{"data":{"slug":"electrum","name":"Electrum","domain":"electrum.org","url":"https://electrum.org/","kyc":"none","kycLevel":0,"kycNote":"Local wallet use needs no account or identity check. Connected servers still receive wallet queries and connection data.","fee":"Free","categories":["Wallet"],"countries":["GLOBAL"],"bestFor":["Bitcoin self-custody","Cold storage and multisig","Running against your own node"],"features":["Bitcoin only","No account and no signup","Keys stay on the device","Seed phrase recovery","Reproducible builds","Multisig wallets","Cold storage and watch-only","Hardware wallet support","Tor and custom server support"],"tagline":"Long-running Bitcoin wallet with no account and locally held keys.","status":"warning","updatedAt":"2026-10-25","description":"Bitcoin desktop and Android wallet running since 2011. No account, keys stay local, and releases are reproducible and signed.","cardSummary":"Bitcoin wallet, no account, reproducible builds.","networks":[],"checkedAt":"2026-10-25","lastReviewed":"2026-10-25","reviewSource":"official_source_review_2026-10-25","jurisdictionConfidence":"verified","kycLastChecked":"2026-08-07","trending":false,"jurisdiction":"DE","noOperatorData":true,"evidenceStatus":"verified","riskLevel":"caution","privacyWarning":"Public Electrum servers can link queried wallet addresses and see connection IPs. The developer reports a fee-bump attack affecting versions before 4.8.3, including a reported loss; 4.8.3 includes the fix. Tor hides the connection IP, not wallet queries. Optional public crash reports can include device and connection details.","auditedBy":[],"corporate":{"entityType":{"value":"company","citation":"https://electrum.org/","note":"Publisher and Berlin address are disclosed in official imprint. A site-stated 2013 founding is not an independently verified legal incorporation date."},"governanceModel":{"value":"company-sponsored","citation":"https://electrum.org/"},"repositoryUrl":{"value":"https://github.com/spesmilo/electrum","citation":"https://github.com/spesmilo/electrum"},"legalEntity":{"value":"Electrum Technologies GmbH","citation":"https://electrum.org/"},"registrationNumber":{"value":"unknown","citation":"unknown"},"registryUrl":{"value":"unknown","citation":"unknown"},"incorporationJurisdiction":{"value":"Germany, per publisher imprint","citation":"https://electrum.org/"},"incorporationDate":{"value":"unknown","citation":"unknown"},"registeredAddress":{"value":"Paul-Lincke-Ufer 8 D, 10999 Berlin, Germany","citation":"https://electrum.org/"},"parentEntity":{"value":"unknown","citation":"unknown"},"officers":{"value":[],"citation":"unknown"},"source":"Cited provider and public identity sources","reviewedAt":"2026-10-25"},"publicClaims":{"followTheMoney":{"value":"Electrum is free MIT-licensed Bitcoin wallet software created by Thomas Voegtlin in 2011. Its website names Electrum Technologies GmbH as publisher and says the company was founded in 2013.","reviewedAt":"2026-10-25","sources":[{"label":"Electrum - About and Impressum","href":"https://electrum.org/#about","type":"official"},{"label":"Electrum source repository (MIT licence)","href":"https://github.com/spesmilo/electrum","type":"official"}]}},"followTheMoney":"Electrum is free MIT-licensed Bitcoin wallet software created by Thomas Voegtlin in 2011. Its website names Electrum Technologies GmbH as publisher and says the company was founded in 2013.","incidents":[{"title":"Malicious-server transaction replacement and fee-bump loss","status":"monitoring","severity":"high","startedAt":"2026-10-11","summary":"Electrum's October 24 advisory reports exploitation of versions before 4.8.3: a malicious server can replace a just-broadcast transaction in wallet history with an invalid transaction paying an attacker. Manually fee-bumping that transaction can sign the attacker payment. The developers report two user reports, including one loss. Version 4.8.3 includes signature checks for wallet-owned inputs; the patch is not evidence that lost funds were recovered.","directUserHarm":true,"customerDataOrAssetsCompromised":true,"disclosure":"proactive","remediation":"partial","sources":[{"label":"Electrum developer security advisory GHSA-6jp4-8v48-cc5v","href":"https://github.com/spesmilo/electrum/security/advisories/GHSA-6jp4-8v48-cc5v"}]}],"agentUsability":{"status":"hard-blocked","evidence":"No reviewed programmatic agent-payment profile is recorded; this dataset treats the service as hard-blocked until a control surface is documented.","derivedFrom":["agentMoney.compatible"]},"details_url":"https://cunicula.com/en/provider/electrum","canonical_score":31,"score_status":"rated","score_evidence":"limited","score_version":"4.0","score_breakdown":{"privacy":12,"control":0,"transparency":0,"security":12,"accountability":7},"applied_caps":[{"key":"active-high-incident","maximum":39,"reason":"An unresolved high-severity incident limits the score to 39."},{"key":"unresolved-material-compromise","maximum":49,"reason":"An unresolved customer-data or asset compromise limits the score to 49."},{"key":"closed-critical-core-without-audit","maximum":69,"reason":"A closed or unknown critical core without current audit evidence limits the score to 69."}],"score_rationale":["privacy: 12 of 25 points.","control: 0 of 20 points.","transparency: 0 of 20 points.","security: 12 of 25 points.","accountability: 7 of 10 points.","Limited evidence: operatorDataExposure, controlModel, sourceModel scored zero.","An unresolved high-severity incident limits the score to 39.","An unresolved customer-data or asset compromise limits the score to 49.","A closed or unknown critical core without current audit evidence limits the score to 69."],"last_scored":"2026-10-25","not_rated_reasons":[],"score_assessment":{"operatorDataExposure":"unknown","controlModel":"unknown","sourceModel":"unknown"},"score_review":{"outcome":"HOLD","checkedAt":"2026-08-25","inputs":{"operatorDataExposure":{"value":"unknown","sourceUrls":["https://electrum.org/","https://github.com/spesmilo/electrum/blob/master/RELEASE-NOTES","https://github.com/spesmilo/electrum/security/advisories/GHSA-vw94-r84p-66qf","https://github.com/spesmilo/electrum","https://github.com/spesmilo/electrum/security/advisories/GHSA-q7m2-785w-r585"],"reviewedAt":"2026-08-25","note":"The reviewed packet did not map this normalized Score 4.0 input to a field-level source; unknown is preserved until that mapping is completed."},"controlModel":{"value":"unknown","sourceUrls":["https://electrum.org/","https://github.com/spesmilo/electrum/blob/master/RELEASE-NOTES","https://github.com/spesmilo/electrum/security/advisories/GHSA-vw94-r84p-66qf","https://github.com/spesmilo/electrum","https://github.com/spesmilo/electrum/security/advisories/GHSA-q7m2-785w-r585"],"reviewedAt":"2026-08-25","note":"The reviewed packet did not map this normalized Score 4.0 input to a field-level source; unknown is preserved until that mapping is completed."},"sourceModel":{"value":"unknown","sourceUrls":["https://electrum.org/","https://github.com/spesmilo/electrum/blob/master/RELEASE-NOTES","https://github.com/spesmilo/electrum/security/advisories/GHSA-vw94-r84p-66qf","https://github.com/spesmilo/electrum","https://github.com/spesmilo/electrum/security/advisories/GHSA-q7m2-785w-r585"],"reviewedAt":"2026-08-25","note":"The reviewed packet did not map this normalized Score 4.0 input to a field-level source; unknown is preserved until that mapping is completed."}},"audit":{"scoreEligible":false,"reason":"No dated, scoped, current audit citation was normalized in the reviewed packet; legacy auditedBy labels receive no score credit."