Security updates
Frostsnap is designed so that no single point can be attacked to take your bitcoin: your devices and your phone keep each other honest, and nothing is trusted on its own. This page lists the security issues where we fell short of that goal, the version that fixed each one, and what you need to do. Each entry has a bulletin for users and a technical report for engineers.
Download the latest Frostsnap app
FSA-2026-001 · Announced 27 August 2026 · Fixed in v0.4.0
A malicious app could trick your devices into signing a hidden output
A signing request can mark an output as belonging to your own wallet. The device left such outputs off its confirmation screen and never checked the claim, so a request could send funds to a key you do not own, at an address that never appeared on the device.
FSA-2026-002 · Announced 27 August 2026 · Fixed in v0.4.0
Change addresses beyond the recovery range
Change from a payment could land past the range a wallet recovery scans, so recovering a wallet might not find every coin.
We know of no bitcoin lost to any issue on this page.
Scammers treat announcements like this as an opportunity. Updating needs nothing from you: no backup, no recovery phrase, no personal details. Frostsnap will never ask for your backup. Download the app from our official sources. After you update the app it will prompt you to update your devices' firmware; that prompt is expected.
Report a security bug
Email security@frostsnap.com. Our security page has the disclosure policy, the bug bounty, and our PGP key.