Key Highlights
- Oath Wallet published an official security statement on November 6, 2026, clarifying that its users and systems were not impacted by the reported vulnerabilities affecting Trust Wallet and other crypto wallets.
- The self-custody iOS wallet said it protects seed phrases locally using Secure Enclave, biometric authentication, AES-GCM encryption, and device-bound iOS Keychain, and that it never stores recovery phrases, private keys, or user funds on any servers.
- Oath Wallet emphasised its 100% open-source code, including version 4.1.15 available on GitHub under the MIT licence, and reminded users to keep devices updated, review transaction approvals carefully, and never share recovery phrases with anyone claiming to represent support.
Oath Wallet published an official security statement on November 6, 2026, addressing reports of fund losses and vulnerabilities affecting Trust Wallet and other cryptocurrency wallets. The self-custody iOS wallet clarified that its users and systems are not impacted by the reported issues.
The statement, posted on the official @OathWallet X account, outlined three main points on seed phrase protection, user control, and transparency. It came one day after an earlier post expressing support for affected Trust Wallet users and calling for clear, evidence-based answers.
Seed Phrase and Local Protection
Oath Wallet confirmed it is not affected by the recently reported security vulnerability. The app uses advanced iOS security mechanisms, including Secure Enclave technology, to protect sensitive information locally on the device.
Access to the secret recovery phrase requires user authentication through biometric verification such as Face ID or Touch ID, or a password set during wallet creation. Key material that authorizes transactions is stored in an encrypted local vault. The implementation relies on AES-GCM encryption combined with device-bound iOS Keychain protection.
In a related post on November 5, the team noted that a wallet vulnerability, a compromised device, and a malicious transaction approval represent distinct problems. Understanding the difference is necessary before determining causes or prevention steps.
Self-Custodial Design and User Control
Oath Wallet is fully self-custodial. The company does not store secret recovery phrases, private keys, or sensitive wallet information on any servers. Users retain complete control and responsibility over their keys and digital assets, with no reliance on a third party for access or withdrawals.
The app generates the recovery phrase on the device, encrypts it, and stores it locally. Oath never receives the phrase and never holds user funds. Optional encrypted iCloud backup is controlled by the user and requires a separate password. The public source code for recent versions, including 4.1.15, is available under the MIT licence on GitHub, allowing inspection of signing functions and storage methods.
Transparency Through Open Source
Oath Wallet is 100% open-source. Anyone can inspect the source code, independently audit the security architecture, verify operations, contribute improvements, modify the code, or build and run it locally. The team stated that true security begins with transparency rather than promises. Protecting user privacy and digital assets remains the core focus of development. The statement closed by emphasising that these protections stay central to everything the project builds.
The statement responds to reports of users losing funds from various wallets, such as Trust Wallet and Keystone. Oath previously noted that every balance represents someone’s savings, work, and trust. It stood with affected users while cautioning against premature conclusions about the root cause.
Oath is a free, open-source Bitcoin and multi-chain crypto wallet for iPhone and iPad, previously known as Aperture Wallet. It supports more than 20 networks and requires no account, email, or KYC. As of late October 2026, the app had reached 5 million downloads on the App Store.
Users are advised to keep devices and the wallet app updated, carefully review transaction approvals, and never share a recovery phrase or private key with anyone claiming to represent support. Official channels remain the only verified source for information and updates.