}},"privacy_observations":{"identity_exposure_level":0,"identity_requirement":"none","hosted_operator_data":false,"jurisdiction":"DE","jurisdiction_confidence":"verified","jurisdiction_context":"other"},"scoring_source_url":"https://cunicula.com/methodology#cunicula-score","jurisdiction_exposure":"other","primary_category":"Wallet","primary_bucket":"Wallet","corporate_identity":{"entity_type":"company","entity_type_note":"Publisher and Berlin address are disclosed in official imprint. A site-stated 2013 founding is not an independently verified legal incorporation date.","governance_model":"company-sponsored","repository_url":"https://github.com/spesmilo/electrum","legal_entity":"Electrum Technologies GmbH","registration_number":null,"registry_url":null,"incorporation_jurisdiction":"Germany, per publisher imprint","incorporation_date":null,"registered_address":"Paul-Lincke-Ufer 8 D, 10999 Berlin, Germany","parent_entity":null,"ultimate_owner":null,"prior_entities":[],"officers":[],"citations":{"legalEntity":{"url":"https://electrum.org/","note":null,"agent_verified":false},"incorporationJurisdiction":{"url":"https://electrum.org/","note":null,"agent_verified":false},"registeredAddress":{"url":"https://electrum.org/","note":null,"agent_verified":false},"entityType":{"url":"https://electrum.org/","note":null,"agent_verified":false},"governanceModel":{"url":"https://electrum.org/","note":null,"agent_verified":false}},"basis":"registry-sourced, not audited","agent_verified":false,"source":"Cited provider and public identity sources","reviewed_at":"2026-10-25"},"evidence_provenance":{"strongest_tier":"third-party-reported","tiers":["third-party-reported","self-reported"],"counts":{"directly-tested":0,"independent-audit":0,"third-party-reported":3,"self-reported":7},"total_sources":10},"privacy_score":100,"privacy_score_version":"3.1","privacy_factors":[{"key":"baseline","label":"Baseline","value":100,"detail":"Starting privacy exposure score"},{"key":"identity","label":"Identity exposure","value":0,"detail":"No required account or identity data recorded (level 0 of 4)"},{"key":"operator-context","label":"Operator context","value":0,"detail":"Local software or protocol with no hosted operator data"}],"evidence_confidence":87,"evidence_confidence_status":"deprecated","evidence_confidence_sunset_on":"2027-02-26","evidence_score_version":"3.1","evidence_factors":[{"key":"source-coverage","label":"Source coverage","value":70,"detail":"Material claims checked against current sources"},{"key":"freshness","label":"Review age","value":17,"detail":"Oldest recorded check is 91 days old"}],"score_computed_at":"2026-11-06T07:01:18.083Z","score_inputs":{"kycLevel":0,"noOperatorData":true,"jurisdiction":"DE","jurisdictionConfidence":"verified","evidenceStatus":"verified","checkedAt":"2026-10-25","lastReviewed":"2026-10-25","kycLastChecked":"2026-08-07"},"citation":{"canonical_url":"https://cunicula.com/en/provider/electrum","api_url":"https://cunicula.com/api/v1/services/electrum","schema_version":"1.1.0","publisher":"Cunicula","reviewed":"2026-10-25","retrieved":"2026-11-06","attribution":"Cunicula, \"Electrum\", cunicula.com, reviewed 2026-10-25, retrieved 2026-11-06, https://cunicula.com/en/provider/electrum","attribution_template":"Cunicula, \"{name}\", cunicula.com, reviewed {reviewed}, retrieved {retrieved}, {url}","license":"LicenseRef-Cunicula-Attribution-1.0","license_url":"https://cunicula.com/en/cite","cite_guide_url":"https://cunicula.com/en/cite"},"edit_history":[{"changed_at":"2026-10-25T16:29:26+11:00","action":"updated","why":"fix: refresh overdue sources and recover publication pipeline","source":{"commit":"5705a0837a385381243c579d4f1331a89843169e","url":"https://cunicula.com/en/provider/electrum#history-5705a0837a38","review_source":"official_source_review_2026-10-25"},"changes":[{"field":"checkedAt","operation":"changed","before":"2026-08-07","after":"2026-10-25"},{"field":"corporate.entityType.note","operation":"changed","before":"Official website Impressum and Privacy Policy state that Electrum Technologies GmbH hosts the site, built and provides the Electrum Wallet app/service, and distributes the software under MIT license.","after":"Publisher and Berlin address are disclosed in official imprint. A site-stated 2013 founding is not an independently verified legal incorporation date."},{"field":"corporate.incorporationDate.citation","operation":"changed","before":"https://lei.bloomberg.com/leis/view/984500AFC0FB96E0CB95","after":"unknown"},{"field":"corporate.incorporationDate.value","operation":"changed","before":"2015-02-03","after":"unknown"},{"field":"corporate.incorporationJurisdiction.citation","operation":"changed","before":"https://lei.bloomberg.com/leis/view/984500AFC0FB96E0CB95","after":"https://electrum.org/"},{"field":"corporate.incorporationJurisdiction.value","operation":"changed","before":"Germany","after":"Germany, per publisher imprint"},{"field":"corporate.officers.citation","operation":"changed","before":"https://www.northdata.com/Electrum%20Technologies%20GmbH,%20Berlin/Amtsgericht%20Charlottenburg%20(Berlin)%20HRB%20164636%20B","after":"unknown"},{"field":"corporate.officers.value","operation":"changed","before":["Thomas Voegtlin (Geschäftsführer)"],"after":[]},{"field":"corporate.parentEntity.citation","operation":"changed","before":"https://www.northdata.com/Electrum%20Technologies%20GmbH,%20Berlin/Amtsgericht%20Charlottenburg%20(Berlin)%20HRB%20164636%20B","after":"unknown"},{"field":"corporate.parentEntity.value","operation":"changed","before":"Voegtlin Holding GmbH","after":"unknown"},{"field":"corporate.registrationNumber.citation","operation":"changed","before":"https://www.northdata.com/Electrum%20Technologies%20GmbH,%20Berlin/Amtsgericht%20Charlottenburg%20(Berlin)%20HRB%20164636%20B","after":"unknown"},{"field":"corporate.registrationNumber.value","operation":"changed","before":"HRB 164636 B","after":"unknown"},{"field":"corporate.registryUrl.citation","operation":"changed","before":"https://www.northdata.com/Electrum%20Technologies%20GmbH,%20Berlin/Amtsgericht%20Charlottenburg%20(Berlin)%20HRB%20164636%20B","after":"unknown"},{"field":"corporate.registryUrl.value","operation":"changed","before":"https://www.northdata.com/Electrum%20Technologies%20GmbH,%20Berlin/Amtsgericht%20Charlottenburg%20(Berlin)%20HRB%20164636%20B","after":"unknown"},{"field":"corporate.reviewedAt","operation":"changed","before":"2026-08-09","after":"2026-10-25"},{"field":"corporate.source","operation":"changed","before":"corporate identity pass 2 (t_d7269d23), cited web research via grok web search","after":"Cited provider and public identity sources"},{"field":"followTheMoney","operation":"changed","before":"Electrum\n────────────────────────\nCreated by: Thomas Voegtlin, November 2011\nPublisher: Electrum Technologies GmbH, Berlin (founded 2013)\nModel: free MIT-licensed software\nReleases: reproducible, signed by several builders","after":"Electrum is free MIT-licensed Bitcoin wallet software created by Thomas Voegtlin in 2011. Its website names Electrum Technologies GmbH as publisher and says the company was founded in 2013."},{"field":"kycNote","operation":"changed","before":"No account, no signup, and no identity check. The software is downloaded and run locally, so there is no operator holding a customer record. The site states the wallet is distributed under the MIT licence by Electrum Technologies GmbH and that it does not store user account data.","after":"Local wallet use needs no account or identity check. Connected servers still receive wallet queries and connection data."},{"field":"lastReviewed","operation":"changed","before":"2026-08-07","after":"2026-10-25"},{"field":"privacyWarning","operation":"changed","before":"Electrum is a light client. Its own FAQ states the client subscribes its addresses to one main server, so that server can reasonably guess the addresses belong to the same entity, and all connected servers see the client IP address unless a proxy, VPN, or Tor is used. Confirmed transactions are checked with SPV, but the server is trusted for unconfirmed transactions and can lie by omission. Running your own server or connecting over Tor removes most of that exposure. The site also warns to download only from electrum.org and verify GPG signatures. Electrum 4.8.1 says it contains important security fixes whose details will be disclosed later, so the unresolved disclosure should be monitored.","after":"Public Electrum servers can link queried wallet addresses and see connection IPs. The developer reports a fee-bump attack affecting versions before 4.8.3, including a reported loss; 4.8.3 includes the fix. Tor hides the connection IP, not wallet queries. Optional public crash reports can include device and connection details."},{"field":"publicClaims.followTheMoney.reviewedAt","operation":"changed","before":"2026-08-07","after":"2026-10-25"},{"field":"publicClaims.followTheMoney.value","operation":"changed","before":"Electrum\n────────────────────────\nCreated by: Thomas Voegtlin, November 2011\nPublisher: Electrum Technologies GmbH, Berlin (founded 2013)\nModel: free MIT-licensed software\nReleases: reproducible, signed by several builders","after":"Electrum is free MIT-licensed Bitcoin wallet software created by Thomas Voegtlin in 2011. Its website names Electrum Technologies GmbH as publisher and says the company was founded in 2013."