Gem Wallet Completes Cure53 Security Audit

Gem Wallet has passed an in-depth Cure53 security audit, with no critical or high-severity issues found in the wallet’s Rust core or its iOS and Android apps, and every medium finding has been fixed or mitigated. The final report is dated October 21, 2026. For our users, it is one more reason to store, send, and swap crypto in Gem Wallet with peace of mind.

What Is Cure53?

Cure53 is a Berlin-based cybersecurity company that has been running penetration tests and auditing code, infrastructure and cryptography since 2007. It was founded by Dr.-Ing. Mario Heiderich, who holds an engineering doctorate in web security, and its 30 independent security researchers include holders of doctorates in engineering, applied cryptography and physics. Cure53 has published more than 130 audit reports on its website.

Cure53’s work protects far more than its clients: the team created DOMPurify, an open-source library that guards web apps against XSS attacks and is downloaded by developers tens of millions of times every week. Its reports are trusted by the teams behind 1Password, Mullvad VPN, Proton Pass, Threema and Bitwarden - products whose whole promise to users is privacy and security.

What Cure53 Reviewed in Gem Wallet

Gem Wallet was audited by four senior Cure53 auditors: Cure53 founder Dr.-Ing. Mario Heiderich, Dr. Alexander Pirker, Dr. Nadim Kobeissi and MSc. C. Mayr. Gem Wallet commissioned the audit in July 2026, and in September 2026 the auditors spent 13 days on a penetration test and source code audit of Gem Wallet version 2.114.40. The audit followed a white-box approach: Cure53 had full access to the source code, reviewed it, and tested the iOS and Android release builds. The backend was not part of this audit.

The audit focused on the Rust core that protects your keys in both apps:

• Encrypted Keystore (v4 Keystore and UniFFI Secret Boundary): How the wallet encrypts, stores, and deletes secrets, and how they pass between the Rust core and the apps.
• Keys and Signing (Derivation, Import and Signing Primitives): Secret phrase import, account derivation, and transaction signing.
• Password Protection (iOS/Android Password Custody): How the iOS and Android apps store and use the wallet password.

Gem Wallet Audit Results

Cure53 found no critical or high-severity issues. Of the 21 findings, 17 are already fixed or mitigated, including every medium finding, and Cure53 confirmed each fix in a follow-up review:

• Critical - 0
• High - 0
• Medium - 6 (all fixed or mitigated)
• Low - 10 (8 fixed)
• Informational - 5 (3 fixed)

The medium findings were about authorization on the device itself: for example, app lock was not turned on by default, and on a rooted Android phone the passcode check could be bypassed. Each of them required an unlocked or rooted phone in an attacker’s hands, or a malicious app installed by the user. The four open items are low-severity or informational hardening suggestions.

How Gem Wallet Protects Your Keys

Cure53 traced wallet secrets end to end - import, encrypted storage, account derivation, signing, export, and deletion - and confirmed the foundations:

• One Rust Core for Both Apps: The iOS (Swift) and Android (Kotlin) apps share the same Rust core. Everyday signing keeps decrypted private keys inside Rust; the apps only receive the signed transaction.
• Strong Encryption at Rest: Each secret is encrypted with AES-256-GCM using a key derived with Argon2id, and the file header is authenticated as well. Cure53 found the Argon2id parameters in line with current recommendations and no nonce reuse.
• Protected Password Storage: The wallet password is kept in the iOS Keychain or the Android Keystore.
• Secure Randomness: Secret phrases, nonces, and salts come from a secure random source.
• Address Checks Across 56 Chains: Derivation tests use fixed expected addresses, and all 56 chains that use a secret phrase matched.

Gem Wallet Fixes After the Cure53 Audit

Most of the fixes make app lock stronger. Gem Wallet now offers to turn it on when you create or import a wallet, and with app lock on, deleting a wallet asks for your passcode or biometrics. On Android, the wallet password is now always protected by an Android Keystore key, and with app lock on, that key requires your device PIN or biometrics, which closes the bypasses Cure53 found on rooted phones.

We also hardened the apps themselves. On Android, dApps now return to Gem through a verified gemwallet.com link that no other app can claim. On iOS, your secret phrase and private key are hidden from screenshots, screen recordings, and the app switcher. In the Rust core, secret phrases and derived keys are now wiped from memory right after use. All of these fixes are available in Gem Wallet version 2.114.73 and later.

Why This Matters for Our Users

Gem Wallet is a 100% open-source self-custody wallet: your private keys are stored only on your device, and no one, including our team, has access to them. All of the code is open on GitHub, so anyone can review the audited version and the fixes that followed.

Open-source code shows how the wallet is built, and an independent audit confirms the wallet’s security. Together, they give our users what matters most - confidence that their crypto stays under their control alone.

Cure53 Audit Report (PDF)

📄 Gem Wallet Cure53 Audit Report (PDF)

📄 Gem Wallet Cure53 Audit Summary (PDF)

Two independent audits now stand behind Gem Wallet - CertiK in April 2026 and Cure53 in October 2026 - and we will keep inviting independent auditors to review our code. Update Gem Wallet to the latest version to get every post-audit fix - and manage your crypto securely and privately 24/7.

Disclaimer: This article is for informational and educational purposes only and is not financial or investment advice. Crypto assets are highly volatile, and you can lose all the money you invest. Do your own research and make decisions at your own risk.