# Gem Wallet Completes Cure53 Security Audit > Gem Wallet has completed an independent Cure53 security audit - see what the experts reviewed and why it matters for your keys and crypto in the wallet. Gem Wallet has passed an in-depth security review by Cure53, with no critical or high-severity issues found in the wallet's Rust core or its iOS and Android apps, and every medium finding has been fixed or mitigated. The final report is dated October 21, 2026. For our users, it is one more reason to store, send, and swap crypto in Gem Wallet with peace of mind. ## What Is Cure53? Cure53 is a Berlin-based company that has specialized in application security audits since 2007. Its team brings together 30 independent experts, and the company has published more than 130 audit reports on its website. Cure53 is known for more than audits: the team created DOMPurify, an open-source tool that protects web applications from XSS attacks. Projects it has audited include 1Password, Mullvad VPN, Proton Pass, and Threema. ## What Cure53 Reviewed in Gem Wallet In September 2026, a team of four senior Cure53 testers spent 13 days on a penetration test and source code audit of Gem Wallet version 2.114.40. The audit followed a white-box approach: Cure53 had full access to the source code, reviewed it, and tested the iOS and Android release builds. The backend was not part of this audit. The audit focused on the Rust core that protects your keys in both apps: - **Encrypted Keystore:** How the wallet encrypts, stores, and deletes secrets, and how they pass between the Rust core and the apps. - **Keys and Signing:** Secret phrase import, account derivation, and transaction signing. - **Password Protection:** How the iOS and Android apps store and use the wallet password. ## Gem Wallet Audit Results Cure53 found no critical or high-severity issues. Of the 21 findings, 17 are already fixed or mitigated, including every medium finding, and Cure53 confirmed each fix in a follow-up review: - **Critical** - 0 - **High** - 0 - **Medium** - 6 (all fixed or mitigated) - **Low** - 10 (8 fixed) - **Informational** - 5 (3 fixed) The medium findings were about authorization on the device itself: for example, app lock was not turned on by default, and on a rooted Android phone the passcode check could be bypassed. Each of them required an unlocked or rooted phone in an attacker's hands, or a malicious app installed by the user. The four open items are low-severity or informational hardening suggestions. ## How Gem Wallet Protects Your Keys Cure53 traced wallet secrets end to end - import, encrypted storage, account derivation, signing, export, and deletion - and confirmed the foundations: - **One Rust Core for Both Apps:** The iOS (Swift) and Android (Kotlin) apps share the same Rust core. Everyday signing keeps decrypted private keys inside Rust; the apps only receive the signed transaction. - **Strong Encryption at Rest:** Each secret is encrypted with AES-256-GCM using a key derived with Argon2id, and the file header is authenticated as well. Cure53 found the Argon2id parameters in line with current recommendations and no nonce reuse. - **Protected Password Storage:** The wallet password is kept in the iOS Keychain or the Android Keystore. - **Secure Randomness:** Secret phrases, nonces, and salts come from a secure random source. - **Address Checks Across 56 Chains:** Derivation tests use fixed expected addresses, and all 56 chains that use a secret phrase matched. ## What We Fixed After the Audit Most of the fixes make app lock stronger. Gem Wallet now offers to turn it on when you create or import a wallet, and with app lock on, deleting a wallet asks for your passcode or biometrics. On Android, the wallet password is now always protected by an Android Keystore key, and with app lock on, that key requires your device PIN or biometrics, which closes the bypasses Cure53 found on rooted phones. We also hardened the apps themselves. On Android, dApps now return to Gem through a verified gemwallet.com link that no other app can claim. On iOS, your secret phrase and private key are hidden from screenshots, screen recordings, and the app switcher. In the Rust core, secret phrases and derived keys are now wiped from memory right after use. ## Why This Matters for Our Users Gem Wallet is a 100% [open-source](https://gemwallet.com/open-source-crypto-wallet/) self-custody wallet: your private keys are stored only on your device, and no one, including our team, has access to them. All of the code is open on [GitHub](https://github.com/gemwalletcom/wallet), so anyone can review the [audited version](https://github.com/gemwalletcom/wallet/releases/tag/2.114.40) and the fixes that followed. Open-source code shows how the wallet is built, and an independent audit confirms the wallet's [security](https://gemwallet.com/security/). Together, they give our users what matters most - confidence that their crypto stays under their control alone. ### Read the Full Cure53 Report 📄 [Gem Wallet Cure53 Audit Report (PDF)](https://static.gemwallet.com/audits/Gem-Wallet-Cure53-Audit-Report-October-2026.pdf) 📄 [Gem Wallet Cure53 Audit Summary (PDF)](https://static.gemwallet.com/audits/Gem-Wallet-Cure53-Audit-Summary-October-2026.pdf) Two independent audits, CertiK and Cure53, now stand behind Gem Wallet, and we will keep inviting independent experts to review our code. Update Gem Wallet to the latest version to get every post-audit fix - and manage your crypto securely and privately 24/7.