},{"field":"reviewSource","operation":"changed","before":"official_electrum_site_faq_repo_intake_2026-08-07","after":"official_source_review_2026-10-25"},{"field":"updatedAt","operation":"changed","before":"2026-08-07","after":"2026-10-25"}]},{"changed_at":"2026-08-27T08:50:11+10:00","action":"updated","why":"fix: reconcile score 4.0 evidence","source":{"commit":"18e788afe003dcb0febe08a578aaf9cb087161b2","url":"https://cunicula.com/en/provider/electrum#history-18e788afe003","review_source":"official_electrum_site_faq_repo_intake_2026-08-07"},"changes":[{"field":"scoreAssessment.controlModel","operation":"changed","before":"local-self-custody","after":"unknown"},{"field":"scoreAssessment.operatorDataExposure","operation":"changed","before":"none","after":"unknown"},{"field":"scoreAssessment.sourceModel","operation":"changed","before":"open-reproducible","after":"unknown"},{"field":"scoreReview","operation":"added","before":null,"after":{"outcome":"HOLD","checkedAt":"2026-08-25","inputs":{"operatorDataExposure":{"value":"unknown","sourceUrls":["https://electrum.org/","https://github.com/spesmilo/electrum/blob/master/RELEASE-NOTES","https://github.com/spesmilo/electrum/security/advisories/GHSA-vw94-r84p-66qf","https://github.com/spesmilo/electrum","https://github.com/spesmilo/electrum/security/advisories/GHSA-q7m2-785w-r585"],"reviewedAt":"2026-08-25","note":"The reviewed packet did not map this normalized Score 4.0 input to a field-level source; unknown is preserved until that mapping is completed."},"controlModel":{"value":"unknown","sourceUrls":["https://electrum.org/","https://github.com/spesmilo/electrum/blob/master/RELEASE-NOTES","https://github.com/spesmilo/electrum/security/advisories/GHSA-vw94-r84p-66qf","https://github.com/spesmilo/electrum","https://github.com/spesmilo/electrum/security/advisories/GHSA-q7m2-785w-r585"],"reviewedAt":"2026-08-25","note":"The reviewed packet did not map this normalized Score 4.0 input to a field-level source; unknown is preserved until that mapping is completed."},"sourceModel":{"value":"unknown","sourceUrls":["https://electrum.org/","https://github.com/spesmilo/electrum/blob/master/RELEASE-NOTES","https://github.com/spesmilo/electrum/security/advisories/GHSA-vw94-r84p-66qf","https://github.com/spesmilo/electrum","https://github.com/spesmilo/electrum/security/advisories/GHSA-q7m2-785w-r585"],"reviewedAt":"2026-08-25","note":"The reviewed packet did not map this normalized Score 4.0 input to a field-level source; unknown is preserved until that mapping is completed."}},"audit":{"scoreEligible":false,"reason":"No dated, scoped, current audit citation was normalized in the reviewed packet; legacy auditedBy labels receive no score credit."}}}]},{"changed_at":"2026-08-26T16:27:32+10:00","action":"updated","why":"feat: apply full-service rereview and score 4.0","source":{"commit":"faa73ed3ef3cfbd8ae2fbc31753e0d1ddc6b11cf","url":"https://cunicula.com/en/provider/electrum#history-faa73ed3ef3c","review_source":"official_electrum_site_faq_repo_intake_2026-08-07"},"changes":[{"field":"privacyWarning","operation":"changed","before":"Electrum is a light client. Its own FAQ states the client subscribes its addresses to one main server, so that server can reasonably guess the addresses belong to the same entity, and all connected servers see the client IP address unless a proxy, VPN, or Tor is used. Confirmed transactions are checked with SPV, but the server is trusted for unconfirmed transactions and can lie by omission. Running your own server or connecting over Tor removes most of that exposure. The site also warns to download only from electrum.org and verify GPG signatures.","after":"Electrum is a light client. Its own FAQ states the client subscribes its addresses to one main server, so that server can reasonably guess the addresses belong to the same entity, and all connected servers see the client IP address unless a proxy, VPN, or Tor is used. Confirmed transactions are checked with SPV, but the server is trusted for unconfirmed transactions and can lie by omission. Running your own server or connecting over Tor removes most of that exposure. The site also warns to download only from electrum.org and verify GPG signatures. Electrum 4.8.1 says it contains important security fixes whose details will be disclosed later, so the unresolved disclosure should be monitored."},{"field":"riskLevel","operation":"changed","before":"standard","after":"caution"},{"field":"scoreAssessment","operation":"added","before":null,"after":{"operatorDataExposure":"none","controlModel":"local-self-custody","sourceModel":"open-reproducible"}},{"field":"status","operation":"changed","before":"ok","after":"warning"}]},{"changed_at":"2026-08-09T15:16:51+10:00","action":"updated","why":"Corporate identity pass 2: research the remaining 94 services","source":{"commit":"25b8bccc09dd0af2333efb99f8e2f7ca15fd0140","url":"https://cunicula.com/en/provider/electrum#history-25b8bccc09dd","review_source":"official_electrum_site_faq_repo_intake_2026-08-07"},"changes":[{"field":"corporate","operation":"added","before":null,"after":{"entityType":{"value":"company","citation":"https://electrum.org/","note":"Official website Impressum and Privacy Policy state that Electrum Technologies GmbH hosts the site, built and provides the Electrum Wallet app/service, and distributes the software under MIT license."},"governanceModel":{"value":"company-sponsored","citation":"https://electrum.org/"},"repositoryUrl":{"value":"https://github.com/spesmilo/electrum","citation":"https://github.com/spesmilo/electrum"},"legalEntity":{"value":"Electrum Technologies GmbH","citation":"https://electrum.org/"},"registrationNumber":{"value":"HRB 164636 B","citation":"https://www.northdata.com/Electrum%20Technologies%20GmbH,%20Berlin/Amtsgericht%20Charlottenburg%20(Berlin)%20HRB%20164636%20B"},"registryUrl":{"value":"https://www.northdata.com/Electrum%20Technologies%20GmbH,%20Berlin/Amtsgericht%20Charlottenburg%20(Berlin)%20HRB%20164636%20B","citation":"https://www.northdata.com/Electrum%20Technologies%20GmbH,%20Berlin/Amtsgericht%20Charlottenburg%20(Berlin)%20HRB%20164636%20B"},"incorporationJurisdiction":{"value":"Germany","citation":"https://lei.bloomberg.com/leis/view/984500AFC0FB96E0CB95"},"incorporationDate":{"value":"2015-02-03","citation":"https://lei.bloomberg.com/leis/view/984500AFC0FB96E0CB95"},"registeredAddress":{"value":"Paul-Lincke-Ufer 8 D, 10999 Berlin, Germany","citation":"https://electrum.org/"},"parentEntity":{"value":"Voegtlin Holding GmbH","citation":"https://www.northdata.com/Electrum%20Technologies%20GmbH,%20Berlin/Amtsgericht%20Charlottenburg%20(Berlin)%20HRB%20164636%20B"},"officers":{"value":["Thomas Voegtlin (Geschäftsführer)"],"citation":"https://www.northdata.com/Electrum%20Technologies%20GmbH,%20Berlin/Amtsgericht%20Charlottenburg%20(Berlin)%20HRB%20164636%20B"},"source":"corporate identity pass 2 (t_d7269d23), cited web research via grok web search","reviewedAt":"2026-08-09"}}]},{"changed_at":"2026-08-08T07:57:20+10:00","action":"created","why":"feat(directory): intake Electrum and Forward Email","source":{"commit":"a6df7d4d817a34fb64ff5ccca2c2a1f6298145d0","url":"https://cunicula.com/en/provider/electrum#history-a6df7d4d817a","review_source":"official_electrum_site_faq_repo_intake_2026-08-07"},"changes":[{"field":"record","operation":"added","before":null,"after":"created"}]}],"history_scope":{"schema_version":"1.0.0","source_path":"data/services.json","source_repository":"https://cunicula.com/en/methodology#record-history","source_commit":"656629f3a2cfd1544249be7a37a0b0526c6bbe7e","record_identity":"id","scope":"Committed public record changes. Creation events are summarized; later events contain field-level before/after values. Internal affiliate and numeric identity fields are excluded, and unsupported public claims remain redacted.","event_count":5},"related_services":[{"slug":"bitbox02","name":"BitBox02","domain":"bitbox.swiss","url":"https://bitbox.swiss/","kyc":"none","kycLevel":2,"kycNote":"No document identity check is required to buy a device. The payment policy lists two processors: BTCPay for on-chain Bitcoin and Lightning, and Stripe for cards, bank transfers, PayPal, Apple Pay, and Google Pay. Available methods vary by country, so the checkout page decides which rails apply.","fee":"One-time hardware purchase","categories":["Wallet"],"countries":["GLOBAL"],"bestFor":["Cold storage","Bitcoin-only self-custody","Paying for hardware in Bitcoin"],"features":["Bitcoin-only edition","Multi-coin edition","Open source firmware","Swiss operator","On-chain Bitcoin checkout","Lightning checkout","microSD backup","BitBoxApp companion"],"tagline":"Swiss hardware signer with Bitcoin-only firmware and Lightning checkout.","status":"ok","updatedAt":"2026-08-07","description":"Swiss hardware wallet from Shift Crypto. The shop takes on-chain Bitcoin and Lightning through BTCPay, plus cards via Stripe.","cardSummary":"Swiss hardware signer taking BTC and Lightning.","networks":["BTC","LN"],"checkedAt":"2026-08-07","lastReviewed":"2026-08-07","reviewSource":"official_bitbox_payment_shipping_policy_intake_2026-08-07","jurisdictionConfidence":"verified","kycLastChecked":"2026-08-07","trending":false,"jurisdiction":"CH","evidenceStatus":"verified","riskLevel":"standard","privacyWarning":"BitBox02 is a physical product. Shift Crypto AG holds order and shipping data even when payment settles in Bitcoin or over Lightning. Orders ship from Swiss and German warehouses, and duties and taxes are prepaid on some routes, which adds a customs record.","auditedBy":[],"corporate":{"entityType":{"value":"company","citation":"https://bitbox.swiss/imprint/","note":"Official imprint, terms of service, and privacy policy state that BitBox is created and the website operated by Shift Crypto AG, a Swiss Aktiengesellschaft selling hardware wallets."