anydeskrce-something/crypto-wallet-security-architecture-comparison.md

# Crypto Wallet Security Architecture Comparison
## Defensive Research: Local Credential Extraction Resistance
### March 2026

---

## Table of Contents
1. [Market Overview & Popularity](#market-overview)
2. [Complete Wallet List by Category](#wallet-list)
3. [Detailed Security Architecture per Wallet](#detailed-architectures)
4. [Comparison Matrix](#comparison-matrix)
5. [Attack Surface Analysis](#attack-surface)
6. [Security Rankings](#security-rankings)

---

## 1. Market Overview & Popularity <a name="market-overview"></a>

### Industry Scale (2025-2026)
- **820 million+** unique active cryptocurrency wallets globally (2025)
- **$12.2 billion** global crypto wallet market (2025), projected to reach **$98.57 billion by 2034** (CAGR 26.7%)
- Hot wallets account for ~**78%** of crypto wallet usage
- Software wallet downloads exceeded **520 million** globally in 2025
- Personal wallet hacks hit **$713 million** in 2025; **20%+ of 2025 exploits** target browser/wallet extension layers

### Top Wallets by User Count

| Wallet | Monthly Active Users | Total Downloads/Users | Primary Platform |
|--------|---------------------|----------------------|-----------------|
| **MetaMask** | ~30 million MAU | 100+ million total | Browser Extension |
| **Trust Wallet** | ~17 million MAU | 220+ million downloads | Mobile (iOS/Android) |
| **Phantom** | ~5-7 million MAU (est.) | 15+ million total | Browser Extension + Mobile |
| **Coinbase Wallet** | ~3.2 million MAU | 10+ million downloads | Browser Extension + Mobile |
| **Exodus** | ~1-2 million MAU (est.) | 5+ million downloads | Desktop (Electron) + Mobile |
| **Rabby** | ~1 million MAU (est.) | 2+ million installs | Browser Extension |
| **OKX Wallet** | ~3-5 million MAU (est.) | 10+ million downloads | Browser Extension + Mobile |
| **Brave Wallet** | Built into Brave (~70M users) | N/A (built-in) | Browser-native |
| **Electrum** | ~500K-1M MAU (est.) | Long-standing BTC community | Desktop native (Python) |
| **Bitcoin Core** | ~100K-300K (est.) | Full node operators | Desktop native (C++) |
| **ZenGo** | ~1 million MAU (est.) | 2+ million downloads | Mobile (iOS/Android) |
| **Keplr** | ~500K-1M MAU (est.) | 1+ million installs | Browser Extension + Mobile |
| **Backpack** | ~500K MAU (est.) | 1+ million installs | Browser Extension |
| **Ledger Live** | ~2-3 million MAU (est.) | Tied to hardware sales | Desktop (Electron) + Mobile |

---

## 2. Complete Wallet List by Category <a name="wallet-list"></a>

### Browser Extension Wallets (EVM / Ethereum)
- **MetaMask** - Market leader, EVM ecosystem standard
- **Rabby** (by DeBank) - DeFi-focused, pre-transaction scanning
- **Coinbase Wallet** - Backed by Coinbase exchange
- **Brave Wallet** - Browser-native (not an extension)
- **Frame** - Privacy-focused, desktop-native with extension bridge
- **Rainbow** - Mobile-first with extension

### Browser Extension Wallets (Multi-Chain)
- **Phantom** - Solana/ETH/BTC/Base
- **Backpack** - Solana/Ethereum, xNFT architecture
- **OKX Wallet** - 80+ chains, MPC support
- **Trust Wallet** - Extension + mobile, 100+ chains

### Browser Extension Wallets (Ecosystem-Specific)
- **Keplr** - Cosmos/IBC ecosystem
- **Temple** - Tezos/Etherlink ecosystem
- **Polkadot.js** - Polkadot/Substrate
- **Nami** - Cardano
- **Yoroi** - Cardano (by Emurgo)
- **Eternl** - Cardano
- **Sui Wallet** - Sui blockchain
- **Petra** - Aptos blockchain
- **Martian** - Aptos blockchain
- **Sender** - NEAR Protocol
- **XDEFI** - Multi-chain (THORChain focus)

### Desktop Wallets (Native)
- **Exodus** - Multi-chain, Electron-based
- **Electrum** - Bitcoin-only, Python
- **Bitcoin Core** - Bitcoin full node, C++
- **Sparrow** - Bitcoin-only, Java
- **Wasabi** - Bitcoin, privacy-focused (CoinJoin)
- **Atomic Wallet** - Multi-chain, Electron (COMPROMISED 2023)
- **Ledger Live** - Companion to Ledger hardware, Electron

### Mobile Wallets (Primary)
- **Trust Wallet** - Leading mobile wallet
- **ZenGo** - MPC/keyless architecture
- **Crypto.com DeFi Wallet** - Multi-chain
- **SafePal** - Software + hardware hybrid
- **Coinomi** - Multi-chain, long-standing
- **BlueWallet** - Bitcoin/Lightning
- **Muun** - Bitcoin/Lightning
- **Green (Blockstream)** - Bitcoin, multisig

### MPC / Smart Wallets
- **ZenGo** - 2-of-2 MPC, keyless
- **OKX Wallet** - MPC mode available
- **Fireblocks** - Institutional MPC
- **Safe (formerly Gnosis Safe)** - Smart contract wallet

