Is Cake Wallet safe?
Cake Wallet is a legitimate, open-source, self-custody wallet that has operated since 2018, and for most users it is safe when installed from an official source and backed up properly. Its worst incident was weak Bitcoin seeds created by versions from 2020–2021, which Cake disclosed in May 2021. Most real-world losses come from fake apps, phishing and shared seeds, not from the app itself.
"Safe" has two parts for a self-custody wallet: whether the software protects your keys, and whether you can avoid the scams around it. This page covers both, with dates, as of October 2026.
The short answer
- Legit: yes. Cake Wallet is made by Cake Labs, has been on the App Store since 2018, and publishes its code on GitHub under the MIT licence.
- Your keys stay with you: on-chain coins are non-custodial. Cake cannot freeze, reverse or recover your funds.
- Not flawless: it had one serious flaw (weak Bitcoin seeds in 2020–2021), one moderate advisory in 2026, and builds that cannot be reproduced independently.
- Biggest risk: people, not code. Fake apps, fake support and seed theft account for most losses we see discussed.
Security factors
| Factor | Status (October 2026) |
|---|---|
| Custody | Non-custodial for on-chain coins; keys created and stored on your device |
| Source code | Public on GitHub, MIT licence |
| Reproducible builds | No; Cake says its builds are not yet reproducible |
| Signed releases | In September 2026 Cake published a release key for signing checksum files and release tags; releases without a signed checksum file list SHA-256 hashes in the notes |
| Independent audit | None of the app found |
| Vulnerability reporting | Security policy with a private GitHub advisory channel and an encrypted email address |
| Account or KYC | None for the wallet |
| Data collection | App Store label says "Data Not Collected" (self-reported by the developer) |
| App protection | PIN, biometrics, optional Cake 2FA, Duress PIN |
The 2020–2021 weak Bitcoin seeds
This is the incident that matters most. Cake Wallet versions released in 2020 and early 2021 generated Bitcoin wallets with an insecure random number generator. The affected seeds are 12-word Electrum-style ("Segwit") Bitcoin seeds. Researchers estimate the effective randomness was so low that the keys can be reconstructed by an attacker.
| Date | Event |
|---|---|
| 10 May 2021 | Version 4.1.7 changes how Bitcoin seeds are generated |
| 11 May 2021 | Version 4.2.0 adds an in-app banner asking users to recreate wallets; in May 2021 Cake publicly discloses the problem and tells users to create new wallets and move funds |
| December 2023 | Cake adds an in-app warning for users who still use a known weak seed (code merged 18 December 2023, shipped around version 4.12.0), using data on more than 8,700 wallets supplied by the Milk Sad researchers |
| May 2024 | The Milk Sad team publishes a technical write-up |
| From 21 May 2024 | Researchers judge larger outgoing transactions from weak wallets to be mostly malicious |
The researchers counted 8,757 weak wallets and about 548.9 BTC that moved through them between November 2020 and October 2024; not all of that was stolen, and no total loss figure has been published (Milk Sad research update, 2024). Monero, Litecoin and other coins were not affected, as far as is known.
What to do: if you have a 12-word Bitcoin seed created in Cake Wallet in 2020 or early 2021, or you imported such a seed into another wallet, treat it as compromised. Create a new wallet with a current version and move any remaining funds at once. Our seed type checker helps you identify the seed type by word count only. Never type the words themselves into a website.
What open source does and does not prove
Open-source code lets anyone read how Cake Wallet creates keys, talks to nodes and builds transactions. It is how outside researchers were able to study the 2021 seed flaw in detail, and it means changes to the code happen in public on GitHub.
It does not prove that the app in the store was built from that code. Cake says its builds are not yet reproducible, so you cannot compile the code yourself and get an identical file to compare (Cake Wallet VERIFY.md, 2026). What you can check is that a download is authentic: in September 2026 Cake published a release key for signing the checksum files and tags of new releases, every release lists SHA-256 hashes, and Android APKs from GitHub, Accrescent and Cake's F-Droid repository share one signing certificate. Our download guide shows how to check both.
We also found no published independent security audit of the Cake Wallet app as of October 2026. Cake does run a vulnerability disclosure policy: researchers can report issues privately through GitHub or by encrypted email, and Cake publishes advisories once fixes ship.