},"governanceModel":{"value":"company-sponsored","citation":"https://bitbox.swiss/dev/"},"repositoryUrl":{"value":"https://github.com/BitBoxSwiss","citation":"https://github.com/BitBoxSwiss"},"legalEntity":{"value":"Shift Crypto AG","citation":"https://bitbox.swiss/imprint/"},"registrationNumber":{"value":"CHE-498.818.196 (commercial register CH-020.3.048.536-0; imprint also lists CH-498.818.196)","citation":"https://www.uid.admin.ch/Detail.aspx?uid_id=CHE-498.818.196"},"registryUrl":{"value":"https://www.uid.admin.ch/Detail.aspx?uid_id=CHE-498.818.196","citation":"https://www.uid.admin.ch/Detail.aspx?uid_id=CHE-498.818.196"},"incorporationJurisdiction":{"value":"Switzerland (Canton of Zurich)","citation":"https://bitbox.swiss/imprint/"},"incorporationDate":{"value":"2020-04-01","citation":"https://www.moneyhouse.ch/en/company/shift-crypto-ag-2790108461"},"registeredAddress":{"value":"Soodmattenstrasse 4, 8134 Adliswil, Switzerland","citation":"https://bitbox.swiss/imprint/"},"officers":{"value":["Douglas Bakkum (Member of the Board, CEO)"],"citation":"https://bitbox.swiss/imprint/"},"priorEntities":{"value":["Shift Cryptosecurity AG in Liquidation (formerly Shift Devices AG), UID CHE-149.201.586, commercial register CH-280.3.019.469-1; trademarks/domains/assets transferred into Shift Crypto AG on foundation"],"citation":"https://www.uid.admin.ch/Detail.aspx?uid_id=CHE-149.201.586"},"source":"corporate identity pass 2 (t_d7269d23), cited web research via grok web search","reviewedAt":"2026-08-09"},"twitter":"https://x.com/BitBoxSwiss","agentUsability":{"status":"hard-blocked","evidence":"No reviewed programmatic agent-payment profile is recorded; this dataset treats the service as hard-blocked until a control surface is documented.","derivedFrom":["agentMoney.compatible"]},"details_url":"https://cunicula.com/en/provider/bitbox02","canonical_score":39,"score_status":"rated","score_evidence":"limited","score_version":"4.0","score_breakdown":{"privacy":6,"control":0,"transparency":0,"security":25,"accountability":8},"applied_caps":[{"key":"closed-critical-core-without-audit","maximum":69,"reason":"A closed or unknown critical core without current audit evidence limits the score to 69."}],"score_rationale":["privacy: 6 of 25 points.","control: 0 of 20 points.","transparency: 0 of 20 points.","security: 25 of 25 points.","accountability: 8 of 10 points.","Limited evidence: operatorDataExposure, controlModel, sourceModel scored zero.","A closed or unknown critical core without current audit evidence limits the score to 69."],"last_scored":"2026-10-25","not_rated_reasons":[],"score_assessment":{"operatorDataExposure":"unknown","controlModel":"unknown","sourceModel":"unknown"},"score_review":{"outcome":"PASS","checkedAt":"2026-08-25","inputs":{"operatorDataExposure":{"value":"unknown","sourceUrls":["https://bitbox.swiss/","https://bitbox.swiss/policies/payment-policy/","https://bitbox.swiss/policies/privacy-policy","https://bitbox.swiss/policies/privacy-policy/","https://bitbox.swiss/imprint","https://bitbox.swiss/imprint/","https://github.com/BitBoxSwiss/bitbox02-firmware/releases"],"reviewedAt":"2026-08-25","note":"The reviewed packet did not map this normalized Score 4.0 input to a field-level source; unknown is preserved until that mapping is completed."},"controlModel":{"value":"unknown","sourceUrls":["https://bitbox.swiss/","https://bitbox.swiss/policies/payment-policy/","https://bitbox.swiss/policies/privacy-policy","https://bitbox.swiss/policies/privacy-policy/","https://bitbox.swiss/imprint","https://bitbox.swiss/imprint/","https://github.com/BitBoxSwiss/bitbox02-firmware/releases"],"reviewedAt":"2026-08-25","note":"The reviewed packet did not map this normalized Score 4.0 input to a field-level source; unknown is preserved until that mapping is completed."},"sourceModel":{"value":"unknown","sourceUrls":["https://bitbox.swiss/","https://bitbox.swiss/policies/payment-policy/","https://bitbox.swiss/policies/privacy-policy","https://bitbox.swiss/policies/privacy-policy/","https://bitbox.swiss/imprint","https://bitbox.swiss/imprint/","https://github.com/BitBoxSwiss/bitbox02-firmware/releases"],"reviewedAt":"2026-08-25","note":"The reviewed packet did not map this normalized Score 4.0 input to a field-level source; unknown is preserved until that mapping is completed."}},"audit":{"scoreEligible":false,"reason":"No dated, scoped, current audit citation was normalized in the reviewed packet; legacy auditedBy labels receive no score credit."}},"privacy_observations":{"identity_exposure_level":2,"identity_requirement":"none","hosted_operator_data":null,"jurisdiction":"CH","jurisdiction_confidence":"verified","jurisdiction_context":"other"},"scoring_source_url":"https://cunicula.com/methodology#cunicula-score","jurisdiction_exposure":"other","primary_category":"Wallet","primary_bucket":"Wallet","corporate_identity":{"entity_type":"company","entity_type_note":"Official imprint, terms of service, and privacy policy state that BitBox is created and the website operated by Shift Crypto AG, a Swiss Aktiengesellschaft selling hardware wallets.","governance_model":"company-sponsored","repository_url":"https://github.com/BitBoxSwiss","legal_entity":"Shift Crypto AG","registration_number":"CHE-498.818.196 (commercial register CH-020.3.048.536-0; imprint also lists CH-498.818.196)","registry_url":"https://www.uid.admin.ch/Detail.aspx?uid_id=CHE-498.818.196","incorporation_jurisdiction":"Switzerland (Canton of Zurich)","incorporation_date":"2020-04-01","registered_address":"Soodmattenstrasse 4, 8134 Adliswil, Switzerland","parent_entity":null,"ultimate_owner":null,"prior_entities":[{"name":"Shift Cryptosecurity AG in Liquidation (formerly Shift Devices AG), UID CHE-149.201.586, commercial register CH-280.3.019.469-1; trademarks/domains/assets transferred into Shift Crypto AG on foundation","detail":null}],"officers":[{"name":"Douglas Bakkum (Member of the Board, CEO)","role":null}],"citations":{"legalEntity":{"url":"https://bitbox.swiss/imprint/","note":null,"agent_verified":false},"registrationNumber":{"url":"https://www.uid.admin.ch/Detail.aspx?uid_id=CHE-498.818.196","note":null,"agent_verified":false},"incorporationJurisdiction":{"url":"https://bitbox.swiss/imprint/","note":null,"agent_verified":false},"incorporationDate":{"url":"https://www.moneyhouse.ch/en/company/shift-crypto-ag-2790108461","note":null,"agent_verified":false},"registeredAddress":{"url":"https://bitbox.swiss/imprint/","note":null,"agent_verified":false},"priorEntities":{"url":"https://www.uid.admin.ch/Detail.aspx?uid_id=CHE-149.201.586","note":null,"agent_verified":false},"officers":{"url":"https://bitbox.swiss/imprint/","note":null,"agent_verified":false},"entityType":{"url":"https://bitbox.swiss/imprint/","note":null,"agent_verified":false},"governanceModel":{"url":"https://bitbox.swiss/dev/","note":null,"agent_verified":false}},"basis":"registry-sourced, not audited","agent_verified":false,"source":"corporate identity pass 2 (t_d7269d23), cited web research via grok web search","reviewed_at":"2026-08-09"},"evidence_provenance":{"strongest_tier":"third-party-reported","tiers":["third-party-reported","self-reported"],"counts":{"directly-tested":0,"independent-audit":0,"third-party-reported":5,"self-reported":7},"total_sources":12},"privacy_score":60,"privacy_score_version":"3.1","privacy_factors":[{"key":"baseline","label":"Baseline","value":100,"detail":"Starting privacy exposure score"},{"key":"identity","label":"Identity exposure","value":-40,"detail":"Persistent contact, billing, or delivery data recorded (level 2 of 4)"},{"key":"operator-context","label":"Operator context","value":0,"detail":"Hosted operator; recorded jurisdiction: CH"}],"evidence_confidence":87,"evidence_confidence_status":"deprecated","evidence_confidence_sunset_on":"2027-02-26","evidence_score_version":"3.1","evidence_factors":[{"key":"source-coverage","label":"Source coverage","value":70,"detail":"Material