---

## 3. Detailed Security Architecture per Wallet <a name="detailed-architectures"></a>

---

### MetaMask

| Property | Details |
|----------|---------|
| **Type** | Browser extension (Chrome, Firefox, Brave, Edge) + Mobile (React Native) |
| **Chains** | EVM chains + Bitcoin (added Dec 2025) + Solana |
| **Encryption Algorithm** | AES-256-GCM |
| **Key Derivation** | PBKDF2-HMAC-SHA256 |
| **KDF Iterations** | **900,000** (current, upgraded from 600,000, originally 10,000) |
| **Salt** | Random, from `crypto.getRandomValues()` |
| **IV** | Random 96-bit, from `crypto.getRandomValues()` |
| **Vault Location (Windows/Chrome)** | `%LOCALAPPDATA%\Google\Chrome\User Data\Default\Local Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn` |
| **Vault Location (macOS/Chrome)** | `~/Library/Application Support/Google/Chrome/Default/Local Extension Settings/nkbihfbeogaeaoehlefnkodbefgpgknn` |
| **Storage Format** | LevelDB (.ldb files), JSON vault data inside |
| **What's Encrypted** | Seed phrase (mnemonic) + all imported private keys in a single vault blob |
| **Runtime Key Handling** | Decrypted keys held in `this.memStore` (in-memory JavaScript object) while wallet is unlocked; cleared on lock |
| **Anti-Tampering** | AES-GCM provides authenticated encryption (integrity check) |
| **Open Source** | Yes (MIT license) |
| **Security Audits** | Multiple audits over the years |
| **Hardware Wallet Support** | Ledger, Trezor, Lattice1, Keystone |
| **Unique Features** | Vault decryptor tool available; progressive encryption upgrades; Snaps extensibility |
| **Known Incidents** | No direct protocol breaches; targeted by phishing/malware extensively; privacy concerns around IP/data collection (ConsenSys/Infura) |

**Key Insight**: MetaMask's encryption has evolved significantly. Early versions used only 10,000 PBKDF2 iterations, making offline brute-force feasible for weak passwords. Current versions use 900,000 iterations, which is much stronger. The vault upgrade mechanism (`updateVault`) allows migrating old vaults to stronger parameters. The vault is a single encrypted JSON blob in LevelDB -- if you can copy the `.ldb` files and know the password, you can decrypt with the official vault decryptor.

---

### Phantom

| Property | Details |
|----------|---------|
| **Type** | Browser extension (Chrome, Firefox, Brave, Edge) + Mobile (iOS/Android) |
| **Chains** | Solana, Ethereum, Bitcoin, Base, Polygon |
| **Encryption Algorithm** | NaCl SecretBox (XSalsa20-Poly1305) |
| **Key Derivation** | PBKDF2 (10,000 iterations, SHA-256) **or** Scrypt |
| **Salt** | Random |
| **Nonce** | Random (24-byte for NaCl SecretBox) |
| **Vault Location (Windows/Chrome)** | `%LOCALAPPDATA%\Google\Chrome\User Data\Default\Local Extension Settings\bfnaelmomeimhlpmgjnjophhpkkoljpa` |
| **Storage Format** | LevelDB, encrypted vault JSON |
| **What's Encrypted** | BIP-39 mnemonic phrases and/or Base58 private keys |
| **Runtime Key Handling** | Decrypted in memory when unlocked |
| **Anti-Tampering** | Poly1305 MAC (authenticated encryption via NaCl SecretBox) |
| **Open Source** | No (closed source) |
| **Security Audits** | Kudelski Security audit |
| **Hardware Wallet Support** | Ledger |
| **Unique Features** | Transaction simulation/preview; scam detection; multi-chain in single extension |
| **Known Incidents** | No direct breaches of the wallet itself |

**Key Insight**: Phantom uses NaCl SecretBox rather than AES-GCM, which is a solid choice cryptographically. However, PBKDF2 at 10,000 iterations is notably weaker than MetaMask's current 900,000. The vault structure is extractable from Chrome's LevelDB and can be attacked offline with tools like `phantom_pwn`. Closed-source nature limits independent verification.

---

### Exodus

| Property | Details |
|----------|---------|
| **Type** | Desktop (Electron) + Mobile (iOS/Android) + Browser Extension |
| **Chains** | 300+ cryptocurrencies |
| **Encryption Algorithm** | AES-256-GCM |
| **Key Derivation** | Password-based (specific KDF parameters not publicly documented) |
| **Data Location (Windows)** | `%APPDATA%\Exodus` (wallet data) and `%LOCALAPPDATA%\exodus` (application) |
| **Data Location (macOS)** | `~/Library/Application Support/Exodus` |
| **Storage Format** | Proprietary encrypted files |
| **What's Encrypted** | Private keys and seed phrase, encrypted with user password |
| **Runtime Key Handling** | Keys held in Electron process memory while unlocked |
| **Anti-Tampering** | GCM authentication tag |
| **Open Source** | **No** (closed source / partial open source) |
| **Security Audits** | Internal security team; no public third-party audit reports |
| **Hardware Wallet Support** | Trezor |
| **Unique Features** | Built-in exchange; mobile cloud backup (encrypted seed in iCloud/Google Drive) |
| **Known Incidents** | Zero serious safety breaches reported. Targeted by fake Exodus apps/malware. |

**Key Insight**: Exodus is closed-source, so the exact KDF parameters are not publicly verifiable. Being Electron-based means the entire Node.js runtime is available to the application -- and to any malware that can inject into or read from the Electron process. The cloud backup feature (encrypted seed stored in iCloud/Google Drive) adds convenience but also adds attack surface if the backup password is weak.

