How STB is secured. Your recovery phrase and private keys are created on your phone and never leave it. Our servers store only public information (addresses and transaction history) and relay transactions your phone has already signed. There is no key on our side, so a breach of STB's servers cannot move your money, and support cannot move it either.
Every transaction is approved on the phone with Face ID, fingerprint or your passcode. The app locks when you leave it. Screens that show your recovery phrase block screenshots and screen recording, and the app refuses to show the phrase at all on a phone it detects as jailbroken or rooted, because those phones can bypass the keychain's protection.
Around each send, STB checks the recipient against sanctions and scam lists, applies your spending guardrails (daily caps, an allowlist of trusted addresses, quiet hours), and honours Freeze, which stops every outbound transaction through STB the moment you turn it on. Freeze and guardrails are tied to your account, so you can turn Freeze on from another device you are signed in on.
What those protections cannot do. Guardrails and Freeze control what moves through STB. They cannot stop someone who already holds your recovery phrase, because the phrase works in any wallet software, outside STB entirely. That is the trade self-custody makes: no company can freeze or lose your money, and no company can claw it back either.
If you think your phone is compromised
- 1
Turn on Freeze: Settings → Security → Freeze, on this phone or any other device where you can sign in.
It takes effect immediately and stops sends, autopay runs and stream settlements made through STB. Receiving continues.
- 2
On a clean device, install STB and create a new wallet with a new recovery phrase.
Do not restore your old phrase. If it was exposed, any wallet made from it is exposed too.
- 3
Move your funds from the old wallet to the new one as soon as you can.
This is the only step that protects you from someone who has your phrase. Lift Freeze on the old wallet when you are ready to send from it, then move everything in one sitting.
- 4
Write the new phrase down on paper, store it offline, and set up guardians for recovery.
Good to know
- A lost or stolen phone that the thief cannot unlock is a different case from a hacked one. Your keys stay protected by the keychain and biometrics; freeze, restore onto a new phone from your recovery phrase, and move funds only if you think the phrase itself was exposed.
- Most thefts happen through the phrase, not the phone: a fake support agent, a website or a form asking you to type your words. STB will never ask for your recovery phrase, in the app, by email or in chat.
- Keep your phone's operating system up to date and do not install apps from outside the official app stores. Device security is the foundation the wallet's protections sit on.
Frequently asked
No. STB never holds your keys, so it has no way to move, freeze on-chain or reverse your funds. Blockchain transfers are final. What STB can do is stop transactions that go through the STB app, which is what Freeze is for.
Not through the servers. They hold only public data such as addresses and transaction history, and every transaction must be signed on your phone with your keys before it can move anything.
Only for transactions made through STB. A person holding your phrase can use any other wallet app, where STB's Freeze and guardrails do not apply. Moving your funds to a wallet with a new phrase is the fix.
The wallet runs, but STB refuses to display your recovery phrase on a phone it detects as jailbroken or rooted, because those phones can bypass the keychain's protection. We recommend not keeping meaningful funds on such a device.
STB supports a passphrase-protected hidden wallet: the same recovery phrase plus a passphrase opens a completely separate wallet that nothing on the device reveals. Keep a small balance in the ordinary wallet and the rest in the hidden one.
Get SpendTheBits
A fully non-custodial wallet for 13 chains, free on iOS and Android. Your keys never leave your phone.