claims checked against current sources"},{"key":"freshness","label":"Review age","value":17,"detail":"Oldest recorded check is 91 days old"}],"score_computed_at":"2026-11-06T07:01:18.083Z","score_inputs":{"kycLevel":2,"noOperatorData":false,"jurisdiction":"CH","jurisdictionConfidence":"verified","evidenceStatus":"verified","checkedAt":"2026-08-07","lastReviewed":"2026-08-07","kycLastChecked":"2026-08-07"}},{"slug":"cake-wallet","name":"Cake Wallet","domain":"cakewallet.com","url":"https://cakewallet.com/","kyc":"none","kycLevel":0,"kycNote":"Wallet keys stay on your device. Swap and purchase providers may request personal information; their identity rules are separate from base wallet use.","fee":"Free app; network and third-party service fees apply.","categories":["Wallet"],"countries":["GLOBAL"],"features":["XMR, ZEC, BTC and LTC","Self-custody","Third-party swaps","Open source","iOS and Android"],"status":"warning","updatedAt":"2026-10-25","description":"Self-custodial wallet for XMR, ZEC, BTC and LTC with built-in third-party swaps.","cardSummary":"Multi-coin wallet with built-in swaps.","networks":[],"checkedAt":"2026-10-25","lastReviewed":"2026-10-25","reviewSource":"official_source_review_2026-10-25","jurisdictionConfidence":"inferred","kycLastChecked":"2026-10-25","trending":true,"jurisdiction":"US","noOperatorData":false,"evidenceStatus":"partial","riskLevel":"standard","privacyWarning":"Cake Labs nodes may transiently receive IP address, wallet sync height, and submitted transactions/channels but state they do not retain them. Optional third-party buy/sell and swap services have separate privacy/KYC practices and may request personal information.","auditedBy":null,"corporate":{"entityType":{"value":"company","citation":"https://cakewallet.com/terms/","note":"Official Terms of Use state the apps are provided by Cake Labs LLC, a limited liability company formed under the laws of Nevis; security page and copyright also name Cake Labs LLC as developer."},"governanceModel":{"value":"company-sponsored","citation":"https://cakelabs.com/"},"repositoryUrl":{"value":"https://github.com/cake-tech/cake_wallet","citation":"https://github.com/cake-tech/cake_wallet"},"legalEntity":{"value":"Cake Labs LLC","citation":"https://cakewallet.com/terms/"},"incorporationJurisdiction":{"value":"Nevis (Saint Kitts and Nevis)","citation":"https://cakewallet.com/terms/"},"officers":{"value":[{"name":"Vikrant Sharma","role":"CEO / Founder"},{"name":"Seth For Privacy","role":"COO"}],"citation":"https://cakewallet.com/about/"},"priorEntities":{"value":[],"citation":"unknown"},"source":"corporate identity pass 2 (t_d7269d23), cited web research via grok web search","reviewedAt":"2026-08-09"},"publicClaims":{"followTheMoney":{"value":"Cake Wallet\n────────────────────────\nFounder and CEO: Vikrant Sharma\nCake Wallet founded: 2018\nCake Labs founded: 2017\nSoftware: open source","reviewedAt":"2026-07-15","sources":[{"label":"Cake Wallet - About","href":"https://cakewallet.com/about/","type":"official"}]}},"followTheMoney":"Cake Wallet\n────────────────────────\nFounder and CEO: Vikrant Sharma\nCake Wallet founded: 2018\nCake Labs founded: 2017\nSoftware: open source","agentUsability":{"status":"hard-blocked","evidence":"No reviewed programmatic agent-payment profile is recorded; this dataset treats the service as hard-blocked until a control surface is documented.","derivedFrom":["agentMoney.compatible"]},"details_url":"https://cunicula.com/en/provider/cake-wallet","canonical_score":43,"score_status":"rated","score_evidence":"limited","score_version":"4.0","score_breakdown":{"privacy":12,"control":0,"transparency":0,"security":25,"accountability":6},"applied_caps":[{"key":"closed-critical-core-without-audit","maximum":69,"reason":"A closed or unknown critical core without current audit evidence limits the score to 69."}],"score_rationale":["privacy: 12 of 25 points.","control: 0 of 20 points.","transparency: 0 of 20 points.","security: 25 of 25 points.","accountability: 6 of 10 points.","Limited evidence: operatorDataExposure, controlModel, sourceModel scored zero.","A closed or unknown critical core without current audit evidence limits the score to 69."],"last_scored":"2026-10-25","not_rated_reasons":[],"score_assessment":{"operatorDataExposure":"unknown","controlModel":"unknown","sourceModel":"unknown"},"score_review":{"outcome":"HOLD","checkedAt":"2026-08-25","inputs":{"operatorDataExposure":{"value":"unknown","sourceUrls":["https://cakewallet.com/","https://cakewallet.com/terms/","https://cakewallet.com/privacy/","https://cakewallet.com/security/","https://github.com/cake-tech/cake_wallet/releases/tag/v6.4.1","https://status.cakewallet.com/api/status-page/cake/badge","https://status.cakewallet.com/api/status-page/cake"],"reviewedAt":"2026-08-25","note":"The reviewed packet did not map this normalized Score 4.0 input to a field-level source; unknown is preserved until that mapping is completed."},"controlModel":{"value":"unknown","sourceUrls":["https://cakewallet.com/","https://cakewallet.com/terms/","https://cakewallet.com/privacy/","https://cakewallet.com/security/","https://github.com/cake-tech/cake_wallet/releases/tag/v6.4.1","https://status.cakewallet.com/api/status-page/cake/badge","https://status.cakewallet.com/api/status-page/cake"],"reviewedAt":"2026-08-25","note":"The reviewed packet did not map this normalized Score 4.0 input to a field-level source; unknown is preserved until that mapping is completed."},"sourceModel":{"value":"unknown","sourceUrls":["https://cakewallet.com/","https://cakewallet.com/terms/","https://cakewallet.com/privacy/","https://cakewallet.com/security/","https://github.com/cake-tech/cake_wallet/releases/tag/v6.4.1","https://status.cakewallet.com/api/status-page/cake/badge","https://status.cakewallet.com/api/status-page/cake"],"reviewedAt":"2026-08-25","note":"The reviewed packet did not map this normalized Score 4.0 input to a field-level source; unknown is preserved until that mapping is completed."}},"audit":{"scoreEligible":false,"reason":"No dated, scoped, current audit citation was normalized in the reviewed packet; legacy auditedBy labels receive no score credit."}},"privacy_observations":{"identity_exposure_level":0,"identity_requirement":"none","hosted_operator_data":true,"jurisdiction":"US","jurisdiction_confidence":"inferred","jurisdiction_context":"five_eyes"},"scoring_source_url":"https://cunicula.com/methodology#cunicula-score","jurisdiction_exposure":"five_eyes","primary_category":"Wallet","primary_bucket":"Wallet","corporate_identity":{"entity_type":"company","entity_type_note":"Official Terms of Use state the apps are provided by Cake Labs LLC, a limited liability company formed under the laws of Nevis; security page and copyright also name Cake Labs LLC as developer.","governance_model":"company-sponsored","repository_url":"https://github.com/cake-tech/cake_wallet","legal_entity":"Cake Labs LLC","registration_number":null,"registry_url":null,"incorporation_jurisdiction":"Nevis (Saint Kitts and Nevis)","incorporation_date":null,"registered_address":null,"parent_entity":null,"ultimate_owner":null,"prior_entities":[],"officers":[{"name":"Vikrant Sharma","role":"CEO / Founder"},{"name":"Seth For Privacy","role":"COO"}],"citations":{"legalEntity":{"url":"https://cakewallet.com/terms/","note":null,"agent_verified":false},"incorporationJurisdiction":{"url":"https://cakewallet.com/terms/","note":null,"agent_verified":false},"officers":{"url":"https://cakewallet.com/about/","note":null,"agent_verified":false},"entityType":{"url":"https://cakewallet.com/terms/","note":null,"agent_verified":false},"governanceModel":{"url":"https://cakelabs.com/","note":null,"agent_verified":false}},"basis":"registry-sourced, not audited","agent_verified":false,"source":"corporate identity pass 2 (t_d7269d23), cited web research via grok web search","reviewed_at":"2026-08-09"},"evidence_provenance":{"strongest_tier":"third-party-reported","tiers":["third-party-reported","self-reported"],"counts":{"directly-tested":0,"independent-audit":0,"third-party-reported":2,"self-reported":6},"total_sources":8},"privacy_score":100,"privacy_score_version":"3.1","privacy_factors":[{"key":"baseline","label":"Baseline","value":100,"detail":"Starting privacy exposure score"},{"key":"identity","label":"Identity exposure","value":0,"detail":"No required account or identity data recorded (level 0 of 4)"},{"key":"operator-context","label":"Operator context","value":0,"detail":"Hosted operator; inferred jurisdiction: US"}],"evidence_confidence":72,"evidence_confidence_status":"deprecated","evidence_confidence_sunset_on":"2027-02-26","evidence_score_version":"3.1","evidence_factors":[{"key":"source-coverage","label":"Source