethereum data fee is included in the fee shown and taken out of a Max send.
In December 2025, someone lost $50 million to an address that matched the real one's first 3 and last 4 characters. AirWallet flags an address that matches a known one's first and last 3 characters after the prefix. It compares against your contacts, recent recipients, everyone your wallets have paid and your own wallets. Activity tags look-alike senders and never offers their addresses for copying.
Releases and support
AirGap once published a release checksum that was the SHA-256 of an empty file (#56). AirWallet's signing tool refuses to sign a list with an empty file in it, or with files left over from an older build. See Updates, downloads and outside code.
Fake support staff are a constant theme in wallet reviews, AirGap's included. Nobody from AirWallet will message you first, call you, or ask for your words, a key or a backup. Real help goes through Help → Report a problem, which never includes addresses, amounts or keys.
Still open
Two things people ask of every air-gapped wallet need more than code: reproducible builds and an F-Droid listing. Neither is done yet.