---

### Trust Wallet

| Property | Details |
|----------|---------|
| **Type** | Mobile (iOS/Android, primary) + Browser Extension |
| **Chains** | 100+ chains, 10 million+ tokens |
| **Encryption Algorithm** | AES-256 (specific mode not publicly documented for mobile; likely AES-GCM for extension) |
| **Key Derivation** | Password-based (specific KDF not publicly detailed) |
| **Key Storage (Mobile)** | iOS: **Secure Enclave** / Keychain; Android: **Android Keystore** (hardware-backed where available) |
| **Key Storage (Extension)** | Browser local storage, encrypted |
| **Storage Format** | Platform-native secure storage (mobile); LevelDB (extension) |
| **What's Encrypted** | Private keys and seed phrase |
| **Runtime Key Handling** | Keys managed via platform secure storage APIs |
| **Anti-Tampering** | Platform-level (Secure Enclave / TEE on mobile); password hash stored in tamper-proof keystore |
| **Open Source** | Core library is open source (trust-wallet-core on GitHub) |
| **Security Audits** | Halborn, Kudelski Security |
| **Hardware Wallet Support** | Ledger (via WalletConnect) |
| **Unique Features** | Biometric unlock; Secure Enclave usage on iOS; built-in dApp browser; staking |
| **Known Incidents** | **December 2025**: Chrome extension shipped malicious update (v2.68) via compromised Chrome Web Store API key -- **$7 million drained** from hundreds of users. This was a supply chain attack, not a cryptographic failure. |

**Key Insight**: Trust Wallet's mobile app is among the most resistant to local extraction because it leverages hardware-backed key storage (Secure Enclave on iOS, Android Keystore with TEE). Keys stored in the Secure Enclave cannot be extracted even with root access -- they can only be used for signing operations. The browser extension, however, has the same vulnerabilities as any other extension-based wallet. The December 2025 supply chain attack demonstrates extension-specific risks.

---

### Coinbase Wallet

| Property | Details |
|----------|---------|
| **Type** | Browser extension + Mobile (iOS/Android) |
| **Chains** | Ethereum, Solana, Bitcoin, and EVM chains |
| **Encryption Algorithm** | AES-256-GCM (cloud backups confirmed; extension likely similar) |
| **Key Derivation** | PBKDF2 (iteration count not publicly specified) |
| **Key Storage** | Local encrypted storage; cloud backup option (encrypted on-device before upload) |
| **Storage Format** | Browser local storage (extension); platform secure storage (mobile) |
| **Anti-Tampering** | GCM authentication; domain verification / phishing protection |
| **Open Source** | Partially (some components) |
| **Security Audits** | Backed by Coinbase security team |
| **Hardware Wallet Support** | Ledger |
| **Unique Features** | Coinbase exchange integration; AWS Nitro Enclaves for programmable wallets (custodial side); Smart Wallet with passkey support |
| **Known Incidents** | No major direct breaches of the self-custody wallet |

**Key Insight**: Coinbase Wallet benefits from the engineering resources of a publicly traded company. Their "Smart Wallet" product uses passkeys and server-side enclaves (AWS Nitro) for key management, which is a fundamentally different (and more breach-resistant) model than traditional seed-phrase wallets. However, the standard self-custody extension follows the same general pattern as MetaMask.

---

### Rabby (by DeBank)

| Property | Details |
|----------|---------|
| **Type** | Browser extension + Mobile |
| **Chains** | 113+ EVM chains |
| **Encryption Algorithm** | AES-GCM (128-bit security level) |
| **Key Derivation** | PBKDF2 (iteration count not specified in public docs -- noted by auditors as "password-stretched" via PBKDF2) |
| **Vault Structure** | Private keys encrypted under vault key, stored in extension local storage |
| **Storage Format** | Browser local storage (chrome.storage.local) |
| **Anti-Tampering** | GCM authentication tag |
| **Open Source** | **Yes** (MIT license, fully auditable) |
| **Security Audits** | SlowMist, Cure53, Least Authority (multiple audits in 2024-2025) |
| **Hardware Wallet Support** | Ledger, Trezor, Keystone, OneKey, GridPlus |
| **Unique Features** | Pre-transaction risk scanning; automatic chain switching; wallet whitelist; off-chain signature phishing warnings |
| **Known Incidents** | No direct breaches |

**Key Insight**: Rabby has the best pre-transaction security features of any browser extension wallet (risk scanning, simulation, phishing detection). However, its underlying vault encryption uses AES-GCM with PBKDF2, and the effective security is limited by password strength (one study cited by auditors estimated average password entropy at ~40.54 bits). Open-source nature allows full verification but also means attackers can study the implementation.

---

### Brave Wallet

| Property | Details |
|----------|---------|
| **Type** | **Browser-native** (built into Brave browser, NOT an extension) |
| **Chains** | Ethereum, Solana, Filecoin, EVM chains |
| **Encryption Algorithm** | Client-side encryption (specific algorithm not publicly detailed; uses Chromium's encryption infrastructure) |
| **Key Derivation** | Password-based |
| **Key Storage** | Brave browser's internal encrypted storage (not accessible via extension APIs) |
| **Storage Format** | Integrated into browser profile data |
| **Anti-Tampering** | Not exposed to extension API attack surface |
| **Open Source** | **Yes** (Brave is fully open source) |
| **Security Audits** | Part of Brave's overall security audit program |
| **Hardware Wallet Support** | Ledger, Trezor |
| **Unique Features** | No extension permissions needed; reduced attack surface; lower CPU/memory usage; built-in Brave Rewards integration |
| **Known Incidents** | No major breaches |

**Key Insight**: Brave Wallet's primary security advantage is architectural: because it is built into the browser rather than being an extension, it does NOT require the broad permissions that extensions need ("read and change all your data on websites you visit"). It cannot be spoofed by a fake extension, and it is not accessible to other extensions. The vault is stored within the browser's internal data structures rather than in a LevelDB accessible via the extensions API. This makes it significantly more resistant to extension-based malware and the entire class of "malicious extension" attacks.