coverage","value":42,"detail":"Some material claims still need confirmation"},{"key":"freshness","label":"Review age","value":30,"detail":"All recorded checks are within 30 days"}],"score_computed_at":"2026-11-06T07:01:18.084Z","score_inputs":{"kycLevel":0,"noOperatorData":false,"jurisdiction":"US","jurisdictionConfidence":"inferred","evidenceStatus":"partial","checkedAt":"2026-10-25","lastReviewed":"2026-10-25","kycLastChecked":"2026-10-25"}},{"slug":"coldcard","name":"Coldcard","domain":"coldcard.com","url":"https://coldcard.com/","kyc":"none","kycLevel":0,"kycNote":"No account, no KYC for firmware use. Hardware purchase may expose shipping address.","fee":"Mk5 USD 189; Q USD 289","categories":["Wallet","Privacy Tools"],"countries":["GLOBAL"],"bestFor":["Cold storage","Air-gapped Bitcoin signing","Maximum self-custody"],"features":["Air-gapped signing","Bitcoin-only","Verifiable firmware source","Duress PIN","PSBT via MicroSD","Sparrow compatible","No companion app required","Dual secure elements","Mk5 and Q models"],"tagline":null,"status":"ok","updatedAt":"2026-09-05","description":"Bitcoin-only air-gapped hardware signer by Coinkite with PSBT signing over MicroSD or QR and duress PIN support.","cardSummary":"Bitcoin-only air-gapped hardware signer.","networks":["BTC"],"checkedAt":"2026-08-25","lastReviewed":"2026-09-05","reviewSource":"https://coldcard.com/security/status","jurisdictionConfidence":"verified","kycLastChecked":"2026-09-05","trending":false,"jurisdiction":"CA","evidenceStatus":"verified","riskLevel":"danger","privacyWarning":"A July 2026 firmware random-number-generator defect weakened seeds generated on affected Coldcard versions and was exploited offline to steal funds. Devices were not remotely hacked. Installing fixed firmware does not repair an existing weak seed. Users who generated a seed on an affected version must follow Coinkite's migration procedure and move funds to a new seed unless the documented dice-roll exception applies.","auditedBy":[],"corporate":{"entityType":{"value":"company","citation":"https://coldcard.com/about","note":"Official Coldcard about page and Coinkite terms state Coldcard is made by Coinkite Inc., a real operating Canadian vendor/shop."},"governanceModel":{"value":"company-sponsored","citation":"https://coldcard.com/about"},"repositoryUrl":{"value":"https://github.com/Coldcard/firmware","citation":"https://github.com/Coldcard/firmware"},"legalEntity":{"value":"Coinkite Inc.","citation":"https://coldcard.com/about"},"incorporationJurisdiction":{"value":"Ontario, Canada","citation":"https://coinkite.com/terms-of-use"},"registeredAddress":{"value":"3219 Yonge St., Unit 376, Toronto, ON M4N 3S1, Canada","citation":"https://coinkite.com/terms-of-use"},"source":"corporate identity pass 2 (t_d7269d23), cited web research via grok web search","reviewedAt":"2026-08-09"},"twitter":"https://x.com/COLDCARDwallet","incidents":[{"title":"2021-2026 firmware RNG entropy defect and Bitcoin theft","status":"monitoring","severity":"critical","startedAt":"2026-07-30","summary":"Affected firmware could generate wallet seeds through a deterministic software fallback rather than the hardware RNG. Affected releases include Mk2 and Mk3 4.0.1 through 4.1.9, Mk4 and Mk5 before 5.6.0, Q before 1.5.0Q, and Edge before 6.6.0X or 6.6.0QX. Current recommended standard releases are Mk4 and Mk5 5.6.2 and Q 1.5.2Q. Updating firmware prevents newly affected seeds but does not repair an existing affected seed. A BIP-39 passphrase does not repair the seed; users must migrate under the official guidance unless its exact independent-dice condition applies. The formal technical postmortem remains unpublished.","directUserHarm":true,"customerDataOrAssetsCompromised":true,"disclosure":"delayed","remediation":"partial","sources":[{"label":"Coinkite security advisory","href":"https://blog.coinkite.com/coldcard-mk3-seed-generation-warning/"},{"label":"Coinkite technical backgrounder","href":"https://blog.coinkite.com/entropy-technical-backgrounder/"},{"label":"Coldcard firmware changelog","href":"https://github.com/Coldcard/firmware/blob/master/releases/ChangeLog.md"},{"label":"Block Engineering independent analysis","href":"https://engineering.block.xyz/blog/predictable-rng-fallback-and-32-bit-reseed-in-coldcard-firmware"},{"label":"COLDCARD current security status and release guidance","href":"https://coldcard.com/security/status"},{"label":"COLDCARD affected-seed migration guide","href":"https://coldcard.com/security/migrate"}]}],"agentUsability":{"status":"hard-blocked","evidence":"No reviewed programmatic agent-payment profile is recorded; this dataset treats the service as hard-blocked until a control surface is documented.","derivedFrom":["agentMoney.compatible"]},"details_url":"https://cunicula.com/en/provider/coldcard","canonical_score":19,"score_status":"rated","score_evidence":"limited","score_version":"4.0","score_breakdown":{"privacy":12,"control":0,"transparency":0,"security":0,"accountability":7},"applied_caps":[{"key":"active-critical-incident","maximum":20,"reason":"An unresolved critical incident limits the score to 20."},{"key":"unresolved-material-compromise","maximum":49,"reason":"An unresolved customer-data or asset compromise limits the score to 49."},{"key":"closed-critical-core-without-audit","maximum":69,"reason":"A closed or unknown critical core without current audit evidence limits the score to 69."}],"score_rationale":["privacy: 12 of 25 points.","control: 0 of 20 points.","transparency: 0 of 20 points.","security: 0 of 25 points.","accountability: 7 of 10 points.","Limited evidence: operatorDataExposure, controlModel, sourceModel scored zero.","An unresolved critical incident limits the score to 20.","An unresolved customer-data or asset compromise limits the score to 49.","A closed or unknown critical core without current audit evidence limits the score to 69."],"last_scored":"2026-10-25","not_rated_reasons":[],"score_assessment":{"operatorDataExposure":"unknown","controlModel":"unknown","sourceModel":"unknown"},"score_review":{"outcome":"HOLD","checkedAt":"2026-08-25","inputs":{"operatorDataExposure":{"value":"unknown","sourceUrls":["https://coldcard.com/security/status","https://x.com/COLDCARDwallet/status/2083155034762621425","https://x.com/Coinkite/status/2084630256296624637","https://x.com/COLDCARDwallet/status/2090459345301488071","https://coldcard.com/"],"reviewedAt":"2026-08-25","note":"The reviewed packet did not map this normalized Score 4.0 input to a field-level source; unknown is preserved until that mapping is completed."},"controlModel":{"value":"unknown","sourceUrls":["https://coldcard.com/security/status","https://x.com/COLDCARDwallet/status/2083155034762621425","https://x.com/Coinkite/status/2084630256296624637","https://x.com/COLDCARDwallet/status/2090459345301488071","https://coldcard.com/"],"reviewedAt":"2026-08-25","note":"The reviewed packet did not map this normalized Score 4.0 input to a field-level source; unknown is preserved until that mapping is completed."},"sourceModel":{"value":"unknown","sourceUrls":["https://coldcard.com/security/status","https://x.com/COLDCARDwallet/status/2083155034762621425","https://x.com/Coinkite/status/2084630256296624637","https://x.com/COLDCARDwallet/status/2090459345301488071","https://coldcard.com/"],"reviewedAt":"2026-08-25","note":"The reviewed packet did not map this normalized Score 4.0 input to a field-level source; unknown is preserved until that mapping is completed."}},"audit":{"scoreEligible":false,"reason":"No dated, scoped, current audit citation was normalized in the reviewed packet; legacy auditedBy labels receive no score credit."