Mobile Wallet
Wallet application running on a smartphone.
A mobile wallet is a cryptocurrency wallet application designed for a smartphone or tablet. It lets users manage addresses, view balances, sign transactions, connect to dapps, and make payments while away from a computer. Most are hot wallets because their signing environment operates on an internet-connected device.
Mobile wallets may hold private keys locally, use hardware-backed device security, connect to a separate hardware wallet, or rely on custodial or MPC services. These models have different recovery and trust assumptions. Users should determine who can sign, whether the provider can restrict access, and what happens after losing the phone.
Mobile wallets matter because cameras, QR codes, biometrics, notifications, and deep links make crypto payments accessible. They support daily spending, event tickets, games, and dapp activity. Convenience also makes the device a frequent phishing target and encourages users to approve actions quickly on a small screen.
Protect the device with a strong passcode, current software, trusted app sources, and minimal unnecessary permissions. Biometrics help against casual access but do not replace recovery. Seed phrases should remain offline. Avoid screenshots, cloud backups of secrets, clipboard reuse, and public Wi-Fi assumptions that obscure malicious links.
Separate daily funds from long-term savings. A mobile hot wallet should carry a limited balance, while a hardware wallet or cold setup protects valuable assets. Use a burner account for unfamiliar applications. Token approvals remain active on-chain after closing the app or disconnecting a session.
Before signing, verify domain, network, full address, amount, asset, allowance, and fee. If the phone is lost, remotely secure it and restore on a trusted device. Suspected key exposure requires migration to a new seed. A mobile wallet provides useful access, but safe use depends on limited exposure, device hygiene, verified software, careful signing, and a tested offline recovery plan.
Travel, device repair, and account synchronization change the threat model. Remove wallets before handing an unlocked phone to a technician and never carry the only recovery copy with the device. Review active dapp sessions and approvals after an incident. Notifications should hide sensitive balances where needed. Mobile wallet teams must also protect deep links and clipboard handling because a convenient handoff can become a phishing path.
Frequently asked questions
- Install it from a verified official source, use a strong device passcode and automatic lock, keep the operating system updated, and minimize unrelated apps. Store recovery information offline, not in photos or notes. Enable wallet biometrics as convenience layered over the passcode, review every signature, keep balances limited, and use hardware-backed signing when supported.
- Yes. Mobile wallets connect through built-in browsers, deep links, QR codes, or protocols such as WalletConnect. Verify the dapp domain and requested network, then read the message, transaction, and token approval carefully. End unused sessions, but remember that disconnecting does not revoke on-chain permissions. Avoid opening wallet links from unsolicited messages or search advertisements.
- Use the verified recovery method on a trusted replacement device and check the expected addresses. Remotely lock or erase the lost phone through the operating system where possible. If wallet keys or recovery words may have been exposed, create a fresh wallet and transfer assets. A device PIN change or app reinstall cannot secure a compromised seed phrase.