---

### Atomic Wallet (COMPROMISED)

| Property | Details |
|----------|---------|
| **Type** | Desktop (Electron) + Mobile |
| **Chains** | 300+ cryptocurrencies |
| **Encryption Algorithm** | AES (specific mode not publicly documented) |
| **Key Derivation** | Password-based |
| **Key Storage** | Local encrypted files |
| **Open Source** | **No** (closed source) |
| **Security Audits** | Least Authority performed an audit in 2022 that identified vulnerabilities |
| **Known Incidents** | **June 2023: $100M+ stolen** by Lazarus Group (North Korea). Root cause never fully determined. Suspected vectors: weak random number generation, software supply chain attack (malicious SDK), possible key transmission to centralized servers, outdated Android dependencies. |

**Key Insight**: Atomic Wallet is the cautionary tale. Despite being a popular wallet, the June 2023 hack resulted in $100M+ in losses attributed to the Lazarus Group. The exact root cause was never publicly confirmed, but security researchers identified multiple potential weaknesses: insufficient entropy in key generation, possible backdoor via compromised dependency, and potential logging of sensitive key material. The wallet was closed-source, limiting independent security verification. Least Authority had flagged security concerns in a 2022 audit. This case demonstrates why closed-source wallets with opaque encryption implementations are high risk.

---

### Electrum

| Property | Details |
|----------|---------|
| **Type** | Desktop native (Python) |
| **Chains** | Bitcoin only |
| **Encryption Algorithm** | AES-256-CBC (private keys); ECIES (wallet file encryption) |
| **Key Derivation** | ECIES-based (asymmetric) for wallet file; password-derived for private keys |
| **Wallet File Encryption** | ECIES: ECDH key exchange -> derives 16-byte IV + 16-byte AES key + 32-byte HMAC key |
| **Data Location (Windows)** | `%APPDATA%\Electrum\wallets\` |
| **Data Location (Linux)** | `~/.electrum/wallets/` |
| **Data Location (macOS)** | `~/.electrum/wallets/` |
| **Storage Format** | JSON wallet file |
| **What's Encrypted** | Private keys (encrypted individually); wallet file encrypted at rest since v2.8 |
| **Runtime Key Handling** | **Keys decrypted only briefly for transaction signing, then cleared**; password NOT kept in memory |
| **Anti-Tampering** | HMAC authentication (via ECIES); verified reproducible builds |
| **Open Source** | **Yes** (MIT license) |
| **Security Audits** | Community-reviewed; formal verification published (INRIA) |
| **Hardware Wallet Support** | Ledger, Trezor, Coldcard, Bitbox, Jade, Keystone |
| **Unique Features** | Multisig; cold storage; Lightning Network; Tor support; coin control; reproducible builds |
| **Seed Entropy** | 132 bits |
| **Known Incidents** | 2018-2020: Phishing attacks via fake Electrum update servers (not a wallet crypto flaw) |

**Key Insight**: Electrum has one of the strongest security architectures among software wallets. The use of ECIES for wallet file encryption means the password is NOT needed in memory after encryption -- the asymmetric scheme allows the wallet to be saved without knowing the password. Private keys are only decrypted momentarily during signing. Being a native Python application (not Electron), it has a smaller attack surface. Reproducible builds allow verification that the distributed binary matches the source code. The main weakness is that it's Bitcoin-only.

---

### Bitcoin Core

| Property | Details |
|----------|---------|
| **Type** | Desktop native (C++) -- full node |
| **Chains** | Bitcoin only |
| **Encryption Algorithm** | AES-256-CBC |
| **Key Derivation** | SHA-512 via OpenSSL `EVP_BytesToKey`; dynamic iteration count based on machine speed at first encryption |
| **Master Key** | Random master key encrypts all private keys; master key itself encrypted with password-derived key |
| **Data Location (Windows)** | `%APPDATA%\Bitcoin\wallets\` (or `wallet.dat` in data dir) |
| **Data Location (Linux)** | `~/.bitcoin/wallets/` |
| **Storage Format** | Berkeley DB (legacy) or SQLite (descriptor wallets, newer) |
| **What's Encrypted** | **Only private keys**; public keys, addresses, transaction metadata remain unencrypted |
| **Runtime Key Handling** | Wallet can be locked/unlocked; when locked, encrypted keys cannot be used; when unlocked, master key held in memory |
| **Anti-Tampering** | Not encrypted by default -- user must explicitly enable encryption |
| **Open Source** | **Yes** (MIT license) |
| **Security Audits** | Most reviewed cryptocurrency codebase in existence |
| **Unique Features** | Full node validation; coin control; PSBT support; descriptor wallets |
| **Known Incidents** | No cryptographic breaches of the wallet encryption itself |

**Key Insight**: Bitcoin Core's wallet encryption is battle-tested but relatively simple. Key architectural decision: only private keys are encrypted, allowing the wallet to monitor the blockchain without needing the password. The dynamic iteration count for key derivation was novel at the time but is less sophisticated than modern KDFs like Argon2. The `wallet.dat` file is NOT encrypted by default -- users must explicitly enable encryption. Being a native C++ application with no web technologies, the attack surface is minimal compared to Electron/browser-based wallets.

