Cobalt Wallet security model

Cobalt Wallet is a self-custody interface to the public XRP Ledger. It is not an exchange, broker, or money transmitter, and it never takes possession of customer funds.

There is no Cobalt account, no login, and no server-side wallet. Your XRP and issued tokens live in an XRPL account that only your recovery phrase controls. If you delete the app without your phrase, Cobalt cannot restore access — and neither can anyone else.

A 12- or 24-word BIP39 recovery phrase is generated locally from the operating system's cryptographic random source (crypto.getRandomValues). The phrase is verified against its BIP39 checksum before an account is derived from it.

You may add an optional 25th word. It is never stored anywhere, so a stolen phrase alone opens nothing — and forgetting it makes the account unrecoverable.

The seed is sealed in a local vault with AES-256-GCM (authenticated encryption). Nothing leaves the device: there is no key escrow, no backup upload, and no telemetry containing key material.

The vault key is derived one of two ways. With biometrics, a hardware-backed passkey produces the key via the WebAuthn PRF extension, so the key material is bound to the secure element. With a passcode, your 6-digit code is stretched through 600,000 rounds of PBKDF2-SHA-256. On native builds the encrypted vault sits in app-private storage with device backup disabled, so it is never copied into iCloud or Android Backup.

Every transaction is signed locally and submitted straight to public XRPL nodes over TLS. Cobalt never sees an unsigned or signed transaction on a server, because there is no server in the signing path.

Before a signature happens, the guards you control in Settings apply:

• Biometric signing — a fresh Face ID / Touch ID / Windows Hello check is required for each signature, so an unlocked phone left on a table cannot send funds.
• Hold to confirm — signing needs a sustained press, never a single tap.
• Checksum confirmation — the recipient address fingerprint must be acknowledged before a payment is signed.
• Large-transfer guard — amounts above your threshold require a second confirmation.
• Auto-lock — the decrypted seed is dropped from memory after your idle timeout, and on every app background or reload.

No account, no email, no name, no analytics profile, and no recovery phrase ever reaches Cobalt. The app makes outbound requests only to public XRPL nodes, public market-data endpoints for prices, and — if you choose to buy or sell — the regulated provider you pick, which runs its own KYC. You can disable price lookups in Settings for XRPL-only traffic.

Cobalt never creates a trustline silently. Issued tokens are shown with their issuer address and a risk label, and removing a trustline returns the reserved XRP to your balance. Third-party venues linked from Buy and Sell are independent businesses; Cobalt does not hold, route, or insure funds on those platforms.

XRPL payments are final. A wrong address, a missing destination tag, a phishing site that tricks you into typing your phrase, malware on a compromised device, or a lost phrase cannot be reversed by Cobalt. Market losses, token issuer failures, and third-party venue failures are equally outside our control.

The app ships with locked-down native configuration (no cleartext traffic, no device backup of the vault, HTTPS-only web content, biometrics declared for Face ID) and is covered by the standard cryptography export declaration. Independent security review and funded-account mainnet testing are the final gates before wide release.

Report a security issue to support@cobaltwalletxrpl.app. Never include your recovery phrase, passcode, or private key in a report — no one at Cobalt will ever ask for them.