Other advisories
On 4 September 2026 Cake published GitHub advisory GHSA-695v-fhpj-fv8x, rated moderate. In versions 6.1.2 to 6.3.0, an Ethereum-style payment request could be prepared on the wrong EVM network because the chain ID was dropped. The risk was a failed or misdirected payment, not key theft, and it was fixed in 6.4.4. Update to the latest version. The full list of incidents is on our security history page.
The Lightning question
Lightning, added in version 6.0 (February 2026), runs on the Spark network through the Breez SDK. Cake describes it as self-custodial, with no channels to manage. Its docs also say that Spark transfers are co-signed by a small, permissioned set of operators who can see amounts and addresses (Cake Wallet docs, 2026).
On 6 October 2026 WalletScrutiny reclassified Cake Wallet as "Custodial" because, in its analysis, the app offers no way to move a Lightning balance back on-chain without the operators. That is a judgement about the Lightning balance only; it does not concern Monero, on-chain Bitcoin or other coins. A cautious approach is to keep only spending money in Lightning. See Lightning in Cake Wallet.
Privacy versus safety
Cake Wallet connects to Cake's own nodes and services by default. That is convenient, but those services can see your IP address and which wallet data you request. For more privacy, use your own node or Tor. One caveat: for Silent Payments, if your own Bitcoin server lacks the required index, Cake's docs say the app falls back to a Cake server. Details are in privacy and Tor and custom nodes.
Where losses really happen
- Fake apps and clone websites that ask for your seed. Install only from the official sources in our download guide and check links with the download checker.
- Fake support. Cake Wallet says its support will never ask for your seed, and that anyone who messages you first offering support is almost always a scammer (Cake Wallet docs, 2026).
- Seed stored online in screenshots, notes apps, cloud drives or email.
- Wrong address or network. Transactions cannot be reversed. Use the address checker and send a small test first.
- "Recovery" services promising to get stolen crypto back. They are scams.
More warning signs are in fake Cake Wallet apps and scams.
Safety checklist
- Install from the App Store, Google Play, Accrescent, Cake's F-Droid repository or GitHub, reached by typing cakewallet.com yourself.
- Keep the app updated.
- Write each seed on paper and store it offline. For a 25-word Monero seed, also write down the restore height. See seed backup.
- Set a strong PIN; consider Cake 2FA. Cake notes that 2FA helps against someone with your phone, not against someone with your seed.
- For larger amounts, use a hardware wallet or Cupcake. See Ledger and Trezor.
- Replace any old Cake Bitcoin wallet with a 12-word Electrum seed from 2020–2021.
- Never share your seed, and ignore anyone who contacts you first.
If you think your wallet is compromised
Cake's advice is to create a new wallet for each affected coin immediately and move any remaining funds there, stop using the old wallet, keep a record of everything, and report the theft to the police and to Cake support (Cake Wallet docs, 2026). Monero wallets can take longer for an attacker to sync, which may give you a short window to act. Never send more money to "recovery" helpers.
Frequently asked questions
Is Cake Wallet legit?
Yes. It is a real, open-source wallet made by Cake Labs and available on the App Store since 2018. Fake copies exist, so install only from official sources.
Has Cake Wallet been hacked?
We found no breach of Cake's own systems that exposed user funds. The serious issue was weak Bitcoin seeds generated by versions from 2020–2021, and researchers judge that larger outgoing transactions from those wallets have been mostly malicious since 21 May 2024, where users never moved their funds.
Can Cake Wallet see or freeze my funds?
No, not for on-chain coins. Cake cannot freeze, reverse or recover transactions. Cake's servers can see your IP address unless you use Tor or your own node.
Is Cake Wallet safe for large amounts?
For larger sums, pair it with a Ledger or Trezor, or use Cupcake as an offline signer, and keep the seed backup offline.
Does Cake Wallet support ever message you first?
Cake Wallet says anyone who messages you first claiming to offer support is almost always a scammer, and its support will never ask for your seed.
Are my Monero funds affected by the 2021 seed flaw?
No. The flaw affected 12-word Electrum-style Bitcoin seeds created in 2020 and early 2021, not Monero seeds.