---

### Ledger Live

| Property | Details |
|----------|---------|
| **Type** | Desktop (Electron) + Mobile companion to Ledger hardware |
| **Chains** | 5000+ crypto assets |
| **Encryption Algorithm** | Private keys **never stored in Ledger Live** -- stored only on hardware device's Secure Element |
| **Key Storage** | Hardware Secure Element (ST33/ST31 chips); Ledger Live stores only public keys, account metadata |
| **Local Data** | Account xpubs, transaction history, settings (persisted locally, not online) |
| **Ledger Key Ring Protocol** | End-to-end encryption keys derived from hardware device for secure data sync |
| **Anti-Tampering** | Hardware-based: Secure Element with side-channel and fault attack countermeasures |
| **Open Source** | Ledger Live is open source; firmware is proprietary |
| **Security Audits** | Multiple audits; Donjon security team (internal) |
| **Unique Features** | Genuine check; secure display on device; physical confirmation required for all transactions |
| **Known Incidents** | 2020: Customer database breach (email/physical addresses leaked, NOT keys); 2023: Ledger Connect Kit supply chain attack (JS library compromised) |

**Key Insight**: Ledger Live is fundamentally different from other software wallets because it does NOT store private keys at all. The private keys exist only within the hardware device's Secure Element chip and are never exposed to the host computer. Even if Ledger Live is fully compromised, the attacker cannot extract private keys -- they can only attempt to trick the user into signing malicious transactions (which must be confirmed on the physical device's screen). This is the gold standard for key isolation. The risk is in the metadata (account balances, addresses, xpubs) stored on disk, and in supply chain attacks against the Ledger Live software itself.

---

### ZenGo

| Property | Details |
|----------|---------|
| **Type** | Mobile (iOS/Android) |
| **Chains** | Bitcoin, Ethereum, 120+ assets |
| **Encryption Algorithm** | MPC (Multi-Party Computation) -- no single private key exists |
| **Key Architecture** | **2-of-2 MPC**: Personal Share (on device, hardware-backed TRNG) + Remote Share (ZenGo servers) |
| **Key Storage** | Personal share stored in device secure storage; remote share on ZenGo infrastructure |
| **Recovery** | Encrypted backup of personal share to cloud; recovery via 3D face biometric map (3FA) |
| **What's Encrypted** | Each share is independently encrypted; neither share alone can sign transactions |
| **Anti-Tampering** | No seed phrase to extract; hardware-backed storage for personal share |
| **Open Source** | MPC library is open source; app is closed source |
| **Security Audits** | 7 audits in 5 years; multiple US/EU patents |
| **Hardware Wallet Support** | N/A (MPC replaces hardware wallet need) |
| **Unique Features** | **Keyless** -- no seed phrase; 3D face biometric recovery; real-time scam detection (Web3 Firewall) |
| **Known Incidents** | **Zero wallets hacked -- ever** (as of March 2026) |

**Key Insight**: ZenGo represents a fundamentally different security model. There is no single private key that can be extracted from any single location. An attacker would need to compromise both the user's device AND ZenGo's servers simultaneously. The 3D face biometric recovery eliminates the seed phrase as an attack vector entirely. The trade-off is trust in ZenGo as a company (the remote share is on their servers) and vendor lock-in. For local credential extraction resistance, this is arguably the strongest model because there is literally no complete key to extract.

---

### Keplr

| Property | Details |
|----------|---------|
| **Type** | Browser extension + Mobile |
| **Chains** | Cosmos ecosystem, IBC chains |
| **Encryption Algorithm** | AES-based (specific parameters not publicly detailed) |
| **Key Derivation** | Password-based |
| **Key Storage** | Encrypted locally on device |
| **Anti-Tampering** | Standard browser extension encryption |
| **Open Source** | **Yes** |
| **Security Audits** | Third-party audited |
| **Hardware Wallet Support** | Ledger, Trezor |
| **Unique Features** | IBC transfers; Cosmos staking; biometric auth on mobile |
| **Known Incidents** | No major breaches |

---

### Temple (Tezos)

| Property | Details |
|----------|---------|
| **Type** | Browser extension + Mobile |
| **Chains** | Tezos, Etherlink, Ethereum |
| **Encryption Algorithm** | Platform-specific security controls; industry-standard encryption |
| **Key Storage** | Encrypted locally; platform-specific secure storage on mobile |
| **Anti-Tampering** | Defense-in-depth approach; mnemonic leakage prevention |
| **Open Source** | **Yes** (fully open source) |
| **Security Audits** | Cossack Labs security assessment (commissioned by Tezos Foundation) |
| **Known Issues Found in Audit** | Cryptography improvements needed; platform-specific security controls added; mnemonic leakage prevention; abuse risk reduction |
| **Known Incidents** | No major breaches |

---

### Backpack

| Property | Details |
|----------|---------|
| **Type** | Browser extension |
| **Chains** | Solana, Ethereum |
| **Encryption Algorithm** | Standard encryption (specific parameters not publicly detailed) |
| **Key Storage** | Non-custodial, local encrypted storage |
| **Anti-Tampering** | xNFT sandboxed execution model |
| **Open Source** | **Yes** (coral-xyz/backpack on GitHub) |
| **Security Audits** | Halborn audit |
| **Hardware Wallet Support** | Ledger |
| **Unique Features** | **xNFT architecture** (apps run in sandboxed environment within wallet, not on external websites -- prevents phishing UI spoofing); Collection Locking (auto-reject drainer transactions) |
| **Known Incidents** | No major breaches |