}},"privacy_observations":{"identity_exposure_level":0,"identity_requirement":"none","hosted_operator_data":null,"jurisdiction":"CA","jurisdiction_confidence":"verified","jurisdiction_context":"five_eyes"},"scoring_source_url":"https://cunicula.com/methodology#cunicula-score","jurisdiction_exposure":"five_eyes","primary_category":"Wallet","primary_bucket":"Wallet","corporate_identity":{"entity_type":"company","entity_type_note":"Official Coldcard about page and Coinkite terms state Coldcard is made by Coinkite Inc., a real operating Canadian vendor/shop.","governance_model":"company-sponsored","repository_url":"https://github.com/Coldcard/firmware","legal_entity":"Coinkite Inc.","registration_number":null,"registry_url":null,"incorporation_jurisdiction":"Ontario, Canada","incorporation_date":null,"registered_address":"3219 Yonge St., Unit 376, Toronto, ON M4N 3S1, Canada","parent_entity":null,"ultimate_owner":null,"prior_entities":[],"officers":[],"citations":{"legalEntity":{"url":"https://coldcard.com/about","note":null,"agent_verified":false},"incorporationJurisdiction":{"url":"https://coinkite.com/terms-of-use","note":null,"agent_verified":false},"registeredAddress":{"url":"https://coinkite.com/terms-of-use","note":null,"agent_verified":false},"entityType":{"url":"https://coldcard.com/about","note":null,"agent_verified":false},"governanceModel":{"url":"https://coldcard.com/about","note":null,"agent_verified":false}},"basis":"registry-sourced, not audited","agent_verified":false,"source":"corporate identity pass 2 (t_d7269d23), cited web research via grok web search","reviewed_at":"2026-08-09"},"evidence_provenance":{"strongest_tier":"third-party-reported","tiers":["third-party-reported","self-reported"],"counts":{"directly-tested":0,"independent-audit":0,"third-party-reported":7,"self-reported":5},"total_sources":12},"privacy_score":100,"privacy_score_version":"3.1","privacy_factors":[{"key":"baseline","label":"Baseline","value":100,"detail":"Starting privacy exposure score"},{"key":"identity","label":"Identity exposure","value":0,"detail":"No required account or identity data recorded (level 0 of 4)"},{"key":"operator-context","label":"Operator context","value":0,"detail":"Hosted operator; recorded jurisdiction: CA (Five Eyes context)"}],"evidence_confidence":94,"evidence_confidence_status":"deprecated","evidence_confidence_sunset_on":"2027-02-26","evidence_score_version":"3.1","evidence_factors":[{"key":"source-coverage","label":"Source coverage","value":70,"detail":"Material claims checked against current sources"},{"key":"freshness","label":"Review age","value":24,"detail":"Oldest recorded check is 73 days old"}],"score_computed_at":"2026-11-06T07:01:18.084Z","score_inputs":{"kycLevel":0,"noOperatorData":false,"jurisdiction":"CA","jurisdictionConfidence":"verified","evidenceStatus":"verified","checkedAt":"2026-08-25","lastReviewed":"2026-09-05","kycLastChecked":"2026-09-05"}},{"slug":"feather-wallet","name":"Feather Wallet","domain":"featherwallet.org","url":"https://featherwallet.org/","kyc":"none","kycLevel":0,"kycNote":"Advertises No-KYC, but strictly adhere to OPSEC rules. Access via Tor, pay with XMR.","fee":"Free","categories":["Wallet"],"countries":["GLOBAL"],"features":["XMR only","Electrum-like","Tor built-in","Tails OS support","Coin control"],"status":"ok","updatedAt":"2026-08-27","changedAt":"2026-08-27","description":"A free, open-source Monero wallet for desktop. Connects via Tor by default, heavily optimized for privacy and power users.","cardSummary":"Monero desktop wallet that connects over Tor.","networks":[],"checkedAt":"2026-08-27","lastReviewed":"2026-08-27","reviewSource":"Primary-source review 2026-08-27","jurisdictionConfidence":"unknown","kycLastChecked":"2026-08-27","trending":false,"jurisdiction":null,"evidenceStatus":"verified","riskLevel":"caution","privacyWarning":"Feather bundles Tor, but by default routes all network traffic over Tor except wallet synchronization. Synchronization contacts a node, while websocket features fetch fiat price, CCS and block-height data and the updater contacts featherwallet.org; users with stronger threat models should configure always-over-Tor or a local node.","auditedBy":[],"corporate":{"entityType":{"value":"project-no-legal-entity","citation":"https://docs.featherwallet.org/guides/about","note":"Official docs state Feather Wallet was created by individuals dsc, tobtoht, and contributors as free open-source software funded solely via Monero CCS and donations, with no company or legal entity referenced on the site, GitHub, or license."},"governanceModel":{"value":"maintainer-group","citation":"https://docs.featherwallet.org/guides/about"},"repositoryUrl":{"value":"https://github.com/feather-wallet/feather","citation":"https://github.com/feather-wallet/feather"},"source":"corporate identity pass 2 (t_d7269d23), cited web research via grok web search","reviewedAt":"2026-08-09"},"twitter":null,"telegram":"https://t.me/featherwallet","agentUsability":{"status":"hard-blocked","evidence":"No reviewed programmatic agent-payment profile is recorded; this dataset treats the service as hard-blocked until a control surface is documented.","derivedFrom":["agentMoney.compatible"]},"details_url":"https://cunicula.com/en/provider/feather-wallet","canonical_score":76,"score_status":"rated","score_evidence":"reviewed","score_version":"4.0","score_breakdown":{"privacy":21,"control":20,"transparency":12,"security":17,"accountability":6},"applied_caps":[],"score_rationale":["privacy: 21 of 25 points.","control: 20 of 20 points.","transparency: 12 of 20 points.","security: 17 of 25 points.","accountability: 6 of 10 points."],"last_scored":"2026-10-25","not_rated_reasons":[],"score_assessment":{"operatorDataExposure":"limited","controlModel":"local-self-custody","sourceModel":"open"},"score_review":{"outcome":"PASS","checkedAt":"2026-08-27","inputs":{"operatorDataExposure":{"value":"limited","sourceUrls":["https://docs.featherwallet.org/guides/network-traffic","https://docs.featherwallet.org/guides/tor-support"],"reviewedAt":"2026-08-27","note":"The local wallet does not require an operator account, but remote-node synchronization and optional direct-clearnet traffic expose limited network metadata."},"controlModel":{"value":"local-self-custody","sourceUrls":["https://docs.featherwallet.org/guides/about","https://github.com/feather-wallet/feather"],"reviewedAt":"2026-08-27","note":"Seeds and signing remain on the user device; the user controls the wallet and can connect a local node."},"sourceModel":{"value":"open","sourceUrls":["https://docs.featherwallet.org/guides/about","https://github.com/feather-wallet/feather"],"reviewedAt":"2026-08-27","note":"The official documentation identifies the BSD-3 repository; no reproducible-build evidence was located."}},"audit":{"scoreEligible":false,"reason":"No dated, scoped independent audit of the score-critical core was evidenced in the reopened first-party source family."}},"privacy_observations":{"identity_exposure_level":0,"identity_requirement":"none","hosted_operator_data":null,"jurisdiction":null,"jurisdiction_confidence":"unknown","jurisdiction_context":"unknown"},"scoring_source_url":"https://cunicula.com/methodology#cunicula-score","jurisdiction_exposure":"unknown","primary_category":"Wallet","primary_bucket":"Wallet","corporate_identity":{"entity_type":"project-no-legal-entity","entity_type_note":"Official docs state Feather Wallet was created by individuals dsc, tobtoht, and contributors as free open-source software funded solely via Monero CCS and donations, with no company or legal entity referenced on the site, GitHub, or license.","governance_model":"maintainer-group","repository_url":"https://github.com/feather-wallet/feather","legal_entity":null,"registration_number":null,"registry_url":null,"incorporation_jurisdiction":null,"incorporation_date":null,"registered_address":null,"parent_entity":null,"ultimate_owner":null,"prior_entities":[],"officers":[],"citations":{"entityType":{"url":"https://docs.featherwallet.org/guides/about","note":null,"agent_verified":false},"governanceModel":{"url":"https://docs.featherwallet.org/guides/about","note":null,"agent_verified":false}},"basis":"registry-sourced, not audited","agent_verified":false,"source":"corporate identity pass 2 (t_d7269d23), cited web research via grok web search","reviewed_at":"2026-08-09"},"evidence_provenance":{"strongest_tier":"third-party-reported","tiers":["third-party-reported","self-reported"],"counts":{"directly-tested":0,"independent-audit":0,"third-party-reported":1,"self-reported":2},"total_sources":3},"privacy_score":100,"privacy_score_version":"3.1","privacy_factors":[{"key":"baseline","label":"Baseline","value":100,"detail":"Starting privacy exposure score"},{"key":"identity","label":"Identity exposure","value":0,"detail":"No required account or identity data recorded (level 0 of 4)"},{"key":"operator-context","label":"Operator context","value":0,"detail":"Hosted operator with unknown jurisdiction"}],"evidence_confidence":94,"evidence_confidence_status":"deprecated","evidence_confidence_sunset_on":"2027-02-26","evidence_score_version":"3.1","evidence_factors":[{"key":"source-coverage","label":"Source coverage","value":70,"detail":"Material claims checked against current sources"},{"key":"freshness","label":"Review age","value":24,"detail":"Oldest recorded check is 71 days old"}],"score_computed_at":"2026-11-06T07:01:18.084Z","score_inputs":{"kycLevel":0,"noOperatorData":false,"jurisdiction":null,"jurisdictionConfidence":"unknown","evidenceStatus":"verified","checkedAt":"2026-08-27","lastReviewed":"2026-08-27","kycLastChecked":"2026-08-27"}},{"slug":"foundation-passport","name":"Foundation Passport