Improving security & cryptography in popular cryptocurrency wallets

Lots of people apply the idea that blockchain is secure by default to every project that has blockchain in its description. But in tech, you know its not so simple.

From a security perspective, we often see weak points requiring special attention in cryptocurrency ecosystems and their wallets (read our blog post Crypto wallets security as seen by security engineers to deep dive into the topic). When working with large blockchain foundations, we ensure that their ecosystem (wallets, backends, APIs, protocols) are secure.

Have a look at a real-life example.

Say, theres a blockchain foundation with a non-custodial cryptocurrency wallet available for millions of users as mobile applications and a web extension.

The users, regulators, investors, etc. expect that the cryptocurrency wallet gives the same level of security guarantees as modern financial or banking apps.

Since this is a non-custodial cryptocurrency wallet, special attention should be paid to protecting data on the client side and its communication with a blockchain.

This comes with the requests for:
advanced level of protection,
encryption for data at rest (non-custodial wallets store private keys and mnemonics),
platform-specific security controls for all the supported platforms,
building app security into UX.

Now this looks like a job for us.

So, we roll up our sleeves and, using the superpower :) of our mobile apps security, security and cryptography engineering services, and a cryptographic library Themis, we:

assess risks and do threat modelling for the apps and backend ecosystem.
conduct a deep cryptography audit of the wallet: web extension (Chrome, Firefox, Chromium) and mobile apps (iOS, Android).
provide cryptographic enhancements and dozens of application security improvements aligned with the defense in depth approach.
analyze the development process and advise SSDLC improvements (from further automation in CI/CD pipeline to formalizing a security roadmap).

Read the detail behind every stage in our case study Filling cryptography and security gaps in cryptocurrency wallets to learn how these efforts resulted in web extension and mobile apps synced in their security guarantees and providing defence in depth protection for the users data.