---

### OKX Wallet

| Property | Details |
|----------|---------|
| **Type** | Browser extension + Mobile |
| **Chains** | 80+ networks |
| **Encryption Algorithm** | AES-based + MPC (optional mode) |
| **Key Architecture** | Standard mode: local encrypted keys. MPC mode: key fragments split across device, cloud, and OKX server (2-of-3 threshold) |
| **Key Storage** | Standard: encrypted on device. MPC: fragments encrypted and distributed |
| **Anti-Tampering** | Smart contract risk scoring; real-time security alerts; allow-listing |
| **Open Source** | SDK is open source (js-wallet-sdk, go-wallet-sdk); wallet app is closed source |
| **Security Audits** | SlowMist, CertiK |
| **Hardware Wallet Support** | Ledger, Trezor |
| **Unique Features** | MPC mode (2-of-3 key splitting); DEX aggregator built-in; NFT marketplace |
| **Known Incidents** | No major breaches of the wallet itself |

---

## 4. Comparison Matrix <a name="comparison-matrix"></a>

### Encryption & Key Derivation Comparison

| Wallet | Encryption | KDF | KDF Iterations | Vault Extractable from Disk? | Keys in Memory When Unlocked? |
|--------|-----------|-----|----------------|------------------------------|-------------------------------|
| **MetaMask** | AES-256-GCM | PBKDF2-HMAC-SHA256 | **900,000** | Yes (LevelDB) | Yes |
| **Phantom** | NaCl SecretBox (XSalsa20-Poly1305) | PBKDF2/Scrypt | **10,000** (PBKDF2) | Yes (LevelDB) | Yes |
| **Exodus** | AES-256-GCM | Unknown (closed source) | Unknown | Yes (AppData files) | Yes (Electron) |
| **Trust Wallet (Mobile)** | AES-256 | Platform-specific | N/A | **No** (Secure Enclave/TEE) | Managed by OS secure storage |
| **Trust Wallet (Extension)** | AES (likely GCM) | Unknown | Unknown | Yes (LevelDB) | Yes |
| **Coinbase Wallet** | AES-256-GCM | PBKDF2 | Unknown (likely 600K+) | Yes (LevelDB) | Yes |
| **Rabby** | AES-GCM (128-bit) | PBKDF2 | Unknown | Yes (chrome.storage.local) | Yes |
| **Brave Wallet** | Chromium internal | Password-based | Unknown | Harder (not extension-accessible) | Yes |
| **Electrum** | AES-256-CBC + ECIES | ECIES (asymmetric) | N/A (asymmetric) | Yes (JSON wallet files) | **Only during signing** |
| **Bitcoin Core** | AES-256-CBC | SHA-512 / EVP_BytesToKey | Dynamic (machine-speed) | Yes (wallet.dat) | When unlocked |
| **Ledger Live** | **N/A (no private keys stored)** | N/A | N/A | **No keys to extract** | **Never** |
| **ZenGo** | MPC (no single key exists) | N/A | N/A | **Only 1 of 2 shares** | Only partial share |
| **Atomic Wallet** | AES (unknown mode) | Unknown | Unknown | Yes | Yes (Electron) |
| **Keplr** | AES-based | Password-based | Unknown | Yes (LevelDB) | Yes |
| **OKX (MPC mode)** | AES + MPC | N/A | N/A | Only 1 of 3 fragments | Partial |

### Security Architecture Comparison

| Wallet | Open Source | Audited | HW Wallet Support | Secure Enclave | MPC | Anti-Phishing | Tx Simulation | Supply Chain Incident |
|--------|-----------|---------|-------------------|---------------|-----|---------------|---------------|----------------------|
| MetaMask | Yes | Yes | Yes | No | No | Basic | Via Snaps | No |
| Phantom | No | Yes (Kudelski) | Yes (Ledger) | No | No | Yes | **Yes** | No |
| Exodus | No | Limited | Yes (Trezor) | No | No | No | No | No |
| Trust Wallet | Partial | Yes | Yes | **Yes (mobile)** | No | Yes | No | **Yes (Dec 2025)** |
| Coinbase Wallet | Partial | Yes | Yes | Yes (Smart Wallet) | Passkeys | Yes | Yes | No |
| Rabby | **Yes** | **Yes (3 firms)** | **Yes (5+ HW)** | No | No | **Yes (best)** | **Yes (best)** | No |
| Brave Wallet | **Yes** | Yes | Yes | No | No | Basic | No | No |
| Electrum | **Yes** | Yes | **Yes (7+ HW)** | No | No | No | N/A (BTC) | Phishing (2018) |
| Bitcoin Core | **Yes** | **Yes (most reviewed)** | N/A | No | No | No | N/A | No |
| Ledger Live | Partial | Yes | **Mandatory** | **Yes (HW SE)** | No | Yes | Yes | **Yes (2023 JS lib)** |
| ZenGo | Partial | **Yes (7 audits)** | N/A | **Yes (device)** | **Yes (2-of-2)** | **Yes** | **Yes** | No |
| Atomic Wallet | No | Limited | No | No | No | No | No | **Yes (2023, $100M+)** |
| OKX Wallet | Partial | Yes (2 firms) | Yes | No | **Yes (optional)** | Yes | Yes | No |

---

## 5. Attack Surface Analysis <a name="attack-surface"></a>

### How Wallet Stealer Malware Operates (2025 Landscape)

Based on threat intelligence from 2025, the primary extraction methods used by crypto-stealing malware:

1. **LevelDB File Exfiltration**: Malware copies the extension's LevelDB files from the known Chrome profile path. Since extension IDs are fixed and well-known, the file paths are predictable. Tools like `StilachiRAT` obtain Chrome's encryption key from the `Local State` file and decrypt credential stores.