Prime","domain":"foundation.xyz","url":"https://foundation.xyz/","kyc":"none","kycLevel":0,"kycNote":"Orders involve contact, shipping, payment and fraud checks. Store accounts and device signing are separate.","fee":"Hardware purchase; price, currency, taxes and shipping depend on checkout.","categories":["Wallet"],"countries":["GLOBAL"],"bestFor":["Bitcoin self-custody","Hardware login approvals","Encrypted file storage"],"features":["Bitcoin wallet","Offline 2FA codes","NFC/USB security keys","50GB encrypted storage","KeyOS microkernel","Sandboxed open-source apps","Encrypted QuantumLink Bluetooth","Envoy companion app","Physical approval"],"tagline":"Hardware for Bitcoin keys, login approvals and encrypted files.","status":"ok","updatedAt":"2026-10-25","description":"Passport Prime is open-source human-authority hardware combining a Bitcoin wallet, offline 2FA codes, NFC/USB security keys, 50GB encrypted storage and sandboxed KeyOS apps.","cardSummary":"Passport Prime for Bitcoin keys, 2FA and encrypted files.","networks":["BTC"],"checkedAt":"2026-10-25","lastReviewed":"2026-10-25","reviewSource":"https://foundation.xyz/security","jurisdictionConfidence":"unknown","kycLastChecked":"2026-10-25","trending":false,"jurisdiction":null,"evidenceStatus":"partial","riskLevel":"caution","privacyWarning":"Prime uses Bluetooth, USB and NFC; it is not the older QR-only Passport Core. Purchases, support and website use can expose contact, payment and device data.","auditedBy":["Keylabs (Passport Prime hardware audit, 2025)"],"corporate":{"entityType":{"value":"company","citation":"https://foundation.xyz/policies/imprint","note":"Current imprint and terms name Foundation Devices, Inc.; no independent registry verification is claimed."},"governanceModel":{"value":"company-sponsored","citation":"https://foundation.xyz/policies/terms-of-service"},"repositoryUrl":{"value":"https://github.com/Foundation-Devices","citation":"https://github.com/Foundation-Devices"},"legalEntity":{"value":"Foundation Devices, Inc.","citation":"https://foundation.xyz/policies/imprint"},"registrationNumber":{"value":"unknown","citation":"unknown"},"registryUrl":{"value":"unknown","citation":"unknown"},"incorporationJurisdiction":{"value":"unknown","citation":"unknown"},"incorporationDate":{"value":"unknown","citation":"unknown"},"registeredAddress":{"value":"6 Liberty Square #6018, Boston, MA 02109, United States","citation":"https://foundation.xyz/policies/imprint"},"officers":{"value":[{"name":"Zach Herbert","role":"Cofounder and CEO"}],"citation":"https://foundation.xyz/blog/foundation-raises-6-4m-human-authority-hardware-launch"},"source":"Foundation imprint, terms and funding announcement.","reviewedAt":"2026-10-25"},"twitter":"https://x.com/FOUNDATIONdvcs","agentUsability":{"status":"hard-blocked","evidence":"No reviewed programmatic agent-payment profile is recorded; this dataset treats the service as hard-blocked until a control surface is documented.","derivedFrom":["agentMoney.compatible"]},"details_url":"https://cunicula.com/en/provider/foundation-passport","canonical_score":35,"score_status":"rated","score_evidence":"limited","score_version":"4.0","score_breakdown":{"privacy":12,"control":0,"transparency":0,"security":17,"accountability":6},"applied_caps":[{"key":"closed-critical-core-without-audit","maximum":69,"reason":"A closed or unknown critical core without current audit evidence limits the score to 69."}],"score_rationale":["privacy: 12 of 25 points.","control: 0 of 20 points.","transparency: 0 of 20 points.","security: 17 of 25 points.","accountability: 6 of 10 points.","Limited evidence: operatorDataExposure, controlModel, sourceModel scored zero.","A closed or unknown critical core without current audit evidence limits the score to 69."],"last_scored":"2026-10-25","not_rated_reasons":[],"score_assessment":{"operatorDataExposure":"unknown","controlModel":"unknown","sourceModel":"unknown"},"score_review":{"outcome":"PASS","checkedAt":"2026-08-25","inputs":{"operatorDataExposure":{"value":"unknown","sourceUrls":["https://foundation.xyz/","https://foundation.xyz/security","https://foundation.xyz/policies/terms-of-service"],"reviewedAt":"2026-08-25","note":"The reviewed packet did not map this normalized Score 4.0 input to a field-level source; unknown is preserved until that mapping is completed."},"controlModel":{"value":"unknown","sourceUrls":["https://foundation.xyz/","https://foundation.xyz/security","https://foundation.xyz/policies/terms-of-service"],"reviewedAt":"2026-08-25","note":"The reviewed packet did not map this normalized Score 4.0 input to a field-level source; unknown is preserved until that mapping is completed."},"sourceModel":{"value":"unknown","sourceUrls":["https://foundation.xyz/","https://foundation.xyz/security","https://foundation.xyz/policies/terms-of-service"],"reviewedAt":"2026-08-25","note":"The reviewed packet did not map this normalized Score 4.0 input to a field-level source; unknown is preserved until that mapping is completed."}},"audit":{"scoreEligible":false,"reason":"No dated, scoped, current audit citation was normalized in the reviewed packet; legacy auditedBy labels receive no score credit."}},"privacy_observations":{"identity_exposure_level":0,"identity_requirement":"none","hosted_operator_data":null,"jurisdiction":null,"jurisdiction_confidence":"unknown","jurisdiction_context":"unknown"},"scoring_source_url":"https://cunicula.com/methodology#cunicula-score","jurisdiction_exposure":"unknown","primary_category":"Wallet","primary_bucket":"Wallet","corporate_identity":{"entity_type":"company","entity_type_note":"Current imprint and terms name Foundation Devices, Inc.; no independent registry verification is claimed.","governance_model":"company-sponsored","repository_url":"https://github.com/Foundation-Devices","legal_entity":"Foundation Devices, Inc.","registration_number":null,"registry_url":null,"incorporation_jurisdiction":null,"incorporation_date":null,"registered_address":"6 Liberty Square #6018, Boston, MA 02109, United States","parent_entity":null,"ultimate_owner":null,"prior_entities":[],"officers":[{"name":"Zach Herbert","role":"Cofounder and CEO"}],"citations":{"legalEntity":{"url":"https://foundation.xyz/policies/imprint","note":null,"agent_verified":false},"registeredAddress":{"url":"https://foundation.xyz/policies/imprint","note":null,"agent_verified":false},"officers":{"url":"https://foundation.xyz/blog/foundation-raises-6-4m-human-authority-hardware-launch","note":null,"agent_verified":false},"entityType":{"url":"https://foundation.xyz/policies/imprint","note":null,"agent_verified":false},"governanceModel":{"url":"https://foundation.xyz/policies/terms-of-service","note":null,"agent_verified":false}},"basis":"registry-sourced, not audited","agent_verified":false,"source":"Foundation imprint, terms and funding announcement.","reviewed_at":"2026-10-25"},"evidence_provenance":{"strongest_tier":"independent-audit","tiers":["independent-audit","third-party-reported","self-reported"],"counts":{"directly-tested":0,"independent-audit":1,"third-party-reported":1,"self-reported":5},"total_sources":7},"privacy_score":100,"privacy_score_version":"3.1","privacy_factors":[{"key":"baseline","label":"Baseline","value":100,"detail":"Starting privacy exposure score"},{"key":"identity","label":"Identity exposure","value":0,"detail":"No required account or identity data recorded (level 0 of 4)"},{"key":"operator-context","label":"Operator context","value":0,"detail":"Hosted operator with unknown jurisdiction"}],"evidence_confidence":72,"evidence_confidence_status":"deprecated","evidence_confidence_sunset_on":"2027-02-26","evidence_score_version":"3.1","evidence_factors":[{"key":"source-coverage","label":"Source coverage","value":42,"detail":"Some material claims still need confirmation"},{"key":"freshness","label":"Review age","value":30,"detail":"All recorded checks are within 30 days"}],"score_computed_at":"2026-11-06T07:01:18.084Z","score_inputs":{"kycLevel":0,"noOperatorData":false,"jurisdiction":null,"jurisdictionConfidence":"unknown","evidenceStatus":"partial","checkedAt":"2026-10-25","lastReviewed":"2026-10-25","kycLastChecked":"2026-10-25"}}]},"meta":{"total":1,"api_version":"1.3","powered_by":"cunicula.com","documentation_url":"https://cunicula.com/en/api-docs","machine_index_url":"https://cunicula.com/llms.txt","license":"LicenseRef-Cunicula-Attribution-1.0","license_url":"https://cunicula.com/en/cite","attribution":"Cunicula, \"{name}\", cunicula.com, reviewed {reviewed}, retrieved {retrieved}, {url}","cite_guide_url":"https://cunicula.com/en/cite","dataset_url":"https://cunicula.com/api/v1/dataset","schema_version":"1.1.0","related_total":5,"history_total":5}}