2. **In-Memory Key Extraction**: When a wallet is unlocked, decrypted private keys exist in the browser process memory. Memory-reading malware can extract these without needing to crack the vault password.

3. **Browser API Hooking**: Malware hooks browser APIs to intercept the password as the user types it, then uses it to decrypt the vault offline.

4. **Malicious Extension Injection**: Fake or compromised extensions that request the same permissions can read other extensions' storage in some configurations, or inject scripts into the extension's pages.

5. **Supply Chain Attacks**: Compromised updates pushed through official channels (e.g., Trust Wallet Dec 2025, Ledger Connect Kit 2023). These bypass all client-side encryption because the malicious code runs with full extension privileges.

### Resistance Ranking by Attack Vector

| Attack Vector | Most Resistant | Least Resistant |
|--------------|---------------|-----------------|
| **Disk-based vault extraction** | ZenGo, Ledger Live, Trust Wallet (mobile) | All browser extensions, Exodus, Atomic |
| **In-memory key extraction** | Electrum (brief decryption), Ledger Live (no keys), ZenGo (partial share) | All extensions while unlocked, Electron apps |
| **Password brute-force (offline)** | MetaMask (900K iter), Bitcoin Core (dynamic), ZenGo (no password to brute) | Phantom (10K iter), older MetaMask vaults |
| **Malicious extension attack** | Brave Wallet (not an extension), ZenGo (mobile-only), Ledger Live (desktop) | All browser extension wallets equally |
| **Supply chain attack** | Open-source wallets with reproducible builds (Electrum, Bitcoin Core) | Closed-source wallets (Exodus, Phantom, Atomic) |
| **Clipboard/keylogger** | ZenGo (no seed phrase), biometric-only wallets | All wallets requiring manual seed phrase entry |

---

## 6. Security Rankings <a name="security-rankings"></a>

### Tier 1: Most Resistant to Local Credential Extraction

1. **Ledger Live + Hardware** -- Private keys never exist on the computer. Period. Nothing to extract.
2. **ZenGo (MPC)** -- No complete private key exists anywhere. Attacker needs simultaneous access to device + ZenGo servers.
3. **Trust Wallet (Mobile/iOS)** -- Secure Enclave storage means keys cannot be extracted even with root access. (Extension version is Tier 3.)
4. **Coinbase Smart Wallet (Passkey mode)** -- Keys managed via secure enclave + server-side AWS Nitro Enclaves.

### Tier 2: Strong Encryption, But Keys Extractable from Disk

5. **MetaMask (current version)** -- 900,000 PBKDF2 iterations make brute-force very expensive. Vault is extractable but well-protected for strong passwords.
6. **Electrum** -- ECIES wallet encryption doesn't need password in memory; keys only decrypted briefly during signing. Native application (not Electron).
7. **Bitcoin Core** -- Battle-tested AES-256-CBC; native C++ with minimal attack surface. Not encrypted by default though.
8. **Brave Wallet** -- Browser-native (not extension) eliminates entire class of extension-based attacks.

### Tier 3: Standard Browser Extension Security

9. **Rabby** -- Best pre-transaction security features, but standard extension vault encryption. Open source and well-audited.
10. **Coinbase Wallet (Extension)** -- Solid engineering, backed by public company resources.
11. **Keplr** -- Standard extension security for Cosmos ecosystem.
12. **OKX Wallet (Standard mode)** -- MPC mode elevates to Tier 2; standard mode is typical extension security.
13. **Backpack** -- xNFT sandboxing is innovative but vault encryption details are limited.

### Tier 4: Weaker or Unknown Encryption Parameters

14. **Phantom** -- NaCl SecretBox is cryptographically sound, but **PBKDF2 at only 10,000 iterations** is 90x weaker than MetaMask against offline brute-force.
15. **Trust Wallet (Extension)** -- Encryption parameters not publicly documented; recent supply chain compromise (Dec 2025) raises concerns.
16. **Exodus** -- Closed source, KDF parameters unknown, Electron-based. Convenience-oriented rather than security-hardened.
17. **Temple** -- Small team, limited public documentation on crypto parameters.

### Tier 5: Known Compromised or High Risk

18. **Atomic Wallet** -- $100M+ hack (2023, Lazarus Group); root cause never fully disclosed; closed source; potentially flawed key generation.

---

## Key Takeaways for Defensive Security

1. **PBKDF2 iteration count is the single most important differentiator** among browser extension wallets. MetaMask's 900,000 iterations vs. Phantom's 10,000 means MetaMask vaults are 90x more expensive to brute-force.

2. **Hardware-backed key storage (Secure Enclave, TEE) is the strongest defense** against local extraction. Trust Wallet on iOS and Ledger hardware are in a different security class from browser extensions.

3. **MPC wallets (ZenGo, OKX MPC mode) eliminate the single-point-of-failure problem** entirely. There is no single key to steal.

4. **Browser-native wallets (Brave) have a structural advantage** over extensions because they are not exposed to the extension permission model and cannot be spoofed by fake extensions.

5. **All browser extension wallets share a common weakness**: the vault is stored in predictable LevelDB paths that malware can trivially locate and exfiltrate. The only defense is the strength of the password + KDF.

6. **Electron-based wallets (Exodus, Atomic, Ledger Live) expose a full Node.js runtime** to potential attackers, increasing the attack surface compared to native applications.

7. **Open-source wallets with reproducible builds (Electrum, Bitcoin Core) are the most resistant to supply chain attacks** because the distributed binary can be verified against the source code.

8. **Electrum's ECIES approach is architecturally elegant**: the password never needs to be kept in memory after encryption, and keys are only decrypted momentarily for signing. This minimizes the window for memory extraction attacks.

9. **The December 2025 Trust Wallet and 2023 Ledger Connect Kit incidents** demonstrate that supply chain attacks are a real and growing threat. Extension-based wallets that auto-update from the Chrome Web Store are particularly vulnerable to this vector.

10. **$713 million was lost from personal wallet hacks in 2025**, with 20%+ of exploits targeting browser and wallet extension layers. The browser extension model has a fundamental design flaw: extensions require broad permissions and store sensitive data in accessible locations.

---

## Sources

- [CoinLedger - Best Cryptocurrency Wallets March 2026](https://coinledger.io/tools/best-crypto-wallet)
- [CoinGecko - Top 7 Hot Wallets in 2026](https://www.coingecko.com/learn/top-hot-software-wallets-crypto)
- [Fortune Business Insights - Crypto Wallet Market Size 2025-2032](https://www.fortunebusinessinsights.com/crypto-wallet-market-109305)
- [MetaMask Help Center - Secret Recovery Phrase Guide](https://support.metamask.io/start/user-guide-secret-recovery-phrase-password-and-private-keys)
- [WispWisp - How MetaMask Stores Your Wallet Secret](https://www.wispwisp.com/index.php/2020/12/25/how-metamask-stores-your-wallet-secret/)
- [AccessDenied - Deep Dive into MetaMask Secrets](https://rya-sge.github.io/access-denied/2023/07/20/metamask-secret/)
- [MetaMask browser-passworder GitHub](https://github.com/MetaMask/browser-passworder)
- [MetaMask Vault Decryptor](https://metamask.github.io/vault-decryptor/)
- [MetaMask Encrypted Vault Paths (Gist)](https://gist.github.com/miguelmota/331edaf9ebb68159e574a5c8391dd019)
- [Phantom Security Page](https://phantom.com/security)
- [phantom_pwn - Phantom Vault Extractor & Decryptor](https://github.com/cyclone-github/phantom_pwn)
- [Exodus Security Page](https://www.exodus.com/security)
- [Trust Wallet Security Overview](https://trustwallet.com/blog/security/complete-overview-of-trust-wallet-security)
- [The Hacker News - Trust Wallet Chrome Extension Breach Dec 2025](https://thehackernews.com/2025/12/trust-wallet-chrome-extension-bug.html)
- [Coinbase Wallet Security](https://www.coinbase.com/security/wallet-security)
- [AWS - Coinbase Programmable Wallets with Nitro Enclaves](https://aws.amazon.com/blogs/web3/powering-programmable-crypto-wallets-at-coinbase-with-aws-nitro-enclaves/)
- [Rabby Wallet - Is Rabby Wallet Safe](https://support.rabby.io/hc/en-us/articles/11495710873359-Is-Rabby-Wallet-safe)
- [Least Authority - Rabby Wallet Security Audit Report](https://leastauthority.com/wp-content/uploads/2025/09/Least-Authority-Rabby-Wallet-Wallet-Extension-Final-Audit-Report.pdf)
- [Brave - Brave Wallet vs MetaMask Comparison](https://brave.com/web3/difference-brave-wallet-metamask/)
- [Hacken - Atomic Wallet Hack Overview](https://hacken.io/discover/atomic-wallet-hack/)
- [Halborn - Atomic Wallet Hack Analysis](https://www.halborn.com/blog/post/explained-the-atomic-wallet-hack-june-2023)
- [Electrum Documentation FAQ](https://electrum.readthedocs.io/en/latest/faq.html)
- [Bitcoin Wiki - Wallet Encryption](https://en.bitcoin.it/wiki/Wallet_encryption)
- [Ledger - Key Ring Protocol](https://www.ledger.com/how-we-used-ledger-key-ring-protocol-in-ledger-live)
- [ZenGo - MPC Wallet Explained](https://zengo.com/mpc-wallet/)
- [ZenGo - How Security Model Works](https://help.zengo.com/en/articles/2603678-how-zengo-security-model-works)
- [CryptoSlate - Browser Extension Fatal Design Flaw $713M in 2025](https://cryptoslate.com/how-browser-extensions-expose-your-crypto-to-a-fatal-design-flaw-that-the-industry-ignored-bleeding-713m-in-2025/)
- [Cossack Labs - Temple Wallet Security Assessment](https://www.cossacklabs.com/case-studies/temple-wallet/)
- [CryptoNews - 10 Safest Crypto Wallets in 2026](https://cryptonews.com/cryptocurrency/safest-crypto-wallet/)
- [Coin Bureau - Is Trust Wallet Safe](https://coinbureau.com/analysis/is-trust-wallet-safe)
- [Coin Bureau - Is Coinbase Wallet Safe 2026](https://coinbureau.com/analysis/is-coinbase-wallet-safe)
- [SlowMist - Browser Wallet Extension Recovery Guide](https://slowmist.medium.com/how-to-recover-your-browser-wallet-extension-from-a-sudden-failure-082f8544b63c)
- [Hashcat Forum - MetaMask Iterations Update](https://github.com/hashcat/hashcat/issues/4022)